Good post. And i would like to add for anyone to be able to use hypervisor escape, you also need a vulnerability in the software presented to the internet. And even then, the chance that anyone would waste a zero day on a homelab is pretty slim…

Idk know if you can still get the ifan03, but I personally use an ifan04-H (230v 50hz) with esphome flashed on it.

Nah, I have it as a vm on a 2u server. I used to have it on a 1 metre extension also, and as soon as I changed the aqara devices, network was stable. I only changed the adapter because I wanted one on LAN.

I used to have a sonoff zigbee 3.0 stick, which was a good device. But back then I still had problems. It probably depends on how many devices you have, but for me, especially when I had a lot of aqara router devices, they took down the whole network from time to time. And they would constantly fall out of the network. I still have one socket switch left, and it triggers by turning on the light in the same room(IKEA switch). There is no automation linked for this… Only solution is to downgrade the firmware of the socket switch several versions.

I’d just like to warn about the reverse way, using aqara products on a general hub. I’m running HA with z2m myself, and used to have a whole array of aqara devices. They caused me nothing but problems, so I have slowly phased them out to similar devices which actually follow the zigbee standard.

Yeah I know, i have turned down 2 potential ISPs already, because they use cgnat. Too bad, because they are cheaper. Just wish ipv6 would really catch on soon.

Yeah, I just made a quick script that queries my public IP every 5 minutes, then changes the a-records via the registrar’s API, if it detects a change.

My ISP only have static ipv4 available for businesses. The price increase is quite a lot. I have been experimenting with ipv6, though I will loose connection when I am at someone else’s WiFi with no ipv6… It’s there as a fallback for now.

I don’t really see why you shouldn’t… I have mine behind a reverse proxy, which puts SSL on the public endpoint. The biggest “issue” today, is the isp rotating my ipv4 address to often.

I have a 7 year old LG Smart TV(webos), on a vlan without internet access. Using the built in integration "LG WebOS TV” for automations. I used to use WOL for turning the TV on, but nowadays it seems like my shield works fine to turn it on over CEC.

If you are worried about the security of the brand name WiFi router, i would just try to set up pfsense on a stick(need only one NIC). I am pretty sure i have seen an official guide for that.

So basically, you plug your switch (access port) to the isp router, and plug the pfsense box into another port(trunk port) on your switch. Define a vlan for internet, and have that access port tagged with the same vlan. Then turn off routing in your brand name router and use it as a pure access point. Now you can play with vlans as much as you want

I wouldn’t worry about the isp router, it has no access to your network, and most traffic going through it should be encrypted anyway. And for your brand named access points, you can block them from accessing internet.

Edit: The guide: Official documentation for “router on a stick”