Recommended Posts

I have some family members about 1500 miles away who now have a small group of WiFi IoT devices, most of them from reputable companies (mostly Amazon and Samsung devices), connected directly to their network.  They also have a desktop, two laptops, a few tablets and phones.

 

I recommended that they segment the IoT devices, showed them some videos about why, and they agree. However, they're not going to spend money on new routers and access points just to get a VLAN working, and I'm too far away to support their network if they cobble together something. So the equipment really has to be consumer grade. They have a router/modem from the CableCo, and, in storage, an older router that's still supported.

 

Someone suggested using the older router, running double NAT, connect the IoT devices to it and calling it a day.   The security side of me is sighing while the practical side of me thinks it's better than nothing.

 

So, I'm looking for opinions. I know NAT isn't really a firewall, but it does work pretty well. Do I tell them to go for it?  Some security is better than none. Do I tell them to just leave well enough alone? It's not worth the trouble.  Is there another option that I've overlooked?

You understand the downstream router can talk to everything that is on the upstream network right..  Its just the device on the upstream network wouldn't be able to create connections to the downstream without a port forward.

 

If you were going to do that the upstream router would be where the iot devices would be...   If downstream they might not be able to find them if they are just searching their local network, but they would be able to talk to them..  Unless you could create firewall rule in this downstream router where it could only send traffic to upstream routers IP... I which I have never seen viable in soho routers..

 

Its not good setup, but guess its better than nothing... Why not just put their iot ###### on the "guest" network of the wifi router?  This is about the same sort of half ass solution.. That comes with its own problems..  Think I mentioned in the other thread its time that this consumer stuff started allowing for actual vlans, these flat networks are just begging for some new big IOT based ransomware sort of attack... Where some iot devices gets compromised and then moves to everything else on the network, things get taken down, files get encrypted, etc. etc..

 

The cheapest way to get actual vlan support would be to use soho wifi router(s) that can run say dd-wrt.. And then create actual vlans.. Worse case is you would also need a vlan capable switch maybe - but these days those can be had for like $40..  But depending on what your all connecting and where everything is located and etc..

2 hours ago, BudMan said:

You understand the downstream router can talk to everything that is on the upstream network right..  Its just the device on the upstream network wouldn't be able to create connections to the downstream without a port forward.

 

If you were going to do that the upstream router would be where the iot devices would be...   If downstream they might not be able to find them if they are just searching their local network, but they would be able to talk to them..  Unless you could create firewall rule in this downstream router where it could only send traffic to upstream routers IP... I which I have never seen viable in soho routers..

 

Its not good setup, but guess its better than nothing... Why not just put their iot ###### on the "guest" network of the wifi router?  This is about the same sort of half ass solution.. That comes with its own problems..  Think I mentioned in the other thread its time that this consumer stuff started allowing for actual vlans, these flat networks are just begging for some new big IOT based ransomware sort of attack... Where some iot devices gets compromised and then moves to everything else on the network, things get taken down, files get encrypted, etc. etc..

 

The cheapest way to get actual vlan support would be to use soho wifi router(s) that can run say dd-wrt.. And then create actual vlans.. Worse case is you would also need a vlan capable switch maybe - but these days those can be had for like $40..  But depending on what your all connecting and where everything is located and etc..

Unfortunately the guest network on their router doesn't seem to work well, but that might be the best solution for them. 

 

Personally, if it were me I  would go with DD-WRT or Tomato and call it a day, but I've used them and it's not the easiest setup. I don't want to have to support their network from half way across the country by phone. I don't want to support their network at all, honestly, but they're family.

 

I agree with you completely about the flat networks. Why Asus, Linksys and Netgear don't support VLANs as an IoT feature is beyond me.

 

3 hours ago, sc302 said:

It doesn't have to be consumer grade.  You can get ubiquiti (relatively cheap), you can use pfsense (relatively free).  

 

You can use any cheap router to achieve your double nat (~$20-40) if that is what you really want.

They're cheap, not really technically inclined and want to use the routers they have.  I'm going to tell them to try the guest network first, it doesn't have a lot of features, but it might be good enough.

8 minutes ago, Joe User said:

Unfortunately the guest network on their router doesn't seem to work well, but that might be the best solution for them. 

 

Personally, if it were me I  would go with DD-WRT or Tomato and call it a day, but I've used them and it's not the easiest setup. I don't want to have to support their network from half way across the country by phone. I don't want to support their network at all, honestly, but they're family.

 

I agree with you completely about the flat networks. Why Asus, Linksys and Netgear don't support VLANs as an IoT feature is beyond me.

 

They're cheap, not really technically inclined and want to use the routers they have.  I'm going to tell them to try the guest network first, it doesn't have a lot of features, but it might be good enough.

where are they located.  perhaps you could utilize a neowinian to help you/them out.

53 minutes ago, sc302 said:

where are they located.  perhaps you could utilize a neowinian to help you/them out.

Good idea. I'll ask them if they're willing to outsource :)

 

3 hours ago, Joe User said:

I don't want to have to support their network from half way across the country by phone.

What you "could" do then is setup unifi stuff.. Now you can manage their site via the controller, could even be at your house, or in the cloud, etc.  Or just remote into it if on their network via a cloudkey.. Now you have pretty much full insite into what is going on.  You can manage all the vlans and wifi from simple gui, etc.

 

Something like a unifi dream machine - would be drop in replacement for whatever ###### soho thing they are running now..  Its not all that cheap, but its not crazy pricey either since its full solution.. That can be expanded if needed, etc. add some switches, or other AP if needed..

  • Like 2

Well, I was told "This is getting too complicated", so for now, he's going to either do nothing or run guest mode. I'll visit in the spring and most likely build it out with DD-WRT or the like.

 

 

Do you tell your doctor you can not get the heart surgery because it sounds "too" complicated... What about your mechanic when he needs to change out your transmission when your car wont go reverse - do you tell him yeah thats sounds too complicated.. Lets just skip that..

 

There is nothing at all complicated about setting up vlans.. Just because the user doesn't get it, doesn't mean it shouldn't be done if you have someone doing it for you..

 

Don't give him any of the details.. Just tell him buy the dream machine and you will set it up so its more secure.. Done..

8 hours ago, BudMan said:

Do you tell your doctor you can not get the heart surgery because it sounds "too" complicated... What about your mechanic when he needs to change out your transmission when your car wont go reverse - do you tell him yeah thats sounds too complicated.. Lets just skip that..

 

There is nothing at all complicated about setting up vlans.. Just because the user doesn't get it, doesn't mean it shouldn't be done if you have someone doing it for you..

 

Don't give him any of the details.. Just tell him buy the dream machine and you will set it up so its more secure.. Done..

His issue isn't an emergency; It's a best practice.  His computers are still firewalled at the OS level from the IoT devices. I still don't like it though.  He's not replacing the home router, it's a Cable Co combo deal, phone/Internet/WiFi router/modem. I'm going to Skype him and we'll go over the settings and set up guest mode for the IoT stuff for now.

 

I did have an idea to use the older router, install Tomato and use it to create a new network for his PCs only and put it in static routing mode. I'll disable NAT, turn on the firewall and that should do it.

 

 

Edited by Joe User
me english gooder now
2 hours ago, Joe User said:

I'll disable NAT, turn on the firewall and that should do it.

How do you think this upstream router is going to route those downstream networks to the internet?  Never seen a soho router have that feature.. It will only nat its own lan network.  You going to put dd-wrt on the upstream router?

 

Not sure how you think that is going to isolate your normal network from your iot stuff?  Are you going to firewall on the downstream and prevent clients from talking to the upstream network other than the upstream routers IP?

 

I agree with you its not an emergency - billions of users are all on 1 flat network with all kinds of different IOT devices, etc...  But it really is a sad state of affairs for the consumer networking gear doesn't allow for basic security practices that could be make quite easy for the user to understand via simple gui to isolate different ports and ssids via just allowing for lan to be a private vlan and letting users set what devices could talk to other devices. And or actually vlaning and letting them create firewall rules between the vlans.

 

Currently the only way to correctly do this is use gear that allows for it - which isn't really geared towards the every day users understanding.

54 minutes ago, BudMan said:

How do you think this upstream router is going to route those downstream networks to the internet?  Never seen a soho router have that feature.. It will only nat its own lan network.  You going to put dd-wrt on the upstream router?

 

Not sure how you think that is going to isolate your normal network from your iot stuff?  Are you going to firewall on the downstream and prevent clients from talking to the upstream network other than the upstream routers IP?

 

I agree with you its not an emergency - billions of users are all on 1 flat network with all kinds of different IOT devices, etc...  But it really is a sad state of affairs for the consumer networking gear doesn't allow for basic security practices that could be make quite easy for the user to understand via simple gui to isolate different ports and ssids via just allowing for lan to be a private vlan and letting users set what devices could talk to other devices. And or actually vlaning and letting them create firewall rules between the vlans.

 

Currently the only way to correctly do this is use gear that allows for it - which isn't really geared towards the every day users understanding.

That's how I run my test network at home. Standard ASUS AC routers, they'll pass everything through the NAT gateway as long as it's in the routing table. (I'm hoping the CableCo router is similar). On the ASUS I usually use Merlin firmware, which is  stock++, sometimes FreshTomato, which is more like DD-WRT but with more quality control.

 

192.168.0.x and 192.168.1.x as examples. .0.x is the original network, .1.x is the secured network. Like you suggested, firewall on the .1.x says to drop everything inbound with an origin from the 0.x network except from the gateway. Then configure the Windows firewall as a backup to that.

Good luck... 3rd party does this - but never seen any stock firmware do it..

 

Quote

.1.x says to drop everything inbound with an origin from the 0.x network except from the gateway. Then configure the Windows firewall as a backup to that.

 

 

So your windows firewall is doing the work.. You need to block the .1 from talking to anything in the .0 other than the gateway.

 

If your running 3rd party you should actually be able to do vlans..

On 1/4/2020 at 6:26 AM, BudMan said:

Good luck... 3rd party does this - but never seen any stock firmware do it..

 

 

So your windows firewall is doing the work.. You need to block the .1 from talking to anything in the .0 other than the gateway.

 

If your running 3rd party you should actually be able to do vlans..

After further testing, you're right. I realized I didn't have stock firmware on there and I already had rules I set up a while ago and forgot about.

 

I'm going to lean on them to get a new router and get their cable company modem working as a passthrough.

 

2 hours ago, Joe User said:

I'm going to lean on them to get a new router

That is the best option to be honest..  Currently the only thing I know of on the market not having to do 3rd party firmware to actually do it correctly would be the dream machine from unifi..

 

Unless you go with sep router and AP..  And a managed switch.  This can be done on a budget - but it does get a bit more complicated, unless you do this sort of thing - then its childs play.

  • 11 months later...

This topic was automatically locked because it did not receive any replies for a year. If you want to have this topic reopened

  • please contact any staff moderator or
  • report the first post of the topic with the reason why it should be reopened.

Thank you.

Create an account or sign in to comment

You need to be a member in order to leave a comment

Create an account

Sign up for a new account in our community. It's easy!

Register a new account

Sign in

Already have an account? Sign in here.

Sign In Now
  • Recently Browsing   0 members

    • No registered users viewing this page.
  • Posts

    • Indeed. But note that this has Wifi7, HDMI 2.1, BlueTooth 5.4, and 5G Ethernet, so even in the additional features list this bundle blows the Steam Machine away. And, with the money saved, one could improve this dramatically.
    • One of the strangest galaxies in our Universe could help answer some long overdue questions by Sayan Sen Image by Pixabay via Pexels | Not representative An international team of astronomers led by the Department of Astronomy at Tsinghua University has discovered an unusually metal-poor galaxy that may contain signs of first-generation star formation. The galaxy, named Metal-Pristine Galaxy COSMOS Redshift 3 (MPG-CR3), or CR3, was identified using observations from the James Webb Space Telescope (JWST), the Very Large Telescope (VLT), and the Subaru Telescope. The findings, published in The Astrophysical Journal Letters, describe CR3 as the most metal-poor galaxy known from the period known as "cosmic noon," around 11.5 billion years ago. Cosmic noon refers to a period when the universe was producing stars at its highest rate and galaxies were growing rapidly. In astronomy, "metals" refers to all elements heavier than helium, including oxygen, carbon, and iron. Because CR3 contains so few of these heavier elements, researchers say it closely resembles what scientists expect the earliest galaxies in the universe may have looked like. The discovery is significant because it could offer clues about Population III (Pop III) stars, the first generation of stars thought to have formed after the Big Bang. These stars are believed to have formed from gas made almost entirely of hydrogen and helium, before heavier elements were created inside stars and spread across the universe through supernova explosions. Hence this is why CR3 has been referred to as a "living fossil." Scientists have long believed that Population III stars existed only in the very early universe. As more generations of stars formed and died, they enriched surrounding gas with heavier elements, making the conditions needed for metal-free star formation increasingly rare. Because of this, researchers expected the formation of such stars to have largely ended after the epoch of reionization, a period when radiation from the first stars and galaxies transformed the neutral hydrogen filling the universe and made it largely transparent to ultraviolet light. CR3 appears to challenge that idea. The galaxy was observed at a redshift of z = 3.193 ± 0.016. Redshift measures how much light from a distant object has been stretched as the universe expands and helps astronomers determine how far back in time they are looking. In this case, the redshift corresponds to roughly 11.5 billion years ago during cosmic noon. Although the universe was already several billion years old by that point, CR3 shows characteristics more commonly associated with much earlier galaxies. Observations revealed exceptionally strong emissions from hydrogen and helium, including Lyα, Hα, and He I λ10830. Lyα, or Lyman-alpha emission, is a specific wavelength of light produced by hydrogen and is widely used to study distant galaxies. Hα emission is another hydrogen signature commonly used to trace active star formation, while He I λ10830 is produced by helium and can indicate the presence of very hot, young stars. The measured equivalent widths of EW₀(Lyα) = 822 ± 101 Å and EW₀(Hα) = 2814 ± 327 Å are among the highest ever observed in star-forming galaxies. Equivalent width is a measure of the strength of an emission line relative to the surrounding light, and such large values are typically associated with intense and very recent star formation. At the same time, researchers found no statistically significant detections of metal emission lines, including [O III] λλ4959, 5007 and C IV λλ1548, 1550. Emission lines act as chemical fingerprints that reveal which elements are present in a galaxy. Oxygen and carbon lines are commonly seen in galaxies that have already undergone significant chemical enrichment. Their absence in CR3 suggests an unusually pristine environment. Using abundance calibration methods developed with JWST observations, the team placed a 2σ upper limit on the galaxy's gas-phase metallicity of 12+log(O/H)<6.52, corresponding to less than 0.7% of the Sun's metallicity (Z < 7 × 10⁻³ Z⊙). Gas-phase metallicity measures the abundance of heavy elements in a galaxy's gas. A 2σ upper limit indicates that the true value is very unlikely to be higher than the quoted threshold. Even when accounting for uncertainties in the calibration methods, the most conservative limit remains 12+log(O/H)<6.95, making CR3 the most metal-poor galaxy identified at cosmic noon. The galaxy also appears to contain very little dust. Researchers measured a Lyα/Hα flux ratio of 13.9 ± 2.5, a result that suggests negligible dust attenuation, meaning very little of the galaxy's light is being absorbed or scattered by cosmic dust. Because dust is usually produced by earlier generations of stars, this finding further supports the idea that CR3 has experienced very little chemical enrichment. Further analysis using spectral energy distribution modelling, a technique that compares observed light with theoretical models, suggests that CR3 contains an extremely young stellar population only around 2 million years old. The modelling, which used Population III stellar templates, also indicates the galaxy has a stellar mass of approximately 6.1 × 10⁵ M⊙. The symbol M⊙ represents one solar mass, or the mass of the Sun. One of the key questions raised by the discovery is how such a chemically primitive galaxy could exist in a universe that had already spent billions of years producing heavier elements. To investigate this, the researchers examined CR3's surroundings. Their analysis suggests the galaxy may lie in a slightly underdense environment, with a density contrast of roughly δ ≈ −0.12. An underdense region contains less matter and fewer galaxies than average. The team suggests that this relative isolation may have helped preserve pockets of pristine gas. Metal-rich material expelled from nearby galaxies may never have reached CR3, while the lower rate of galaxy mergers and interactions could have slowed the mixing of enriched gas into the system. If future observations confirm these findings, CR3 could provide some of the strongest evidence yet that first-generation star formation continued well after the epoch of reionization. Such a result would challenge the conventional view that pristine star formation ended by z ≳ 6 and suggest that small pockets of metal-free gas survived much longer than previously thought. Researchers stress that more observations will be needed to determine the galaxy's true nature. Future spectroscopic studies with higher resolution and better signal quality could help confirm whether CR3 is genuinely hosting Population III star formation. The discovery is also expected to encourage searches for other similar galaxies, which could help astronomers better understand how the first stars formed and how galaxies evolved in the early universe. Source: Tsinghua University, IOPscience This article was generated with some help from AI and reviewed by an editor. Under Section 107 of the Copyright Act 1976, this material is used for the purpose of news reporting. Fair use is a use permitted by copyright statute that might otherwise be infringing.
    • "I think in the immediate absence of a partner to apply relief" In the words of Sterling Archer... "Phrasing!"
    • For me, the fundamental problems with these "smartglasses" is that they really don't work well for people with significant prescriptions and massively up the price if you use attached lenses if they have displays, and if they don't, then they're not actually "smart" anything, rather just connecting to your phone and relaying voice to an AI. In a few cases like this, they throw in small cameras to feed video to the AI. All around, these feel like both a solution looking for a problem, and the problems it tries to solve seem more easily solved by different approaches and designs. Oddly, if the rumours are true, Apple may actually have invented something for once and it kind of does this right: put cameras in ear buds and manage the interface to AI exactly as most of us do: tapping on an ear bud and saying "Hey Google" or "Hey Siri." That makes them compatible with almost everyone, can double up as a hearing assist device, an impaired vision assist device, a "smart" device... and answer your phone and play music. That just seems like a better solution all around.
    • Usually the bigger ones with many fixes/changes take a few, theyre an exception to the rule most likely
  • Recent Achievements

    • Dedicated
      HidekoYamamoto94 earned a badge
      Dedicated
    • One Month Later
      timbobit earned a badge
      One Month Later
    • One Month Later
      nates earned a badge
      One Month Later
    • Week One Done
      Almohandis earned a badge
      Week One Done
    • Rookie
      dorf went up a rank
      Rookie
  • Popular Contributors

    1. 1
      +primortal
      452
    2. 2
      +Edouard
      161
    3. 3
      PsYcHoKiLLa
      107
    4. 4
      Michael Scrip
      84
    5. 5
      Steven P.
      71
  • Tell a friend

    Love Neowin? Tell a friend!