6 ms·
You can do it with a capable (read enterprise grade) router that does packet filtering. You can do it with a linux box and a lot of ethernet network cards as we
by gvb 11y ago
You can do it with a capable (read enterprise grade) router that does packet filtering. You can do it with a linux box and a lot of ethernet network cards as well, but your speed will suffer because every packet needs to be inspected before being forwarded. Hardware assist in packet inspection makes a major difference. See also Software Defined Networking[1].
You probably won't need "deep packet inspection" for a few years, until the IoT people get smarter about hiding their traffic. That was sarcasm. Maybe. The fact that they cannot do secure networking competently implies they won't be able to hide their traffic competently either, but the incentives are much stronger for the latter.
Anyway...
Step 1: FORCE ALL THE TRAFFIC THROUGH THE ROUTER. Shouting here because, if the traffic does not go through the router, you cannot control (block) it. Forcing the traffic through the router can be difficult. You need to "home-run" all ethernet (wired and wireless) to the router.
1a) Hard-wired ethernet is simple. Home run it to the router.
1b) Do not permit any small network switches on any of the ethernets (this principle is breakable if you understand that all units on the satellite switch will be unprotected from each other).
1c) Best: Do not allow any wireless. This is unrealistic today. Better: have a separate wireless access point (with WPA encryption and good passwords) for every group (class) of wireless devices that then gets home-runned to the filtering router. The filtering router can then prevent your light bulbs on the light bulb[2] WiFi AP from talking to the refrigerator on the kitchen appliance AP. "Better than nothing" is to have multiple SSIDs on one WiFi AP.
Step 2: Create a shitload of subnets by either using all of the Class C networks 192.168.0.0/16 or subnetting 10.0.0.0/8[3] Put each device or logical grouping (class) of devices on a separate subnetwork.
Step 3: Disallow all packet routing by default. Bask in the glory of a perfectly secured (albeit perfectly useless) network. Crack open a beer. Drink it fast... the local residents won't let you finish it because they will impress on you their pain of not being able to "facebook" because your network is too secure.
Step 4: Re-allow all packet routing to tamp down the mutiny.
Step 5: Write a shitload (more) routing rules defining which device (class of devices) can talk to which other device on which physical ethernet ports on which ethernet IP addresses (subnets) and IP ports (i.e. whitelist only the necessary traffic).
Step 6: Re-enable the packet filtering in the router. Crack open a beer, you deserve it.
Step 7: Goto step 4.
After a few iterations, you might be able to finish your beer in step 6. After a few weeks, you might even get enough time to enjoy your beer.
[1] https://en.wikipedia.org/wiki/Software-defined_networking https://en.wikipedia.org/wiki/Software-defined_networking
[2] Most light bulbs are not directly on WiFi but are instead on a low power network like Zigbee or Z-Wave. They come with a ethernet-to-Z* gateway. This is actually pretty good, because you can plug the gateway into your filtering firewall and be in pretty good shape because you can treat all of your lightbulbs as a device class and filter them with their ethernet attachment to your router.
[3] Subnetting 10.0.0.0/8 can be a problem because your internet provider thinks that they need to use 10.0.0.0/8 for the two IP networks on your side of their internet attachment point. This is really stupid because their ToS probably specify that you can have only one computer on their precious network (that was sarcasm again. maybe.), so they are blocking 16777214 IP addresses so that they can have one for themselves (10.0.0.1) and provide 1 for you.
- edent 11y agoYes, but what sort of beer? ;-) Any suggestions for hardware which can accomplish this? Might scour eBay for some company discards. Good point about the light bulbs, although the Lifx ones I have are direct WiFi connections. Was wary of Hue after their compatibility shenanigans, but there's a certain simplicity in having them all hang off a central hub.
- ryan-c 11y agoI have an EnGenius EAP600 as my access point which allows for up to 8 SSIDs, each of which can be mapped to a different VLAN. It also supports a feature called client isolation, which prevents clients from talking directly to each other. These features make what gvb suggests a little easier. My router is simply a Linux box running Debian (currently a Supermicro SYS-5018A-TN4, previously I had a Soekris net4801, then a Dreamplug). All of my ethernet switches are Netgear SOHO models that support most enterprise features (I use RSTP, VLANs and LACP). I have a couple GS108Ts, a GS716T and a S3300-28X. With these switches I can maintain isolation via VLANs even with multiple switches, and most of the VLANs go into my router via a cheap 10Gbe SFP+ card I got on eBay. Currently, I've got the following "smart" devices: WiFi Scale Smart TV (ethernet) Roku (ethernet) PS3 (ethernet) PS2 (ethernet) Raspberry Pi 2 running OpenELEC (ethernet) None of them are allowed to talk to each other.
- mindslight 11y agoIf you don't take this Internet of Treachery seriously, you will end up with a fridge full of Keystone Light, locked exits to make you personally drink it, and no way of taking pictures to salvage any irony.
- gvb 11y agoOld Cisco routers (e.g. C4507s) are very cheap and very capable. They are also very large and very noisy (serious trays of fans). You can get them with various combinations of cards for $300++ (plus $150++ shipping) for something that probably cost $20,000-$70,000 new. They have more than their share of limitations, but for the money they are hard to beat. The 4507 has dual redundant power supplies. The "R" model has dual redundant supervisor cards, and the "7" indicates it has seven card slots for plug in modules. You can get 48 port PoE (be careful you get standard PoE, not the earlier non-standard Cisco PoE) for around $100. Random examples * $50 + ??? S/H: http://www.ebay.com/itm/Cisco-Catalyst-4507R-2-Power-Supplies-2-WS-X4516-5-WS-X4148-FX-MT-TESTED-/401052369074 http://www.ebay.com/itm/Cisco-Catalyst-4507R-2-Power-Supplie... * $450 and "free" S/H: http://www.ebay.com/itm/Cisco-WS-C4507R-E-Cat4500-E-Series-7-Slot-Chassis-1YearWarranty-2-Available-/272162151936 http://www.ebay.com/itm/Cisco-WS-C4507R-E-Cat4500-E-Series-7... Non comprehensive list of limitations: * The switches and software are no longer supported. Cisco won't talk to you (but that's OK, you cannot afford to talk to Cisco). * They (should) come with software (and likely the previous owner's switch configuration :-O), but the software will not be properly licensed to you. Getting a proper license (and thus upgrading) ain't happening. There are also several different capability levels of software, the more expensive versions having more capabilities. Better sellers will give you a clue about what you are getting software-wise. * Cisco's OS security has lots of known holes. If you are using it for security purposes, you want the console on a serial port (or the dedicated ethernet port on the supervisor card) that has physical restrictions, do not put it on a network port that one of your malicious IoT devices can reach. * Very annoying: the 48 port GigE cards that are remarkably cheap don't support jumbo frames. :-( There are GigE cards that support jumbo frames. Some are 6(?) port, there may be 48 port ones.