5 ms·

What would be a good method for keeping the IoT Thing from talking to a machine beyond my locally administered network?

viraptor 2y ago
Never connect it to the WiFi/Ethernet? Or if you do, filter the traffic. Unfortunately that's often not possible on consumer class modems.
- lazide 2y ago
  Often the equipment won’t actually work either if you try to filter it meaningfully. I’ve had IoT cameras (in particular) that would brick themselves if you didn’t allow 443 to all Amazon IP blocks. :s
wmf 2y ago
A firewall.
sedro 2y ago
A separate VLAN, if your router is capable
ndriscoll 2y ago
Don't plug it in unless you have the expertise to already know the answer to that question. That should also be your advice to any friends/family. Plugging something like this into a network is a horrifically bad idea. This is like asking people on the Internet how to safely mix random household cleaning chemicals. If you don't have the background to answer that yourself, you should not be doing household chemistry.
- pavon 2y ago
  I found out after our solar system was installed that the enphase inverter came with a cell modem for monitoring and remote management. Our installers didn't know how or even if it was possible to configure the system without one.
  - pilingual 2y ago
    Enphase required the cell connection when I checked a couple years ago. Sol-Ark makes a solid hybrid inverter and allows offline operation.
  - ndriscoll 2y ago
    Now you know to advise people to look into that question before the install/find an installer that can guarantee it. If the thing can't easily have cell function disabled (e.g. by pulling a readily accessible card), then advise people to stay away from enphase.
  - classichasclass 2y ago
    After I bought out our panels, I found the Enphase modem and disconnected it. It was a USB box connected to the monitoring unit, the monitoring unit has other networking options, and it's mine anyway.
bokkies 2y ago
I have a sunsynk inverter which is the same hardware as deye but apparently different software. I have it hooked up to a Pi4b running home assistant using this https://github.com/kellerza/sunsynk https://github.com/kellerza/sunsynk and it has no direct internet access. I can connect to my home network using tailscale to monitor power usage and generation through the HA app if I'm not at home
breeskee 2y ago
I stuck IOT stuff on a cheap linksys WRT router with ExpressVPN firmware. It forces all clients out over that so Nest, Amazon et al can’t snitch or sell my demographics or billing address to people. Not tying it to my home IP anyway. but this require a DMZ or a second external IP address (I have both with centurylink) because if it’s double nat on your home network. Thee devices can access your home network.
breeskee 2y ago
(If you don’t want IOT talking to the internet at all, set up an internal dhcp server and give the devices a bunk router address . If my gateway were 192.168.1.1 , I just set that clients gateway as 192.168.1.254) Misread your question. Sorry. Most of my devices I do want talking to the internet. Just not on my home IP.
ssl-3 2y ago
VLANs. One for you, one for the Chinese shit. Keep your [phone/PC/whatever] on one VLAN, with a NAT gateway, and they'll work just as they do now. Keep the IoT Things inside of their own VLAN, without a gateway to the Internet. And if a device like Home Assistant or whatever needs to exist on both VLANs in order to be useful, then: Make sure it isn't forwarding/routing/NATing packets. --- The implementation details vary, but they needn't be particularly expensive. What I do at home is run OpenWRT on a Pi 4 for my home routing purposes. It's fast enough for my needs and it's got simple GUI configuration options for VLAN. (Why OpenWRT? Because it's easy for me to puzzle out when I need to adjust something after a few months or a year -- I don't deal with routing every day, nor do I wish to. (Also SQM is a built-in, which always keeps WAN latency tolerable.)) From there, I've got cheap managed switches that enforce/insert VLAN tags where that is useful to me, so I can decide which physical ports are capable of talking to whichever VLANs. And from there, I've got relatively inexpensive Mikrotik access points that are configured to provide different SSIDs for different VLANs. It all works OK, though more enterprisey folks will almost certainly choose a very different path.
- stavros 2y ago
  > One for you, one for the Chinese shit. Can you give an example of tech devices that aren't manufactured in China?
  - ssl-3 2y ago
    No, not specifically. (To bring this to the logical conclusion: So much for Internet access.) ;)
    - deleted 2y ago
      [deleted]
    - stavros 2y ago
      So much for internet access even for you! Your router is also made in China.
drdaeman 2y ago
The issue is that a lot of IoT things won't even work unless they have Internet connection and a registered account. The careful approach to IoT is to never connect a device to anything, dump the firmware, analyze it, reflash the EEPROM with patched TLS certificates (if necessary), write your own server implementation, let the IoT device join a dedicated IoT WiFi network, on that network run everything through a gateway pretending to be "the Internet", where the emulated server is running. Yep, it's this bad. Of course, if the device or its malfunction cannot cause sufficient harm (e.g. it's a light, usually it's not worth to reverse engineer it) then just run it on a separate SSID and VLAN, with least access necessary to get it running (starting from blocking everything and allowing network by network until it works). And, uh, if the device has a LTE or can use something like Amazon Sidewalk, it gets even trickier to keep it tame. I don't have any solar power stuff, but I did this with my old cat feeder machine. In the process I discovered a service/backdoor SSH account, a system that does not encrypt p-frames at all before uploading data to the cloud, and a bunch of other things that made me happy I did not connect it to any public networks. Short conclusion: consider against with a camera or a microphone that runs on Tuya-developed firmware. Generalized conclusion: consider against IoT from any manufacturers you don't trust to fully respect your best interests, or aren't willing to audit first. The downside is obvious, of course. And with every year more and more manufacturers tighten up their hardware, but I'm certain the crappy programming and service backdoors are all there, only ways to mess with the network traffic or firmware are clamped down.
- wolrah 2y ago
  > The issue is that a lot of IoT things won't even work unless they have Internet connection and a registered account. To a significant extent I see this as a "buyer beware" situation. Now, a lot of people aren't even really aware of the problem nor knowledgeable enough to know what to look for, but I'd expect the majority of the HN audience is both aware of and able to understand the problem enough to be capable of looking out for and avoiding it. I personally don't mind if a device uses internet connectivity to provide a useful service, but I refuse to buy anything that requires internet connectivity arbitrarily for functionality that could easily be performed locally. The first thing I do when I think a new IoT device might be neat is google "<product> Home Assistant" and see what comes up. If there's no integration or the integration is cloud based instead of local I probably won't buy it. IoT devices are not necessities, most of them are either luxury items or disposable novelties. You can always just not buy them. There are certainly some categories, particularly in the residential market, where it may be harder to find an option you find agreeable but its far from impossible. If every major offering in a category is bad in this way, you almost certainly don't actually need that thing.

Never connect it to the WiFi/Ethernet? Or if you do, filter the traffic. Unfortunately that's often not possible on consumer class modems.

lazide 2y ago
Often the equipment won’t actually work either if you try to filter it meaningfully. I’ve had IoT cameras (in particular) that would brick themselves if you didn’t allow 443 to all Amazon IP blocks. :s

wmf 2y ago

A firewall.

sedro 2y ago

A separate VLAN, if your router is capable

ndriscoll 2y ago

Don't plug it in unless you have the expertise to already know the answer to that question. That should also be your advice to any friends/family. Plugging something like this into a network is a horrifically bad idea. This is like asking people on the Internet how to safely mix random household cleaning chemicals. If you don't have the background to answer that yourself, you should not be doing household chemistry.

pavon 2y ago
I found out after our solar system was installed that the enphase inverter came with a cell modem for monitoring and remote management. Our installers didn't know how or even if it was possible to configure the system without one.
- pilingual 2y ago
  Enphase required the cell connection when I checked a couple years ago. Sol-Ark makes a solid hybrid inverter and allows offline operation.
- ndriscoll 2y ago
  Now you know to advise people to look into that question before the install/find an installer that can guarantee it. If the thing can't easily have cell function disabled (e.g. by pulling a readily accessible card), then advise people to stay away from enphase.
- classichasclass 2y ago
  After I bought out our panels, I found the Enphase modem and disconnected it. It was a USB box connected to the monitoring unit, the monitoring unit has other networking options, and it's mine anyway.

bokkies 2y ago

I have a sunsynk inverter which is the same hardware as deye but apparently different software. I have it hooked up to a Pi4b running home assistant using this https://github.com/kellerza/sunsynk https://github.com/kellerza/sunsynk and it has no direct internet access. I can connect to my home network using tailscale to monitor power usage and generation through the HA app if I'm not at home

breeskee 2y ago

I stuck IOT stuff on a cheap linksys WRT router with ExpressVPN firmware. It forces all clients out over that so Nest, Amazon et al can’t snitch or sell my demographics or billing address to people. Not tying it to my home IP anyway. but this require a DMZ or a second external IP address (I have both with centurylink) because if it’s double nat on your home network. Thee devices can access your home network.

breeskee 2y ago

(If you don’t want IOT talking to the internet at all, set up an internal dhcp server and give the devices a bunk router address . If my gateway were 192.168.1.1 , I just set that clients gateway as 192.168.1.254) Misread your question. Sorry. Most of my devices I do want talking to the internet. Just not on my home IP.

ssl-3 2y ago

VLANs. One for you, one for the Chinese shit. Keep your [phone/PC/whatever] on one VLAN, with a NAT gateway, and they'll work just as they do now. Keep the IoT Things inside of their own VLAN, without a gateway to the Internet. And if a device like Home Assistant or whatever needs to exist on both VLANs in order to be useful, then: Make sure it isn't forwarding/routing/NATing packets. --- The implementation details vary, but they needn't be particularly expensive. What I do at home is run OpenWRT on a Pi 4 for my home routing purposes. It's fast enough for my needs and it's got simple GUI configuration options for VLAN. (Why OpenWRT? Because it's easy for me to puzzle out when I need to adjust something after a few months or a year -- I don't deal with routing every day, nor do I wish to. (Also SQM is a built-in, which always keeps WAN latency tolerable.)) From there, I've got cheap managed switches that enforce/insert VLAN tags where that is useful to me, so I can decide which physical ports are capable of talking to whichever VLANs. And from there, I've got relatively inexpensive Mikrotik access points that are configured to provide different SSIDs for different VLANs. It all works OK, though more enterprisey folks will almost certainly choose a very different path.

stavros 2y ago
> One for you, one for the Chinese shit. Can you give an example of tech devices that aren't manufactured in China?
- ssl-3 2y ago
  No, not specifically. (To bring this to the logical conclusion: So much for Internet access.) ;)
  - deleted 2y ago
    [deleted]
  - stavros 2y ago
    So much for internet access even for you! Your router is also made in China.

drdaeman 2y ago

The issue is that a lot of IoT things won't even work unless they have Internet connection and a registered account. The careful approach to IoT is to never connect a device to anything, dump the firmware, analyze it, reflash the EEPROM with patched TLS certificates (if necessary), write your own server implementation, let the IoT device join a dedicated IoT WiFi network, on that network run everything through a gateway pretending to be "the Internet", where the emulated server is running. Yep, it's this bad. Of course, if the device or its malfunction cannot cause sufficient harm (e.g. it's a light, usually it's not worth to reverse engineer it) then just run it on a separate SSID and VLAN, with least access necessary to get it running (starting from blocking everything and allowing network by network until it works). And, uh, if the device has a LTE or can use something like Amazon Sidewalk, it gets even trickier to keep it tame. I don't have any solar power stuff, but I did this with my old cat feeder machine. In the process I discovered a service/backdoor SSH account, a system that does not encrypt p-frames at all before uploading data to the cloud, and a bunch of other things that made me happy I did not connect it to any public networks. Short conclusion: consider against with a camera or a microphone that runs on Tuya-developed firmware. Generalized conclusion: consider against IoT from any manufacturers you don't trust to fully respect your best interests, or aren't willing to audit first. The downside is obvious, of course. And with every year more and more manufacturers tighten up their hardware, but I'm certain the crappy programming and service backdoors are all there, only ways to mess with the network traffic or firmware are clamped down.

wolrah 2y ago
> The issue is that a lot of IoT things won't even work unless they have Internet connection and a registered account. To a significant extent I see this as a "buyer beware" situation. Now, a lot of people aren't even really aware of the problem nor knowledgeable enough to know what to look for, but I'd expect the majority of the HN audience is both aware of and able to understand the problem enough to be capable of looking out for and avoiding it. I personally don't mind if a device uses internet connectivity to provide a useful service, but I refuse to buy anything that requires internet connectivity arbitrarily for functionality that could easily be performed locally. The first thing I do when I think a new IoT device might be neat is google "<product> Home Assistant" and see what comes up. If there's no integration or the integration is cloud based instead of local I probably won't buy it. IoT devices are not necessities, most of them are either luxury items or disposable novelties. You can always just not buy them. There are certainly some categories, particularly in the residential market, where it may be harder to find an option you find agreeable but its far from impossible. If every major offering in a category is bad in this way, you almost certainly don't actually need that thing.