I am setting up frigate NVR on my TrueNAS server. For this I will be using a managed switch, with a VLAN for each camera.
I want my cameras to access my TrueNAS server which is on the same switch. My server has a single interface however, and it is my understanding that I will need to use VLAN tagging to allow my single NIC to be split amongst the different camera VLANs.
The issue is that my interface is BRIDGED since i have multiple LXCs running which need to access the internet. When I configure a VLAN on TrueNAS, I see no option to have br0 as the parent interface for VLAN tagging.
I can try to select my enp interface from my NIC, however since it is a member (the only member) of br0, I do not see how this will work. When I configured the bridge, I do not know if the bridge is configured as VLAN aware as there is no option for this.
Does anyone have a suggestion to help me fix this issue? Can I choose enp as the parent interface even though it is bridged? Is there a way to use the CLI to make a VLAN with br0 as the parent interface? Can I make br0 VLAN aware? I am not sure how to dix this.
Obviously, an easy fix is to purchase an L3 switch which allows inter-VLAN routing, and have my server on its own VLAN, and allow the switch to route traffic between VLANs. I think however that I would still need to configure the TrueNAS interface as its own VLAN, and the issue about that interface already being bridged still remains.
Sorry for the long post, just had to explain my train of thought.
Why are all the cameras on different vlans? Is this a requirement of Frigate? (I have no experience with it). Overall this sounds like an extremely complicated setup. You shouldn’t need an L3 switch just to connect a few cameras. Am I missing something?
Yes I might be over complicating it, I’m slowly learning about networking so you might be right. To answer your question, most recommend that each camera be in its own VLAN since it is more secure. This is generally the recommended approach.
As for the L3 switch, I realized after posting that I do not need this as I can let my router forward traffic between VLANs.
I suppose the root of my question is as follows: Can I use my NIC as the parent interface of a VLAN even if it is a member of a bridge? The rest of the context is unimportant, sorry.
What?? Each camera in its own VLAN? I have never seen such a recommendation. A VLAN for the cameras that only the NVR can access sure, but just one for all the cameras.
For me, at least, that translates to: “I don’t whant to tell you why I want to do it, but I want to do it. Please tell me how” .
Could it be that a customer of yours has heard the term VLAN and now automatically associates it with “security,” and therefore wants to put every single camera into its own VLAN, even though that makes no real sense? And could it be that you don’t actually want to tell them that it doesn’t make any sense?
It is more secure, especially if you have different camera vendors. One camera getting compromised will have no effect on other cameras because they are on different VLAN, and can not be reached by the compromised camera. If you have 10 cameras on single VLAN, and one of them gets compromised, you are risking all of them being compromised. And when i say compromised, i mean, they can be accessed and viewed if they have RTSP or web UI support. This makes sense if you are letting your cameras reach the internet. This is, in my opinion, very stupid idea. Not to mention complexity of configuring and securing everything. Its much better and secure to put all cameras on single VLAN, but block them from accessing internet. Allow them to communicate with internal network only. And then configure external access with netbird or tailscale so you can access whatever DVR/NVR service you have. You cant trust camera firmware or their applications being secure. Its a recipe for disaster.
