As I am slowly expanding my smart home setup, I am getting more and more matter devices. However I’ve been avoiding matter over wifi devices as they completely break my network segmentation currently.
Network Setup
- Main VLAN for most of my devices
- IoT VLAN for IoT devices
- A few other VLANs irreleant to my smart home
No IPv6 is enabled on any of them from the router side.
Smart Home Setup
My smart home uses Home Assistant exclusively, everything goes through here. No Apple Home, Google, Alexa or Samsung nonsense currently.
Home Assistant
Home Assistant is on the main VLAN. It is exclusively accessed through a reverse proxy that is also on the main VLAN. Access is exclusively IPv4.
Matter over Thread setup
My thread border router is using a Open Thread Border Router instance on the Home Assistant system, which connects to a SLZB-06MU radio over Ethernet. The SLZB-06MU lives on the IoT VLAN.
Because of the OTBR instance here, everything on my main network is getting an IPv6 address in order to talk to thread devices.
Adding more Thread border routers
I would like thread border routers to live on the IoT network but currently I have to have them on the main network.
Matter over Wifi
I would like Matter over Wifi devices to live on the IoT network, but since they need IPv6 to function they have to be on the main network or else they won’t be able to function. Currently I’ve been resorting to simply using the manufacturer’s apps (only matter over wifi devices I currently have are Tplink smart plugs) but I would like to ditch the reliance on TPLink app entirely since they are matter enabled devices.
What I am thinking
Move the Home Assistant server to the IoT network, reconfigure my reverse proxy and call it a day. Are there better ways to handle this?
You don’t have to move HA to the IoT network. I have a similar config to you where I have a VLAN without internet access for the IoT devices, then have HA (both HA and python-matter-server docker containers) in my local servers VLAN. I run OpenWRT on my router and was able to setup an avahi mDNS reflector there, forwarding mDNS between the VLANS is required for matter. Then, created appropriate firewall rules, see my config below. You do need to configure IPv6 on the IoT network and network HA is on, but you can just use ULA addressing for this, you don’t need to use globally routable IPv6 addresses if you don’t want to. I have ULA-only on the IoT VLAN and both ULA and GUA on the servers VLAN.
Here’s the firewall rules I used on OpenWRT. The wierd-looking IPv6 address is negative netmask notation, it covers both the GUA and ULA address for the homeassistant server by specifying a match for the suffix instead of the prefix. I think it may be specific to openwrt, haven’t seen it elsewhere.
```
config rule
option name 'homeassistant-MDNS-v6'
option src 'homeassistant'
option dest_port '5353'
option target 'ACCEPT'
option proto 'udp'
option dest_ip 'ff02::fb'
option family 'ipv6'
config rule
option name 'homeassistant-iot-matter-v6'
option src 'homeassistant'
option dest 'iot'
option target 'ACCEPT'
option family 'ipv6'
option dest_port '5540'
list src_ip '::7:0:0:0:2/-60'
option proto 'tcp udp'
config rule
option name 'iot-MDNS-v6'
option src 'iot'
option dest_port '5353'
option target 'ACCEPT'
option proto 'udp'
option dest_ip 'ff02::fb'
option family 'ipv6'
Here’s my config changes I made for avahi-daemon config as well. Use the actual bridge or hardware device names for allow-interfaces, not the zone names here.
[server]
use-ipv4=no
use-ipv6=yes
allow-interfaces=br-hass,br-iot
[reflector]
enable-reflector=yes
reflect-ipv=no