How does "Block Internet Access" work (and other questions)

[distilled]

This is very probably going to be a dumb, or at least redundant question, but I could not find it addressed anywhere with a few searches. I apologize in advance, but I travel frequently these days, and do not have the time to learn through experimentation, as would be my preference.

As I travel, I keep an eye on my homes using home security cameras that are connected via site-to-site OpenVPN configured in Merlin. This works extremely well, it is fast, and it allows me to easily extend the VPN to various devices within each residence, so I can pull up the cameras on phones, tablets and televisions (TinyCam Pro) and PCs running NVR software (Blue Iris). I have started tweaking things using YazFi to segment camera traffic from "human" internet, and also to compartmentalize "gadget" type IoT traffic (Home Assistant, light switches etc). YazFi sends the groups through different commercial VPN services, to help confound analytics. I would love to be able to selectively route certain groups (like televisions) around the VPN for Netflix, Amazon and the like, but haven't figured out how to do that yet. Time is limited, heck, typing this post is taking more than I have right now, but I am hoping someone might be able to point me in the right direction, thereby lowering the risk that I will crash one of the VPN routers while experimenting. Nothing like sawing off the branch you are sitting on, right?

So. I very much would like to avoid having the cameras leak anything to the net. P2P is disabled, but I would feel even better using the "Block Internet Access" option in the related clients, just to be sure. However, this kills VPN connectivity. Is this because OpenVPN is using interface type TUN, thereby giving the VPN clients a different IP scope, so it sees the VPN's RFC 1918 address as "internet" and blocks it? ? If I set it up in TAP mode so it bridges instead of routing, will Block Internet Access allow me to connect? Would it kill the VPN changing this? The houses are on opposite coasts, so it is a pretty long walk just to undo a little booboo.

I would also like to be able to use the X3mrouting script to selectively route some of the YazFi networks, and at least one thread mentioned using X3mrouting with YazFi, but it was over my head.
I know this post contains more information than is probably necessary, but folks here seem to enjoy a challenge, and I am hoping my verbosity is more likely to engage.

If it matters, two of the VPN endpoints run an 86u and one a 68u.

93's,

 

[martinr]

I don’t know how Block Internet access works or how it differs from IoT Blocking in Skynet. But...

“Skynet can also be used to secure IOT device and prevent them from phoning home.”

So if you are running Skynet, it certainly is worth trying.


Option 2 in amtm then Option 11
and Option 11 again.

https://www.snbforums.com/threads/release-skynet-router-firewall-security-enhancements.16798/

And if you aren’t yet running Skynet, then you really should consider it, and I expect its IoT Blocking will do what you want.

 

[distilled]

Thank you martinr, I do run Skynet and feel better for it. I have seen IoT Blocking, but haven't thoroughly delved into what it can do.

I am not sure it will do what I need, though. Some devices I have actually need to call home, so I push them off onto an isolated guest network, and route them through a VPN. Also, it isn't simply a matter of them calling home, I want them segregated so they cannot be used as a pivot point, or as a way of promiscuously gathering data from my LAN.

This probably sounds paranoid, and I am willing to compromise with the future by adopting some gadgetry, but I want to mitigate the risk. If I were younger and had my whole life and career in front of me, I would be much more careful with my privacy, but with old age knocking, I want to find a happy medium between the cool AI powered future that we seem to be moving towards somewhat blindly, and the old fashioned security of a wall safe protected by a shotgun.

 

[rgnldo]

Would a manageable switch do the trick?
More reliable

 

[distilled]

I intend to set up a managed switch and VLANs at each location, but haven't done it yet. I may have to do that while I am here, and catch each location up by attrition, as time permits. Naturally, it will require physical presence, so for the moment, I am limited to that which can be done logically.

Thanks rgnldo, that is absolutely my long term plan.