IoT - how to wall off devices while keeping them usable

[ByDemonsBeDriven]

Quick background - not a newb but definitely no packet networking pro. I have advanced knowledge in TDM circuit switching which is dying a quick death and I adapt quickly to new tech when I'm thrown in the fire so to speak. I've been teaching myself packet switching/routing as I can, and have a good grasp on the layers and know enough to be dangerous. That's the problem though... I "know" stuff then get home and lump everything on my network to my RT-N66U running tomato where it all works just fine. I'm not thrown in the fire because I have one LAN and unmanaged switches which just get everything working with minimal effort. So...

Thanks to a nearby lightning strike and some damaged equipment I've decided to get this home setup correctly and SECURELY. I grabbed an edgerouter lite, Netgear GS724T 24 port managed switch, and two ubiquiti unifi AP's since I have a fairly large ranch style home. I'm looking for advice as I *think* I know what I need to do but I'm sure there are field-proven best practices I should be following.

I have computers, phones, tablets, printers, and a handful of IoT devices. The devices which never see firmware updates or come from small companies with no real support need to get off my main LAN. The news stories about telnet servers with hard-coded default passwords embedded in wireless cameras/etc are getting more and more frequent and I believe I need some VLANS to separate this stuff. But, I also need to access these IoT devices from phones or computers on other VLANS. I'm thinking if I only allow a connection to the port I need to control the device I'll be "safe". Am I making sense???? So....

My plan is to run the ISP connection to the edgerouter, the edgerouter to the switch, and the unifi AP's also to the switch. I don't know a ton about layer 3 switches but it seems to me I can segment everything, wired or wireless, using just that switch. Is that the right way to go about this? Can I "route" between segmented devices using only the switch or will that traffic need to go back to the router? Example - I have an off-brand colored lighting controller that my kid connects to with her iphone to change the room lights. The lighting controller uses 3 or 4 IP ports for it's communications. I want ONLY those ports open between her phone and the controller. They will be assigned different VLANS. Can I setup a route like that in the switch alone so the traffic never hits the router? That seems like the most efficient method for the network but I'm not sure that's possible.

I haven't even opened the boxes on this equipment yet. I'm just feeling this out to see if I'm thinking correctly before I start wiring things. Any advice is appreciated!

 

[Jose C]

Let me tell you what I have at home, about 5 pcs, 6 apple devices, wireless printers smart tv, wemo, ip cams, smarthing.

I accomplish this with two netgear R7000 running tomato.

I have my main LAN on vlan2 (1 is for wan) were all my trusted devices are, of phones, Apple TV NAS.

Then, I have another vlan with another subnet were I put everything else, wemo, smarthing cameras. Since all of these devices work over the Internet, this means even when you are home the connection from your phone goes to the internet to communicate with the wemo devices you have next to you it doesn't matter the are on a different vlan and subnet. With this, of one of those devices gets compromise they will be on my secondary network and not my main where my nas and pcs are.

Also, the cameras don't have access to the internet at all, so to check the cameras when I'm not home I connect to a vpn server (openvpn) i have on one of those routers and connect "locally" to the camera.


Sent from my iPhone using Tapatalk

 

[ByDemonsBeDriven]

Let me tell you what I have at home, about 5 pcs, 6 apple devices, wireless printers smart tv, wemo, ip cams, smarthing.

I accomplish this with two netgear R7000 running tomato.

I have my main LAN on vlan2 (1 is for wan) were all my trusted devices are, of phones, Apple TV NAS.

Then, I have another vlan with another subnet were I put everything else, wemo, smarthing cameras. Since all of these devices work over the Internet, this means even when you are home the connection from your phone goes to the internet to communicate with the wemo devices you have next to you it doesn't matter the are on a different vlan and subnet. With this, of one of those devices gets compromise they will be on my secondary network and not my main where my nas and pcs are.

Also, the cameras don't have access to the internet at all, so to check the cameras when I'm not home I connect to a vpn server (openvpn) i have on one of those routers and connect "locally" to the camera.


Sent from my iPhone using Tapatalk

I thought about doing something like this. The edgerouter can be configured as WAN+2LAN and I could just throw an old WRT54 up for the second LAN but I want to do this right and try and learn something along the way. One interesting thing I read is people locking themselves out of their switches by changing VLANs and not being able to configure the switch using in-band communications. I know this is simple once you know it but I don't know it - yet. I do want any in-band channels secure though. I'm just going to hook this shirt up and start playing.

 

[netwrks]

Everything you need / want to know about Ubiquity router configs but were afraid to ask..

https://www.youtube.com/user/williehowe

https://www.youtube.com/channel/UCVS6ejD9NLZvjsvhcbiDzjw

https://www.youtube.com/user/benpin1988 - UBNT Employee..

EDIT: UBNT AP PDF: https://dl.ubnt.com/datasheets/unifi/UniFi_AC_APs_DS.pdf

 

[System Error Message]

with IOT the problem is with the dependence of external servers or the cloud. That is where the failure point has been. Even if you filter around you arent going to be able to stop any hacks that utilise the flaws in the design on relying on the cloud.

A good IoT device would not require a cloud. Lets say you use smart locks, rather than using an app through the internet, what about connecting via wifi when you reach home, using an encrypted login to access the lock from the app working on the same network.

Its the reliance on external servers to function that makes IoT devices terrible.