3 ms·

If you're going to run IoT devices in your house I highly recommend isolating them to their own VLAN+Wifi SSD to limit their exposure to the rest of your networ

If you're going to run IoT devices in your house I highly recommend isolating them to their own VLAN+Wifi SSD to limit their exposure to the rest of your network. Personally I'm a fan of Ubiquiti's Unifi gear for this. Relatively cheap(~$250 depend on what you get), easy to setup and much better Wifi quality as a bonus. Ars did a pretty good write-up a while back that I liked[1]. [1] https://arstechnica.com/information-technology/2018/07/enterprise-wi-fi-at-home-part-two-reflecting-on-almost-three-years-with-pro-gear/ https://arstechnica.com/information-technology/2018/07/enter...

394549 8y ago
> If you're going to run IoT devices in your house I highly recommend isolating them to their own VLAN+Wifi SSD to limit their exposure to the rest of your network. This goes both ways, too. You don't want someone to pivot from an IOT device to your PC, but you also don't want someone to pivot from your PC into an IOT device like a security camera or door lock.
- vvanders 8y ago
  Yup, it's pretty trivial to setup the VLAN on Unifi gear to completely isolate the IoT VLAN/SSID to internet only and never see local traffic/devices and vice versa.
rixrax 8y ago
This. This 100x. Complete client isolation in air and in the wire. You'll sleep better. What is somewhat frustrating is that some vendors still design their equipment, and especially their setup process, in a way that it requires (W)LAN without client isolation. I don't want to call out names, but vendors out there, please, please, please with sugar on top, built your IoT setup process in a way that I can complete it without assumption that both device and client will be able to connect to same WiFi and be able to communicate directly with each other. E.g. modern, well behaving IoT do it along the lines of: 1) on fresh start device creates WiFi access point (AP) or is visible via Bluetooth (not big fan of the latter, but...) 2) Connect to temp hotspot (or BT) with your laptop, or phone 3) Setup device (e.g. which WiFi to use, create account, ...) 4) At the completion of the setup, device shuts down temp AP, and device and laptop/phone connect back to their WiFis 5) From this point-on, all communications from client to device go via internet / service provided by IoT device manufacturer (ideally over TLS). I recognize that by design I am now in a strong vendor lock-in. E.g. should manufacturer of given device go out of business or discontinue service, that particular IoT will become useless just the same. So it goes...
deleted 8y ago
[deleted]

394549 8y ago

> If you're going to run IoT devices in your house I highly recommend isolating them to their own VLAN+Wifi SSD to limit their exposure to the rest of your network. This goes both ways, too. You don't want someone to pivot from an IOT device to your PC, but you also don't want someone to pivot from your PC into an IOT device like a security camera or door lock.

vvanders 8y ago
Yup, it's pretty trivial to setup the VLAN on Unifi gear to completely isolate the IoT VLAN/SSID to internet only and never see local traffic/devices and vice versa.

rixrax 8y ago

This. This 100x. Complete client isolation in air and in the wire. You'll sleep better. What is somewhat frustrating is that some vendors still design their equipment, and especially their setup process, in a way that it requires (W)LAN without client isolation. I don't want to call out names, but vendors out there, please, please, please with sugar on top, built your IoT setup process in a way that I can complete it without assumption that both device and client will be able to connect to same WiFi and be able to communicate directly with each other. E.g. modern, well behaving IoT do it along the lines of: 1) on fresh start device creates WiFi access point (AP) or is visible via Bluetooth (not big fan of the latter, but...) 2) Connect to temp hotspot (or BT) with your laptop, or phone 3) Setup device (e.g. which WiFi to use, create account, ...) 4) At the completion of the setup, device shuts down temp AP, and device and laptop/phone connect back to their WiFis 5) From this point-on, all communications from client to device go via internet / service provided by IoT device manufacturer (ideally over TLS). I recognize that by design I am now in a strong vendor lock-in. E.g. should manufacturer of given device go out of business or discontinue service, that particular IoT will become useless just the same. So it goes...

deleted 8y ago

[deleted]