Recommended Posts

I have some family members about 1500 miles away who now have a small group of WiFi IoT devices, most of them from reputable companies (mostly Amazon and Samsung devices), connected directly to their network.  They also have a desktop, two laptops, a few tablets and phones.

 

I recommended that they segment the IoT devices, showed them some videos about why, and they agree. However, they're not going to spend money on new routers and access points just to get a VLAN working, and I'm too far away to support their network if they cobble together something. So the equipment really has to be consumer grade. They have a router/modem from the CableCo, and, in storage, an older router that's still supported.

 

Someone suggested using the older router, running double NAT, connect the IoT devices to it and calling it a day.   The security side of me is sighing while the practical side of me thinks it's better than nothing.

 

So, I'm looking for opinions. I know NAT isn't really a firewall, but it does work pretty well. Do I tell them to go for it?  Some security is better than none. Do I tell them to just leave well enough alone? It's not worth the trouble.  Is there another option that I've overlooked?

You understand the downstream router can talk to everything that is on the upstream network right..  Its just the device on the upstream network wouldn't be able to create connections to the downstream without a port forward.

 

If you were going to do that the upstream router would be where the iot devices would be...   If downstream they might not be able to find them if they are just searching their local network, but they would be able to talk to them..  Unless you could create firewall rule in this downstream router where it could only send traffic to upstream routers IP... I which I have never seen viable in soho routers..

 

Its not good setup, but guess its better than nothing... Why not just put their iot ###### on the "guest" network of the wifi router?  This is about the same sort of half ass solution.. That comes with its own problems..  Think I mentioned in the other thread its time that this consumer stuff started allowing for actual vlans, these flat networks are just begging for some new big IOT based ransomware sort of attack... Where some iot devices gets compromised and then moves to everything else on the network, things get taken down, files get encrypted, etc. etc..

 

The cheapest way to get actual vlan support would be to use soho wifi router(s) that can run say dd-wrt.. And then create actual vlans.. Worse case is you would also need a vlan capable switch maybe - but these days those can be had for like $40..  But depending on what your all connecting and where everything is located and etc..

2 hours ago, BudMan said:

You understand the downstream router can talk to everything that is on the upstream network right..  Its just the device on the upstream network wouldn't be able to create connections to the downstream without a port forward.

 

If you were going to do that the upstream router would be where the iot devices would be...   If downstream they might not be able to find them if they are just searching their local network, but they would be able to talk to them..  Unless you could create firewall rule in this downstream router where it could only send traffic to upstream routers IP... I which I have never seen viable in soho routers..

 

Its not good setup, but guess its better than nothing... Why not just put their iot ###### on the "guest" network of the wifi router?  This is about the same sort of half ass solution.. That comes with its own problems..  Think I mentioned in the other thread its time that this consumer stuff started allowing for actual vlans, these flat networks are just begging for some new big IOT based ransomware sort of attack... Where some iot devices gets compromised and then moves to everything else on the network, things get taken down, files get encrypted, etc. etc..

 

The cheapest way to get actual vlan support would be to use soho wifi router(s) that can run say dd-wrt.. And then create actual vlans.. Worse case is you would also need a vlan capable switch maybe - but these days those can be had for like $40..  But depending on what your all connecting and where everything is located and etc..

Unfortunately the guest network on their router doesn't seem to work well, but that might be the best solution for them. 

 

Personally, if it were me I  would go with DD-WRT or Tomato and call it a day, but I've used them and it's not the easiest setup. I don't want to have to support their network from half way across the country by phone. I don't want to support their network at all, honestly, but they're family.

 

I agree with you completely about the flat networks. Why Asus, Linksys and Netgear don't support VLANs as an IoT feature is beyond me.

 

3 hours ago, sc302 said:

It doesn't have to be consumer grade.  You can get ubiquiti (relatively cheap), you can use pfsense (relatively free).  

 

You can use any cheap router to achieve your double nat (~$20-40) if that is what you really want.

They're cheap, not really technically inclined and want to use the routers they have.  I'm going to tell them to try the guest network first, it doesn't have a lot of features, but it might be good enough.

8 minutes ago, Joe User said:

Unfortunately the guest network on their router doesn't seem to work well, but that might be the best solution for them. 

 

Personally, if it were me I  would go with DD-WRT or Tomato and call it a day, but I've used them and it's not the easiest setup. I don't want to have to support their network from half way across the country by phone. I don't want to support their network at all, honestly, but they're family.

 

I agree with you completely about the flat networks. Why Asus, Linksys and Netgear don't support VLANs as an IoT feature is beyond me.

 

They're cheap, not really technically inclined and want to use the routers they have.  I'm going to tell them to try the guest network first, it doesn't have a lot of features, but it might be good enough.

where are they located.  perhaps you could utilize a neowinian to help you/them out.

53 minutes ago, sc302 said:

where are they located.  perhaps you could utilize a neowinian to help you/them out.

Good idea. I'll ask them if they're willing to outsource :)

 

3 hours ago, Joe User said:

I don't want to have to support their network from half way across the country by phone.

What you "could" do then is setup unifi stuff.. Now you can manage their site via the controller, could even be at your house, or in the cloud, etc.  Or just remote into it if on their network via a cloudkey.. Now you have pretty much full insite into what is going on.  You can manage all the vlans and wifi from simple gui, etc.

 

Something like a unifi dream machine - would be drop in replacement for whatever ###### soho thing they are running now..  Its not all that cheap, but its not crazy pricey either since its full solution.. That can be expanded if needed, etc. add some switches, or other AP if needed..

  • Like 2

Well, I was told "This is getting too complicated", so for now, he's going to either do nothing or run guest mode. I'll visit in the spring and most likely build it out with DD-WRT or the like.

 

 

Do you tell your doctor you can not get the heart surgery because it sounds "too" complicated... What about your mechanic when he needs to change out your transmission when your car wont go reverse - do you tell him yeah thats sounds too complicated.. Lets just skip that..

 

There is nothing at all complicated about setting up vlans.. Just because the user doesn't get it, doesn't mean it shouldn't be done if you have someone doing it for you..

 

Don't give him any of the details.. Just tell him buy the dream machine and you will set it up so its more secure.. Done..

8 hours ago, BudMan said:

Do you tell your doctor you can not get the heart surgery because it sounds "too" complicated... What about your mechanic when he needs to change out your transmission when your car wont go reverse - do you tell him yeah thats sounds too complicated.. Lets just skip that..

 

There is nothing at all complicated about setting up vlans.. Just because the user doesn't get it, doesn't mean it shouldn't be done if you have someone doing it for you..

 

Don't give him any of the details.. Just tell him buy the dream machine and you will set it up so its more secure.. Done..

His issue isn't an emergency; It's a best practice.  His computers are still firewalled at the OS level from the IoT devices. I still don't like it though.  He's not replacing the home router, it's a Cable Co combo deal, phone/Internet/WiFi router/modem. I'm going to Skype him and we'll go over the settings and set up guest mode for the IoT stuff for now.

 

I did have an idea to use the older router, install Tomato and use it to create a new network for his PCs only and put it in static routing mode. I'll disable NAT, turn on the firewall and that should do it.

 

 

Edited by Joe User
me english gooder now
2 hours ago, Joe User said:

I'll disable NAT, turn on the firewall and that should do it.

How do you think this upstream router is going to route those downstream networks to the internet?  Never seen a soho router have that feature.. It will only nat its own lan network.  You going to put dd-wrt on the upstream router?

 

Not sure how you think that is going to isolate your normal network from your iot stuff?  Are you going to firewall on the downstream and prevent clients from talking to the upstream network other than the upstream routers IP?

 

I agree with you its not an emergency - billions of users are all on 1 flat network with all kinds of different IOT devices, etc...  But it really is a sad state of affairs for the consumer networking gear doesn't allow for basic security practices that could be make quite easy for the user to understand via simple gui to isolate different ports and ssids via just allowing for lan to be a private vlan and letting users set what devices could talk to other devices. And or actually vlaning and letting them create firewall rules between the vlans.

 

Currently the only way to correctly do this is use gear that allows for it - which isn't really geared towards the every day users understanding.

54 minutes ago, BudMan said:

How do you think this upstream router is going to route those downstream networks to the internet?  Never seen a soho router have that feature.. It will only nat its own lan network.  You going to put dd-wrt on the upstream router?

 

Not sure how you think that is going to isolate your normal network from your iot stuff?  Are you going to firewall on the downstream and prevent clients from talking to the upstream network other than the upstream routers IP?

 

I agree with you its not an emergency - billions of users are all on 1 flat network with all kinds of different IOT devices, etc...  But it really is a sad state of affairs for the consumer networking gear doesn't allow for basic security practices that could be make quite easy for the user to understand via simple gui to isolate different ports and ssids via just allowing for lan to be a private vlan and letting users set what devices could talk to other devices. And or actually vlaning and letting them create firewall rules between the vlans.

 

Currently the only way to correctly do this is use gear that allows for it - which isn't really geared towards the every day users understanding.

That's how I run my test network at home. Standard ASUS AC routers, they'll pass everything through the NAT gateway as long as it's in the routing table. (I'm hoping the CableCo router is similar). On the ASUS I usually use Merlin firmware, which is  stock++, sometimes FreshTomato, which is more like DD-WRT but with more quality control.

 

192.168.0.x and 192.168.1.x as examples. .0.x is the original network, .1.x is the secured network. Like you suggested, firewall on the .1.x says to drop everything inbound with an origin from the 0.x network except from the gateway. Then configure the Windows firewall as a backup to that.

Good luck... 3rd party does this - but never seen any stock firmware do it..

 

Quote

.1.x says to drop everything inbound with an origin from the 0.x network except from the gateway. Then configure the Windows firewall as a backup to that.

 

 

So your windows firewall is doing the work.. You need to block the .1 from talking to anything in the .0 other than the gateway.

 

If your running 3rd party you should actually be able to do vlans..

On 1/4/2020 at 6:26 AM, BudMan said:

Good luck... 3rd party does this - but never seen any stock firmware do it..

 

 

So your windows firewall is doing the work.. You need to block the .1 from talking to anything in the .0 other than the gateway.

 

If your running 3rd party you should actually be able to do vlans..

After further testing, you're right. I realized I didn't have stock firmware on there and I already had rules I set up a while ago and forgot about.

 

I'm going to lean on them to get a new router and get their cable company modem working as a passthrough.

 

2 hours ago, Joe User said:

I'm going to lean on them to get a new router

That is the best option to be honest..  Currently the only thing I know of on the market not having to do 3rd party firmware to actually do it correctly would be the dream machine from unifi..

 

Unless you go with sep router and AP..  And a managed switch.  This can be done on a budget - but it does get a bit more complicated, unless you do this sort of thing - then its childs play.

  • 11 months later...

This topic was automatically locked because it did not receive any replies for a year. If you want to have this topic reopened

  • please contact any staff moderator or
  • report the first post of the topic with the reason why it should be reopened.

Thank you.

Create an account or sign in to comment

You need to be a member in order to leave a comment

Create an account

Sign up for a new account in our community. It's easy!

Register a new account

Sign in

Already have an account? Sign in here.

Sign In Now
  • Recently Browsing   0 members

    • No registered users viewing this page.
  • Posts

    • Google Pixel 11 series: Here's what to expect by Hamid Ganji Google Pixel 10 series In recent years, Google has successfully turned its Pixel devices into worthy contenders in the smartphone market. The search giant is now preparing to launch the Pixel 11 series in just a few months, and many Pixel fans are likely wondering what Google has in store for them this year. The next lineup of Google smartphones includes four devices: the Pixel 11, Pixel 11 Pro, Pixel 11 Pro XL, and Pixel 11 Pro Fold. This year, we don’t expect Google to bring revolutionary upgrades to its handsets, and the Pixel 11 series is likely to receive modest hardware improvements alongside a slew of AI-powered features. Here are the rumored specifications of the Google Pixel 11 series ahead of its official debut: When will the new Pixel phones be unveiled? The last two generations of Google Pixel phones (Pixel 9 series and Pixel 10 series) were launched in August, unlike the previous three generations that debuted in October. With that in mind, we expect Google to unveil the Pixel 11 series sometime in August 2026. The exact launch date has yet to be confirmed. Google Pixel 11 CAD renders - Image via AndroidHeadlines How much will the Pixel 11 series cost? Predicting the final price of upcoming smartphones has become increasingly difficult. As you may know, RAM and memory prices are rising sharply, leading to significant increases in the cost of consumer electronics. Recently, Apple CEO Tim Cook said that price increases for some future Apple products are unavoidable, suggesting that the iPhone 18 series could become more expensive. Google has remained tight-lipped about any potential price increases for the Pixel 11 series. If the company manages to maintain last year’s pricing structure, here’s what the lineup could cost: Pixel 11: $799 Pixel 11 Pro: $999 Pixel 11 Pro XL: $1,199 Pixel 11 Pro Fold: $1,799 Given current market conditions, it may be difficult for Google to avoid raising prices unless it adopts cost-saving measures, such as equipping the base model with 8GB of RAM. Google Pixel 11 series anticipated specs: We expect the Google Pixel 11 series to debut with a new Tensor G6 processor as well as an upgraded camera system. The overall design, however, is expected to remain largely unchanged across the lineup. Specifications Pixel 11 Pixel 11 Pro Pixel 11 Pro XL Pixel 11 Pro Fold Display 6.3-inch LTPO AMOLED / 120Hz refresh rate / up to 3100 nits of brightness 6.3-inch Super Actua LTPO OLED, 120Hz refresh rate, up to 3600 nits of brightness 6.8-inch Super Actua LTPO OLED, 120Hz refresh rate, up to 3600 nits of brightness 8-inch inner screen and 6.4-inch outer display, 120Hz refresh rate, up to 3600 nits of brightness RAM & Processor Tensor G6 / 8-12GB of RAM Tensor G6 / 12-16GB of RAM Tensor G6 / 12-16GB of RAM Tensor G6 / 16GB of RAM Storage options 128GB or 256GB 256GB, 512GB, 1TB 256GB, 512GB, 1TB 256GB, 512GB, 1TB Camera 50MP main sensor, 13MP ultra-wide, 10.8MP 5x telephoto, 10.5MP front camera 50MP main camera, 48MP ultra-wide, 48MP telephoto with 5x optical zoom, 42MP selfie camera 50MP main camera, 48MP ultra-wide, 48MP telephoto with 5x optical zoom, 42MP selfie camera 50MP main camera, 10.5MP ultra-wide camera, 10.8MP telephoto camera, 10MP front camera, 10MP inner camera Battery 4,840 mAh 4,707 mAh 5,000 mAh 4,658 mAh Software Android 17 Android 17 Android 17 Android 17 The Pixel 11 series won’t be a major departure from its predecessor, with Google instead focusing on subtle improvements and AI additions such as Gemini Intelligence. However, a patent filed by Google suggests the company is working on a removable battery for its smartphones, and we could see this feature make its way to the Pixel 11 Pro Fold. Given that nearly all smartphones today lack removable batteries, such a feature would be a welcome addition to future Pixel devices. That said, it may not arrive with this year’s lineup after all, and the final decision is yet to be made by Google. The Pixel 11 series could also face an uphill battle in the market. In the Android segment, Samsung is performing well with the Galaxy S26 series, while the Galaxy Z Fold 8 lineup is also expected to launch next month. On the other hand, Apple is preparing to unveil the iPhone 18 Pro and iPhone 18 Pro Max in September alongside its first foldable iPhone.
    • At least AMD is still taking Windows 10 seriously (after the oops) before it consumer extended support ends. @WaltC - Memories, 2x Voodoo in SLI with a Riva TNT with an Aureal A3D soundcard.
    • So size is the ONLY selling point????? People have been plugging in PC's to TV's in living rooms for 20+ years. I would take a bigger box for more peformance. Also lot and lots of SFF/Mini ITX build guides out there.
    • My point is, if you buying this instead of a console for TV purposes, that you need to understand that you will not be able to play the most popular MP games with Steam OS. Now if you are not into those games, and into some of the perputual alpha/beta games on Steam then this is an option. I would argue a gaming PC would be the better route, more expensive but take the 1k -1.4k you are about to spend on this thing and build a better one. Because it is running Linux you can overide its 1080p settings. However The Verge complained about its 1080p cap and how you would have to get around it at the CLI, so someone buying this instead of a PS5 or Xbox might have a challege on their hands.
    • A review of Synology's BeeCamera software for the BeeStation Plus by Christopher White Synology is leaning into the BeeStation and the BeeStation Plus, and it's easy to understand why. While power users will want something more customizable, the BeeStation and its more powerful sibling, the BeeStation Plus, are great for those who want a device they can simply plug in, click a few buttons, and have it work as their own personal cloud. Until recently, the device was mostly used for the storage of files, photos, and videos, and with the Plus model, you could install and stream media through Plex. Synology recently released a new free application for the BeeStation Plus called BeeCamera, which is basically a stripped-down version of Surveillance Station. First, let's get the confusing naming out of the way. While you might initially think that BeeCamera is a physical device, perhaps a camera that Synology created specifically for the BeeStation Plus, that would be incorrect. BeeCamera is simply the name for the application that runs on the NAS and on your mobile device. I think the marketing team missed the mark here, but it does fit the other naming on the device, like BeePhotos and BeeFiles, I guess. Camera Support As of right now, only Synology-branded cameras are supported, which many will see as a callback to the drive locking the company implemented and then backtracked on. That said, while I 100% disagree on drive locking, I agree that camera locking for a device made to simply plug and play is the right decision. The whole point of the BeeStation line is simplicity. There are currently three camera model lines available, a wireless device for indoor use, and two PoE models for external use. CC400W (Wi-Fi): Plug it into power using the included power adapter, and connect it to your wireless network. This camera is rated only for indoor use and is the one I was provided to review the BeeCamera. $198.36, in line with the Unifi G6 Compact. BC510 (PoE): A bullet-style camera. Connect it to an Ethernet cable that is providing Power over Ethernet (PoE). This camera is rated for both indoor and outdoor use. $240. TC510 (PoE): A dome-style camera. Connect it to an Ethernet cable that is providing Power over Ethernet (PoE). This camera is rated for both indoor and outdoor use. $240. Although this isn't a review of the actual Synology camera, I did want to note that a positive for the Synology CC400W is that it uses a magnetic base. This means you can mount it on any magnetic surface, which is pretty handy. However, a downside to the camera is that it's powered by a built-in USB cable that's about six and a half feet (two meters) long. This means that the cable will probably be either too long or too short, but more importantly, if the cable is damaged at all, you'll likely need to buy an entirely new camera because there doesn't appear to be a way to replace it, unlike many competitors, like the Unifi G6 Instant. Hopefully, this is something Synology addresses in a future revision of the hardware. The BeeStation Plus supports up to four cameras. Setup The setup of BeeCamera is, like everything in the BeeStation family, very straightforward. Simply make sure you're on at least version 1.5 of the BeeStation OS, and BeeCamera is automatically installed on the device. BeeCamera Setup Screenshots Setting up the CC400W was just as easy. Plug it in, open up the BeeCamera app, and follow the on-screen steps to add the camera. During this process, you'll configure the camera name and how many days of retention you want to keep. The system will also automatically update the firmware for you. The whole thing took only a couple of minutes, excluding the time it took for the camera to update the firmware. Once the camera is connected to the BeeStation Plus, you can manage the various camera settings within the app, although there aren't many to choose from. You're able to configure whether the microphone will record audio (some privacy laws may preclude you from recording it), select what codec to use (H.264 or H.265), configure the color and exposure of the camera, and determine what data you want to overlay onto the video. Finally, you can set up AI detections so that BeeCamera will alert you if it sees certain things. These are all of the common detections you would expect in a camera system, such as people, pets, and vehicles. Under people and vehicles, you can also add extra monitoring for lingering and congestion detection, although pets are currently in "Lab" and therefore have no extra features yet. Recording in 4K using H.265 for 30 days will take roughly 300 GB of storage, which is very reasonable for most regular households, as the BeeStation Plus has 8TB of native storage. If you want to set up detection zones, you can. These are areas that BeeCamera will look at for the various detections, and are helpful if, for example, there's a tree in your frame and you don't want to be notified each time the wind makes the branches move around in the frame. Finally, you can also schedule when the camera should and should not be recording, which is a very useful feature. For example, you may want to record only at night when you're sleeping, but not during the day when you're up and about the house, so you can easily shut the camera off between 8 am and 10 pm. Each hour of each day can be configured to record continuously, only upon a detection event, or disabled completely. You can't fine-tune to record at a specific time, though, only hourly blocks on the hour. Daily Use The best part of BeeCamera is that it's easy and just works. If you only care about being notified when things happen, the mobile app sends those notifications and lets you click the button to bring up the video and see what's going on. For example, when I went out of town and had the camera pointed at the cat tower in our hallway, it was nice to be able to drop in and check that my furry friends were doing okay without me. Initiating the remote connection to the BeeStation Plus through the app is very responsive, but this will heavily depend on your ISP. In my case, using Xfinity, I'm able to go from starting the app to seeing live video in roughly three seconds, which is about the same amount of time it takes to connect to my Unifi UNVR system that costs much more. If you want to see footage from a specific day and time, you can do so using the calendar icon. You can also scroll through the timeline, looking for detections that are labeled in blue (vs. the normal gray when there's nothing of interest). There are buttons that let you go to the last/next detection on the timeline, which is helpful if you missed the notification on your mobile device. That's where the ease of use stops, though. While you can download clips that are flagged by detection, there's apparently no way to select generic time frames you're interested in, and the only place to download is to your phone. In addition, sharing a video shares the actual video, not just a link back to your BeeStation Plus. While that's good from a security and privacy perspective, it's a little awkward for sharing large videos. Limitations While the ease of implementation is great, there are some things that are lacking from BeeCamera. The most obvious is that there is no way to view the footage on the desktop. You can log in to the BeeStation Plus to see how much storage BeeCamera is using, but unlike BeePhotos and BeeFiles, there is no BeeCamera on the web console to manage or view footage. This means you'll be viewing all of your security footage on your mobile device, which is pretty limiting. In addition, there's no way to download the video to your PC without first using your phone as the intermediary. The one exception to this is that you can use BeeFiles to see the raw MP4 files. They're saved in 5-minute increments, and it's just raw data with no detection information or any other way to identify what any of them are. The lack of a way to interact with BeeCamera on the desktop also makes configuration of the cameras more difficult. For example, trying to set up detection zones using a tiny screen and your finger to draw boxes is more cumbersome than it needs to be. This reinforces the idea that BeeCamera is not made for power users. It's also missing some of the more advanced functionality of Surveillance Station. For example, I couldn't find a way to say, "Alert me if the thing in this zone is no longer there." Another major deficiency with BeeCamera, and a feature I suspect may come out in the future, is that while it can detect generic people, there is no specific facial recognition yet. This is an interesting omission, given the fact that other Synology tools can detect specific individuals, and competitors such as Unifi Protect also do it. This is probably a software limitation, so we will have to wait and see if this feature is added in the future. Conclusion If you need a security guard to monitor surveillance cameras to make sure your property is secure, then BeeCamera is not the solution for you. That said, you probably wouldn't be using a BeeStation Plus as the brains behind the system either. BeeCamera (and BeeStation in general) is clearly aimed at households that want to avoid sending personal data to Google and Amazon, and now want to add some cameras to keep an eye on their home and their pets while they're away. BeeCamera excels at doing this. The target market isn't interested in creating cases, tying multiple views together in a single pane of glass, or the like, and for the intended use case, the system works great. Where it starts to fall apart a bit is with more advanced features. Not being able to use a desktop app is a major compromise in my opinion, and having to do all of the configuration on a mobile device is annoying, but not impossible. If you don't want to have a full-fledged NAS device in your home, but still want control over your data (or maybe want an easy way to backup your data for World Backup Day), and want to add a couple of cameras to keep an eye on your house and your pets, this is a great, cheap, and easy way to go, and I suspect more functionality will come over time. If Synology releases a desktop app or at least a way to configure cameras and view footage on a desktop browser, this would be a near-perfect solution for a general home user. As an Amazon Associate, we earn from qualifying purchases.
  • Recent Achievements

    • One Month Later
      timbobit earned a badge
      One Month Later
    • One Month Later
      nates earned a badge
      One Month Later
    • Week One Done
      Almohandis earned a badge
      Week One Done
    • Rookie
      dorf went up a rank
      Rookie
    • First Post
      mike_rumble earned a badge
      First Post
  • Popular Contributors

    1. 1
      +primortal
      476
    2. 2
      +Edouard
      172
    3. 3
      PsYcHoKiLLa
      104
    4. 4
      Michael Scrip
      88
    5. 5
      Steven P.
      70
  • Tell a friend

    Love Neowin? Tell a friend!