If I couldn't trust my company on my home network, why would I work for them?

> If I couldn't trust my company on my home network, why would I work for them?

Your employer isn't your friend.

It might be an awesome company to work for perhaps, but it's still a company (unless you work for like a 2 person startup). A company subject to audits and regulations and all kinds of other pressures (some of them actually valid, though many are theater) to monitor and control data and flows on their hardware.

You don't want those monitors etc on your personal data and network which has nothing to do with work.

So, keep them separate is the best possible advice.

Yes my company monitors the network at work and on my work computer, as they must do so.

But they are not allowed to scan my home network and other devices, and they have no reason to break the law. I trust them to not do that more than half of the devices running on my home network.

Many of these technologies have been built in the assumption of a world where they run in the company LAN.

No reason to trust, better to isolate.

My employers laptop is in a separate VLAN. What makes you sure that no-one else than the employer has access to it. This laptop has Windows 10 installed for example. And a shit-ton of McAfee crap. I would trust my employer but not the many companies who have a foothold on the machine as well because my employer is too cheap to install decent stuff on it.

I work frim home ... pandemic and all that. What else am I supposed to do?

VLAN is the obvious and most cost-effective mitigation

Not really. VLAN provides segmentation, but it does not provide any mechanisms to limit access to other vlans in your network - which are most likely routed by your router. You will need to add some L3 filtering (acls/iptables/whatever) to isolate segments.

That's only true if use of VLAN tags is controlled by hosts; if you use a smart switch to assign VLANs to ports it's pretty much as-if you have multiple, physically separated networks.

You'd still need the router to tag/untag those VLAN's and allow traffic to flow. So if the router does VLAN tagging but just routes between the different network segments you haven't fixed anything.

You'd also need a firewall, and to configure it correctly.

All nice, but now you need managed switches and stuff plus some amount of unbillable time to configure it all and fix it when it breaks. Might be worth it if your bill rate accommodates it though.

Segmenting your broadcast domains doesn't help much if traffic is routed freely between them.

Sounds like a great approach. Any recommendations for such a switch for WFH?