37

I'm trying to work out how best to design a home network which contains (potentially hostile) devices. I'm running into my limits of networking knowledge!

I have two challenges.

Unsecure Devices

On my home network I have a Lifx WiFi lightbulb. Lifx doesn't provide any security (no passwords) so any other device on the LAN can control it.

I'm happy for my phone and laptop to connect to the bulb - but I don't want my TV to have access to it. Or vice-versa.

Hostile Devices

In a similar vein, I have a Nest Protect WiFi Smoke Alarm. It is (theoretically) possible for a Nest employee to tunnel in to the device and gain full access to my network.

Is it possible to create a network which allows a device to connect to the Internet, but nothing on the LAN?

Design

So, what sort of steps can I take on a domestic Internet router to isolate devices which I don't necessarily want to give full access to my LAN?

My thoughts are...

  1. Disconnect the devices. That said, I really like being able to control my TV from my phone!
  2. Create a different subnet for each device. My router allows me to create a main network and a guest network. I could put all my semi-trusted devices on a secondary network - but I'd lose the ability to control them while connected to the main network. Additionally, they'd still have the ability to interfere with each other.
  3. DMZ? I'm unsure about this - would it isolate the IoT devices from the main LAN while still giving them Internet access? I understand that the devices would be totally exposed to the net - giving anyone the ability to control the password-less devices, is that right?
  4. Something else...?

I have the feeling that what I want to do is impossible. Should I just accept that devices on my network can access each other and attempt to secure what I can?

Improve this question
5
  • 1
    A decent broadband router will allow you to have multiple WiFi AP names on seperate subnets; after that it's a case of configuring appropriate firewalling/routing between them. IIRC, I paid about £400 for mine.
    – Phil Lello
    Mar 24, 2016 at 18:31
  • 23
    It becomes so very complicated when you have to assume that your toaster is trying to kill you.
    – Deer Hunter
    Mar 24, 2016 at 19:10
  • 1
    @PhilLello Actually any wifi/router that can run DDWRT or OpenWRT (can be bought new for $50 US or used for $20US) can create multiple VLANs with multiple SSIDs, and it's not even that complicated to make adjustments like internet-only access, or one-way one-port access. However keeping track of whether it's your toaster you trust to talk to your TV, or your fridge to your smoke alarm, and not vice versa, becomes the tough part.
    – Jeff Meden
    Mar 24, 2016 at 20:38
  • @JeffMeden, that's another very compelling reason to have a Home Automation Device/hub to act as the sole rules engine. Network-wise, allow every device talk to the hub, but never to each other. For example, don't let the water heater talk to the phone. Instead, add a rule to the hub that says "when the water heater sends a leak alert, send an alert to the user's mobile phone". This way you never allow an attacker who breaks into the cheap water heater interface being able to directly connect to the door lock system. (Securing the hub is a different issue, but is a less complex problem.)
    – John Deters
    Dec 9, 2016 at 16:41
  • Do the IoT devices hide their source code from you? It makes a difference, if you have to fear that the devices can actively harm your LAN.
    – Jonas Stein
    Jun 15, 2017 at 18:05

6 Answers 6

Reset to default
18

First you need to break the devices into classes of connectivity:

  1. Need just a constant "cloud" connection to work properly
  2. Need no connection except for initial config/updates, need local connection
  3. Need both a cloud connection and a local connection to work

If you have a class of devices that are truly cloud-based (i.e. they don't use any local traffic, it all must go out to the internet and back) creating a SSID and VLAN that segregates traffic is a simple measure to make sure that any hostile activity it might be repurposed for is sheltered from high value targets like your backup server. Putting devices that need some sort of always-on connection in their own class keeps them sidelined if there is some sort of remote compromise of their command and control structure (the cloud.)

If you still need local access to some of those devices, say to give your phone just the ability to access port 80 on your TV or your light bulb (if that's how the smart remote works) a stateful firewall rule can enforce that only your phone, to only that port on the TV, will be allowed. If your TV needs no internet access and only protected local access, this would fall into another category which would need its own SSID, and if you really want it to be able to talk to the internet but no other devices, and be all by itself, it would need its very own SSID and VLAN, which many can be created if needed.

One measure that could also go a long way if your network is subject to transient devices (i.e. relatives tablets or laptops dropping by from time to time) is putting just those on a different VLAN, since for example your smart light bulb, unless you purposefully open a port from the internet at large, is of no harm even without a password since you (hopefully) trust all the other devices on your network to not be under malicious control.

Several inexpensive Wifi/Router devices that can be loaded with OpenWRT or DDWRT can be configured this way. The challenge isn't how to pull all this off, it's how to keep it all working smoothly and not throwing up your hands admitting that it's easier to just live under the spectre of network Armageddon in order to not have to unblock a port every time your phone TV app updates, and it says your TV firmware is now out of date. If you're like most people, you just harden what you can: automatic or alerted updates on all devices that support it, smart firewall rules with anything like uPNP disabled, and then carry on with your life.

Improve this answer
9

I bought for that purpose an Ubiquiti EdgeRouterX and UniFi AP AC LITE.

The access point supports up to 4 SSID, each goes to another VLAN. I have set up a 'main' wireless network and 'guest' (that I also use for untrusted devices).

The router allows internet access for every VLAN, but does not allow traffic to cross between VLANs, with the exception that I can connect from the 'main' network to the 'guest', but not the other way around.

I think that this setup is pretty secure and also quite cheap for the performance. I even did not have to touch the CLI. The UniFi controller has to run on a PC only to set up the wireless access points, later they can work without it.

Improve this answer
2
  • When you say "has to be run on a PC" - do you know if it'll work on Linux?
    – Terence Eden
    Mar 26, 2016 at 17:56
  • 1
    It is Java based. It runs on Windows, Mac and Linux. I run it on Gentoo without problems.
    – filo
    Mar 27, 2016 at 9:25
6

Depending on your level of paranoia, you can get an AP that has multiple SSIDs mapped to separate VLANs. Then with a firewall or access lists, you can control what each VLAN has access to. You can probably pick up used commercial devices for not too much money that do what you want.

Improve this answer
4
  • Thanks! Is it possible to have a uni-directional access list? That is, my laptop and phone have access to my toaster - but the toaster doesn't have access to the rest of the LAN?
    – Terence Eden
    Mar 24, 2016 at 19:27
  • Yes, you can do this with some routers that have stateful firewall features
    – Ron Trunk
    Mar 26, 2016 at 16:41
  • @RonTrunk do you knowif OpenWRT or DD-WRT can do this?
    – cavalcade
    Oct 31, 2016 at 20:02
  • Setting up VLANs is the easy part. Routing traffic across VLANs based on traffic type becomes ... complicated.
    – Dan Esparza
    Nov 26, 2017 at 19:55
5

In your case you have the following solution:

  1. Buy a good router with a good firewall that can support multiple AP.
  2. Segregate the network so you will have the smoke alarm on one network and the other devices on another (that's what I did for fun and because I wanted to run some honeypots on the way... and some static IP's and backups if a provider is down)
  3. Buy 3 different and decent routers use one as entry point and use the other as separated APs.
  4. If you are in the IoT devices buy some PIs connect them with a cable at the router and use USB internet adapters to make APs (and don't forget to change defaults).
Improve this answer
3

I went a step further and installed a separate physical network for IoT devices. My builder installed Cat5e for the phone lines and Cat6 for the LAN, and I used the phone runs to build out the IoT hardwired network with a separate router and WiFi access points.

I sometimes bring devices home to alpha/beta test that haven't been fully baked in terms of security yet, but even alpha units are usually pretty secure and production test runs. I don't explicitly trust ALL of the devices or external infrastructures from the other IoT manufacturers that I use in my home.

Improve this answer
2
  • 1
    The idea is to isolate the devices from each other. There isn't a lot of difference between a separate wired network and the guest network on the AP.
    – schroeder ♦
    Jan 25, 2017 at 19:37
  • @schroeder If the devices run on closed source software (or closed source firmware), one can know that the devices do and the physical separation as suggested makes sense.
    – Jonas Stein
    Jun 15, 2017 at 18:01
2

The other distinct SSID/VLAN answers really are the way to go.

Expanding on those answers, I think there is a reasonable low-risk solution to preserving your convenience: Why not get some other phone that's not your phone to connect to that untrusted (IoT) AP for controlling your TV etc.? Maybe you have an old phone, or you can find something to run Android? (This would of course be easier with official support for Android on a Raspberry Pi...)

Improve this answer
3
  • 1
    Carrying one phablet is bad enough - carrying multiple devices is not the answer most people want. Plus, there's often crossover needed between VLANs: the laptop needs access to the media center and the TV, the media center needs access to the TV, the phone needs access to the washing machine, etc. Since you need a few firewall rules anyway, it costs nothing to add another rule to allow the phone to access the media center, too. But you never have to let the sewing machine access the cameras, or the TV access the alarm system, so you leave those alone and let 'deny all' do the work.
    – John Deters
    Dec 8, 2016 at 22:41
  • @JohnDeters I suppose you're right. In that case, the separate device is really just a workaround for when you don't want to set firewall rules and instead deny all communications between trusted and untrusted devices...but you still want an overly-capable remote with short battery life. Maybe not so useful.
    – ZX9
    Dec 8, 2016 at 22:57
  • a second phone sounds like a good idea for me :-)
    – MountainX
    Oct 7, 2018 at 22:21

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .