I'm trying to work out how best to design a home network which contains (potentially hostile) devices. I'm running into my limits of networking knowledge!
I have two challenges.
On my home network I have a Lifx WiFi lightbulb. Lifx doesn't provide any security (no passwords) so any other device on the LAN can control it.
I'm happy for my phone and laptop to connect to the bulb - but I don't want my TV to have access to it. Or vice-versa.
In a similar vein, I have a Nest Protect WiFi Smoke Alarm. It is (theoretically) possible for a Nest employee to tunnel in to the device and gain full access to my network.
Is it possible to create a network which allows a device to connect to the Internet, but nothing on the LAN?
So, what sort of steps can I take on a domestic Internet router to isolate devices which I don't necessarily want to give full access to my LAN?
My thoughts are...
- Disconnect the devices. That said, I really like being able to control my TV from my phone!
- Create a different subnet for each device. My router allows me to create a main network and a guest network. I could put all my semi-trusted devices on a secondary network - but I'd lose the ability to control them while connected to the main network. Additionally, they'd still have the ability to interfere with each other.
- DMZ? I'm unsure about this - would it isolate the IoT devices from the main LAN while still giving them Internet access? I understand that the devices would be totally exposed to the net - giving anyone the ability to control the password-less devices, is that right?
- Something else...?
I have the feeling that what I want to do is impossible. Should I just accept that devices on my network can access each other and attempt to secure what I can?