I recently had my home wired for gigabit ethernet, which is awesome, but left me with a short ethernet run that is actually outside the walls of my house. How can I secure this link against someone splicing in? Ideally I'd like to attach something to each end of the cat6 run that encrypts traffic in a way that is transparent to the other devices on the network, but am interested in software solutions as well (as long as they perform well and aren't too onerous to set up).
There are two possible options to consider: Layer 2 (data-link) encryption and Layer 3 (network or IPsec) encryption. Unfortunately both are probably more expensive or complicated than you want to get into. However, the wire that runs between you and your internet service provider (or even further downstream) is just as if not more susceptible to splicing. What this means is that the only way to be really secure is to use strong end-to-end encryption whenever you need to do something sensitive, and that encrypting traffic over that one little link of your local network is probably not going to make you any safer. End-to-end encryption will encrypt the sensitive traffic on your device, and it's not decrypted until it reaches the destination device, thus preventing most practical packet sniffing attacks.
Remember that costly security only makes sense when it protects something of equal or greater value. I would suggest the following alternatives:
- Physical security, such as putting your external cable inside an armored conduit.
- Make sure you use HTTPS for anything sensitive on the web. Even if these packets are sniffed on your network they will already be encrypted. This encrypts data between your machine and the destination web server.
- Use end-to-end encryption whenever offered. In contrast to HTTPS, end-to-end encryption will keep data encrypted past the destination web server up to the point where the data is actually used.
- Use encrypted wifi with a strong password whenever you're dealing with something sensitive. This encrypts all data between your machine and your wifi access point.
A Layer 2 solution most closely resembles what you asked for in the question. These devices are sometimes called "bump in the wire" devices specifically because you attach them to either end of a physical cable and all encryption happens transparently and without the knowledge of any other device on the network. Unfortunately at this time these solutions are extremely expensive- they are "call for price" expensive. Some quick googling suggests that these devices start at a few thousand dollars and quickly go into the few tens of thousands of dollars range. They provide high security, authentication, and can operate at 10gig/100gig speeds.
Searching for "layer 2 encryption" or "bump in the wire encryption" or "MACsec" will get you more information about these devices.
Layer 3 encryption is network-based encryption typically using IPsec. Here, each host on your network authenticates and/or encrypts communications with each other host on your network. If you had an IPsec enabled router/switch and a sufficiently smart device on the other end you might be able to set up IPsec so that it only functions over that one wire. It would also be possible to encrypt all data on your local network (behind your router). Beware that IPsec in general generates a lot of processing and bandwidth overhead.
What you basically set up is two disparate sites. Assuming you ran a cable from your house to a detached garage, it doesn't matter if your garage is 100 feet away or located in rural Guangzhou, for the sake of security you consider it as two separate sites.
To those ends, what you need is a site-to-site VPN setup, similar to any corporate LAN whose offices are spread across a geographic area or the globe. (Some SOHO routers will facilitate this for you, but that's venturing into product recommendation territory.)
Anything that leaves your house is encrypted, goes over the external wire, and is decrypted on the receiving end. Set up properly everything functions as a unified LAN and the fact that half the network is on the other side of the yard is transparent to all of your nodes.
Layer 2 bridging over a VPN would work. But it will be onerous:
Working at layer 2 would be the most transparent to the machines on your network.
Prosumer class devices will likely do Layer 3 VPNs which means dealing with different subnets, broadcast domains etc. They'll be easier, but not as transparent.
I would be surprised if you found a cheap, simple, transparent solution which could provide gigabit speeds.
Installing a camera, replacing the external run with armored cable or fibre would be faster and probably less trouble.
In terms of risk, unless you're working in an embassy, or your ethernet cable straddles the streets of a Brazilian favela, I would be impressed if somebody was so interested to intercept your LAN traffic.
This seems like overkill. What goes over this cable that is really sensitive enough for someone to physically access your ethernet cable? Sensitive internet traffic will go over https. Since you probably have a switch it's only traffic between devices in the two areas that will go over that cable, not all traffic.
Are your computers, servers and devices secured so people can't browse file shares or access resources? Is everything fully patched? If not that's probably the first area to consider.
Practical efforts might include:
- Put the cable inside a plastic or metal conduit, physically secure it
- Use security cameras to monitor the area
- Check the cable occasionally