How does my router know what requests to accept and which to ignore, when treating connection requests to the smart devices that originate from outside my network?

I have no port forwarding configured, yet when i use the Nest app, or the Wink app, for instance, I am able to send commands from outside my LAN.

I get that the app needs to authenticate when connecting to my device, but how can it even establish a connection from outside my network, knowing that all routers act as natural firewalls, and that no ports have been opened.


Generally, these smart devices have a third component - the service provider.

Using Nest as an example, when you connect it to your wifi network, it connects back to Nest servers so that the Nest iOS or Android app can make changes to your home device remotely. You don't need to connect directly to your home network.

The most direct security benefit being that you don't need to expose your home network to the internet, which is unsafe.

  • Still, they establish a connection to the device, which resides on my network, behind my router's firewall.So how do they get through my router?
    – John
    Dec 26 '16 at 5:39
  • The connection to the service is outbound. It is there that your devices receive the instructions the service receives from your mobile app. Think of it like connecting to a website. You can interact and do everything you need with a website, because you establish the connection out. IoT device work on the same idea.
    – h4ckNinja
    Dec 26 '16 at 8:07
  • So what we are saying is that the device checks the value of an attribute through an API at fixed intervals, in the case of a thermostat the temperature value, and sets its temperature accordingly to the value of it read through the API. Is that the principle? If so, its a clever way if going around the security of firewalls...
    – John
    Dec 26 '16 at 21:38

Not the answer you're looking for? Browse other questions tagged or ask your own question.