Advice needed on securing IOT - AVS Forum | Home Theater Discussions And Reviews
Forum Jump: 
 
Thread Tools
post #1 of 5 Old 02-05-2020, 11:52 AM - Thread Starter
Newbie
 
Join Date: Feb 2020
Posts: 1
Mentioned: 0 Post(s)
Tagged: 0 Thread(s)
Quoted: 0 Post(s)
Liked: 0
Advice needed on securing IOT

Hi,

I am new to the forum, been an AV fan for as long as I can remember and a technology fan. Had been holding off from Smart appliances as was waiting for HomeKit to take off. Currently there isn't much HomeKit stuff that excites me, so I have jumped in with lots of Chinese stuf (Broadlink, Sonoff etc). What amazes me about these products (apart from the affordability) is the ease of installation and setup.

I want to secure my setup as much as possible, but am not sure what to do. I understand its a good idea to put all your IOT devices on the guest network, that makes sense as Guests dont have access to LAN, but I like to change the guest password frequently. Changing the password on each IOT device would take ages, also the apps to run the devices are on my phone, which is on the main network (not guest), so does that not defeat having the device on the guest network?
Automation is offline  
Sponsored Links
Advertisement
 
post #2 of 5 Old 02-10-2020, 03:55 PM
Advanced Member
 
TrendSetterX's Avatar
 
Join Date: Jan 2006
Location: Fort Worth, Texas
Posts: 751
Mentioned: 14 Post(s)
Tagged: 0 Thread(s)
Quoted: 432 Post(s)
Liked: 327
So create a third wireless setup just for “devices”.

Theater: Sony 75x940E | Yamaha 3060 | DirecTv HR54 | ATV4K | MP 4K HDBaseT Extender | SVS PC2000 sub | 5.1 surround
Networking: ASUS RT-AC68U (wireless disabled) | Ubiquiti AmpliFi HD Mesh Wireless with wired back-hauls
Automation & Lighting: Control4 & Lutron Homeworks Interactive
TrendSetterX is offline  
post #3 of 5 Old 02-10-2020, 05:26 PM
AVS Forum Addicted Member
 
BassThatHz's Avatar
 
Join Date: Apr 2008
Location: Northern Okan range (NW Cascades region)
Posts: 11,197
Mentioned: 250 Post(s)
Tagged: 0 Thread(s)
Quoted: 3968 Post(s)
Liked: 4482
Ubiquiti Pro wifi AP's support multiple VLAN's and multiple SSID's from the same device, they also support hundreds of simultaneous connections, often both 2.4ghz and 5ghz. They are a bit more expensive and the learning curve is steep, but they do work well.
Just make sure you buy the correct model number, they are NOT all-the-same, they are all different.

You might even be able to define separate sub-nets with appropriate masking to help block traffic, and firewall rules.

Either that, or just go buy a cheap $5 wifi from the local pawn/thrift store and setup a 3rd network.

Most ISP modems have a bridge-mode on one of the ports for two WAN's.
Tthey will both still be dynamic IP's, unless they are business-tier, which is fine since you won't be hosting your own website from the inside of your house. They will also share your bandwidth/dataplan if-applicable.

That won't keep data from leaking out or from being hacked though, that's an entirely different realm.
It WILL stop traffic between your lan/wireless-lan and guest network from reaching the IOT network in both directions (unless you place a router between them with routes-enabled.)
BassThatHz is online now  
Sponsored Links
Advertisement
 
post #4 of 5 Old 02-13-2020, 05:35 PM
AVS Forum Special Member
 
Bigus's Avatar
 
Join Date: Feb 2003
Location: The South
Posts: 5,841
Mentioned: 13 Post(s)
Tagged: 0 Thread(s)
Quoted: 713 Post(s)
Liked: 625
Yeah I think best practice would be a router that has multiple physical separately configurable LAN's whether a commercial device or something a little more self setup like pfsense, or a router that has separately configurable VLAN's, or a WAP that has separately configurable LAN's, probably in that order of security but likely all perfectly fine for the application.
Bigus is offline  
post #5 of 5 Old 02-19-2020, 12:40 PM
Advanced Member
 
zalusky's Avatar
 
Join Date: Jun 2002
Posts: 926
Mentioned: 0 Post(s)
Tagged: 0 Thread(s)
Quoted: 139 Post(s)
Liked: 83
+1000 for Ubiquiti. I prefer my devices to be separate that way I can update the individual components as tech changes. Why buy a whole new router/Wifi box when the Wifi goes to 802.11XXX. You should only need to upgrade the AP.
zalusky is offline  
Sponsored Links
Advertisement
 
Reply Home Automation

Thread Tools
Show Printable Version Show Printable Version
Email this Page Email this Page


Forum Jump: 

Posting Rules  
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is On
HTML code is Off
Trackbacks are Off
Pingbacks are Off
Refbacks are Off