I have a mix of IoT devices at home. Alexas, WiFi PLugs, Smartthings (with related Z-Wave/Zigbee devices). I've been on the hunt for a solution to monitor what these devices send out and secure data sent if needed. Here's what I've tried...

CujoAI - the device did not tell me what it was doing. Gave me vague alerts that a laptop was trying to access a known malware site and it was blocked. Nothing about IoT, though it's sold to protect IoT devices. The unit used cloud-based analytics seemingly creating additional holes/attack surface when it came to my home network.

BitDefender BOX2 - Was better than CujoAI, but not by much. It completely disabled my Orbi WiFi mesh features and did not provide a lot of value or information on traffic coming and going in the network.

Dumped both for pfSense, thinking I could customize and install packages as needed. My current setup is pfSense Firewall, connected to the Orbi Mesh. I have Squid and lightsquid installed. Over the last few days I don't see much going on. Usual traffic but nothing that I can see too bad.

I don't want to go back to black box solutions to secure my network and IoT, as I have before, but don't want to completely roll my own either.

Is there a combination of pfsense packages (squid, pfBlockerNG, SquidGuard, Snort and maybe Wireshark) that will give me monitoring and control I need? Better yet is there a guide out there for setting something like this up? I also have MacMini on the network, with VMware so I can spin up servers or other devices as needed.

If pfSense and its packages is not the right solution, I don't mind buying or building something else. I want to make sure I'm on the right track.

  • What's your threat profile? Who are you defending against? What's at stake? It's hard to say what's the right solution of we don't know if this is just a hobby, or if there's a real specific threat you're concerned about. – Daisetsu Oct 15 '18 at 23:04
  • 1
    This is my home network. My wife works from home, as do I occasionally. I have 2 teens, so just family personal information, not corporate or anything too intense. – Sunil Oct 15 '18 at 23:39
  • 1
    There's no one single answer I can give you, because it entirely depends on how much time and effort it's worth to you. DNS blacklisting is a good idea like you mentioned. I know a lot of people use pihole for that. SNORT can be a pain to setup and configure IMO. SquidGuard is another blacklist. Rather than just focusing on blacklists I would suggest making sure your network itself is configured securely. – Daisetsu Oct 15 '18 at 23:45
  • Maybe setup WPA Enterprise with a RADIUS server to auth wireless users. VLAN your IOT from the rest if the devices. Write group policies that are applied to all devices in your domain. Log traffic to your IOT and alert in analygous traffic (splunk is free under a certain threshold). – Daisetsu Oct 15 '18 at 23:48
  • Splunk! Did not look into that one. Maybe a separate SSID for IoT with added security features, leaving the main SSID secure also but just less logging/monitoring. – Sunil Oct 16 '18 at 0:41

Browse other questions tagged or ask your own question.