Recommended Posts

I have some family members about 1500 miles away who now have a small group of WiFi IoT devices, most of them from reputable companies (mostly Amazon and Samsung devices), connected directly to their network.  They also have a desktop, two laptops, a few tablets and phones.

 

I recommended that they segment the IoT devices, showed them some videos about why, and they agree. However, they're not going to spend money on new routers and access points just to get a VLAN working, and I'm too far away to support their network if they cobble together something. So the equipment really has to be consumer grade. They have a router/modem from the CableCo, and, in storage, an older router that's still supported.

 

Someone suggested using the older router, running double NAT, connect the IoT devices to it and calling it a day.   The security side of me is sighing while the practical side of me thinks it's better than nothing.

 

So, I'm looking for opinions. I know NAT isn't really a firewall, but it does work pretty well. Do I tell them to go for it?  Some security is better than none. Do I tell them to just leave well enough alone? It's not worth the trouble.  Is there another option that I've overlooked?

You understand the downstream router can talk to everything that is on the upstream network right..  Its just the device on the upstream network wouldn't be able to create connections to the downstream without a port forward.

 

If you were going to do that the upstream router would be where the iot devices would be...   If downstream they might not be able to find them if they are just searching their local network, but they would be able to talk to them..  Unless you could create firewall rule in this downstream router where it could only send traffic to upstream routers IP... I which I have never seen viable in soho routers..

 

Its not good setup, but guess its better than nothing... Why not just put their iot ###### on the "guest" network of the wifi router?  This is about the same sort of half ass solution.. That comes with its own problems..  Think I mentioned in the other thread its time that this consumer stuff started allowing for actual vlans, these flat networks are just begging for some new big IOT based ransomware sort of attack... Where some iot devices gets compromised and then moves to everything else on the network, things get taken down, files get encrypted, etc. etc..

 

The cheapest way to get actual vlan support would be to use soho wifi router(s) that can run say dd-wrt.. And then create actual vlans.. Worse case is you would also need a vlan capable switch maybe - but these days those can be had for like $40..  But depending on what your all connecting and where everything is located and etc..

  On 02/01/2020 at 13:34, BudMan said:

You understand the downstream router can talk to everything that is on the upstream network right..  Its just the device on the upstream network wouldn't be able to create connections to the downstream without a port forward.

 

If you were going to do that the upstream router would be where the iot devices would be...   If downstream they might not be able to find them if they are just searching their local network, but they would be able to talk to them..  Unless you could create firewall rule in this downstream router where it could only send traffic to upstream routers IP... I which I have never seen viable in soho routers..

 

Its not good setup, but guess its better than nothing... Why not just put their iot ###### on the "guest" network of the wifi router?  This is about the same sort of half ass solution.. That comes with its own problems..  Think I mentioned in the other thread its time that this consumer stuff started allowing for actual vlans, these flat networks are just begging for some new big IOT based ransomware sort of attack... Where some iot devices gets compromised and then moves to everything else on the network, things get taken down, files get encrypted, etc. etc..

 

The cheapest way to get actual vlan support would be to use soho wifi router(s) that can run say dd-wrt.. And then create actual vlans.. Worse case is you would also need a vlan capable switch maybe - but these days those can be had for like $40..  But depending on what your all connecting and where everything is located and etc..

Expand  

Unfortunately the guest network on their router doesn't seem to work well, but that might be the best solution for them. 

 

Personally, if it were me I  would go with DD-WRT or Tomato and call it a day, but I've used them and it's not the easiest setup. I don't want to have to support their network from half way across the country by phone. I don't want to support their network at all, honestly, but they're family.

 

I agree with you completely about the flat networks. Why Asus, Linksys and Netgear don't support VLANs as an IoT feature is beyond me.

 

  On 02/01/2020 at 13:12, sc302 said:

It doesn't have to be consumer grade.  You can get ubiquiti (relatively cheap), you can use pfsense (relatively free).  

 

You can use any cheap router to achieve your double nat (~$20-40) if that is what you really want.

Expand  

They're cheap, not really technically inclined and want to use the routers they have.  I'm going to tell them to try the guest network first, it doesn't have a lot of features, but it might be good enough.

  On 02/01/2020 at 16:25, Joe User said:

Unfortunately the guest network on their router doesn't seem to work well, but that might be the best solution for them. 

 

Personally, if it were me I  would go with DD-WRT or Tomato and call it a day, but I've used them and it's not the easiest setup. I don't want to have to support their network from half way across the country by phone. I don't want to support their network at all, honestly, but they're family.

 

I agree with you completely about the flat networks. Why Asus, Linksys and Netgear don't support VLANs as an IoT feature is beyond me.

 

They're cheap, not really technically inclined and want to use the routers they have.  I'm going to tell them to try the guest network first, it doesn't have a lot of features, but it might be good enough.

Expand  

where are they located.  perhaps you could utilize a neowinian to help you/them out.

  On 02/01/2020 at 16:34, sc302 said:

where are they located.  perhaps you could utilize a neowinian to help you/them out.

Expand  

Good idea. I'll ask them if they're willing to outsource :)

 

  On 02/01/2020 at 16:25, Joe User said:

I don't want to have to support their network from half way across the country by phone.

Expand  

What you "could" do then is setup unifi stuff.. Now you can manage their site via the controller, could even be at your house, or in the cloud, etc.  Or just remote into it if on their network via a cloudkey.. Now you have pretty much full insite into what is going on.  You can manage all the vlans and wifi from simple gui, etc.

 

Something like a unifi dream machine - would be drop in replacement for whatever ###### soho thing they are running now..  Its not all that cheap, but its not crazy pricey either since its full solution.. That can be expanded if needed, etc. add some switches, or other AP if needed..

  • Like 2

Well, I was told "This is getting too complicated", so for now, he's going to either do nothing or run guest mode. I'll visit in the spring and most likely build it out with DD-WRT or the like.

 

 

Do you tell your doctor you can not get the heart surgery because it sounds "too" complicated... What about your mechanic when he needs to change out your transmission when your car wont go reverse - do you tell him yeah thats sounds too complicated.. Lets just skip that..

 

There is nothing at all complicated about setting up vlans.. Just because the user doesn't get it, doesn't mean it shouldn't be done if you have someone doing it for you..

 

Don't give him any of the details.. Just tell him buy the dream machine and you will set it up so its more secure.. Done..

  On 03/01/2020 at 14:21, BudMan said:

Do you tell your doctor you can not get the heart surgery because it sounds "too" complicated... What about your mechanic when he needs to change out your transmission when your car wont go reverse - do you tell him yeah thats sounds too complicated.. Lets just skip that..

 

There is nothing at all complicated about setting up vlans.. Just because the user doesn't get it, doesn't mean it shouldn't be done if you have someone doing it for you..

 

Don't give him any of the details.. Just tell him buy the dream machine and you will set it up so its more secure.. Done..

Expand  

His issue isn't an emergency; It's a best practice.  His computers are still firewalled at the OS level from the IoT devices. I still don't like it though.  He's not replacing the home router, it's a Cable Co combo deal, phone/Internet/WiFi router/modem. I'm going to Skype him and we'll go over the settings and set up guest mode for the IoT stuff for now.

 

I did have an idea to use the older router, install Tomato and use it to create a new network for his PCs only and put it in static routing mode. I'll disable NAT, turn on the firewall and that should do it.

 

 

Edited by Joe User
me english gooder now
  On 03/01/2020 at 22:39, Joe User said:

I'll disable NAT, turn on the firewall and that should do it.

Expand  

How do you think this upstream router is going to route those downstream networks to the internet?  Never seen a soho router have that feature.. It will only nat its own lan network.  You going to put dd-wrt on the upstream router?

 

Not sure how you think that is going to isolate your normal network from your iot stuff?  Are you going to firewall on the downstream and prevent clients from talking to the upstream network other than the upstream routers IP?

 

I agree with you its not an emergency - billions of users are all on 1 flat network with all kinds of different IOT devices, etc...  But it really is a sad state of affairs for the consumer networking gear doesn't allow for basic security practices that could be make quite easy for the user to understand via simple gui to isolate different ports and ssids via just allowing for lan to be a private vlan and letting users set what devices could talk to other devices. And or actually vlaning and letting them create firewall rules between the vlans.

 

Currently the only way to correctly do this is use gear that allows for it - which isn't really geared towards the every day users understanding.

  On 04/01/2020 at 01:17, BudMan said:

How do you think this upstream router is going to route those downstream networks to the internet?  Never seen a soho router have that feature.. It will only nat its own lan network.  You going to put dd-wrt on the upstream router?

 

Not sure how you think that is going to isolate your normal network from your iot stuff?  Are you going to firewall on the downstream and prevent clients from talking to the upstream network other than the upstream routers IP?

 

I agree with you its not an emergency - billions of users are all on 1 flat network with all kinds of different IOT devices, etc...  But it really is a sad state of affairs for the consumer networking gear doesn't allow for basic security practices that could be make quite easy for the user to understand via simple gui to isolate different ports and ssids via just allowing for lan to be a private vlan and letting users set what devices could talk to other devices. And or actually vlaning and letting them create firewall rules between the vlans.

 

Currently the only way to correctly do this is use gear that allows for it - which isn't really geared towards the every day users understanding.

Expand  

That's how I run my test network at home. Standard ASUS AC routers, they'll pass everything through the NAT gateway as long as it's in the routing table. (I'm hoping the CableCo router is similar). On the ASUS I usually use Merlin firmware, which is  stock++, sometimes FreshTomato, which is more like DD-WRT but with more quality control.

 

192.168.0.x and 192.168.1.x as examples. .0.x is the original network, .1.x is the secured network. Like you suggested, firewall on the .1.x says to drop everything inbound with an origin from the 0.x network except from the gateway. Then configure the Windows firewall as a backup to that.

Good luck... 3rd party does this - but never seen any stock firmware do it..

 

  Quote

.1.x says to drop everything inbound with an origin from the 0.x network except from the gateway. Then configure the Windows firewall as a backup to that.

 

Expand  

 

So your windows firewall is doing the work.. You need to block the .1 from talking to anything in the .0 other than the gateway.

 

If your running 3rd party you should actually be able to do vlans..

  On 04/01/2020 at 12:26, BudMan said:

Good luck... 3rd party does this - but never seen any stock firmware do it..

 

 

So your windows firewall is doing the work.. You need to block the .1 from talking to anything in the .0 other than the gateway.

 

If your running 3rd party you should actually be able to do vlans..

Expand  

After further testing, you're right. I realized I didn't have stock firmware on there and I already had rules I set up a while ago and forgot about.

 

I'm going to lean on them to get a new router and get their cable company modem working as a passthrough.

 

  On 06/01/2020 at 02:10, Joe User said:

I'm going to lean on them to get a new router

Expand  

That is the best option to be honest..  Currently the only thing I know of on the market not having to do 3rd party firmware to actually do it correctly would be the dream machine from unifi..

 

Unless you go with sep router and AP..  And a managed switch.  This can be done on a budget - but it does get a bit more complicated, unless you do this sort of thing - then its childs play.

  • 11 months later...

This topic was automatically locked because it did not receive any replies for a year. If you want to have this topic reopened

  • please contact any staff moderator or
  • report the first post of the topic with the reason why it should be reopened.

Thank you.

Create an account or sign in to comment

You need to be a member in order to leave a comment

Create an account

Sign up for a new account in our community. It's easy!

Register a new account

Sign in

Already have an account? Sign in here.

Sign In Now
  • Recently Browsing   0 members

    • No registered users viewing this page.
  • Posts

    • Yeah, he identified a whole lot of wasteful spending of US taxpayer money. What's wrong with that? Nothing, unless you had your fingers in the pie of course.
    • How to reduce the annoying Liquid Glass effects on iOS 26 by Aditya Tiwari Apple announced Liquid Glass at WWDC 2025 in all of its glory. It's a new glass-inspired design language from the iPhone-maker making its way to most of its software platforms, including iOS 26, iPadOS 26, macOS 26, tvOS 26, and watchOS 26. Apple markets Liquid Glass as a new translucent material that "behaves like glass in the real world. Its color is informed by surrounding content and intelligently adapts between light and dark environments." The Cupertino giant isn't wrong. The new glass-inspired design does bring a fresh coat of paint and some beautiful visuals to the iPhone and other Apple-made devices. However, as the dust from the mega arrival settles, people are starting to realize the current drawbacks of having too much glass on their device. There have been reports of users, including those at Neowin, experiencing readability issues, background separation issues, and trouble focusing on the content displayed on the screen due to its transparent nature. While these are small nuances on Apple's part that can be fixed without much hassle, it's degrading the initial experience of what the company calls its biggest visual upgrade since iOS 7. That said, there are some workarounds built into iOS 26 that will help you tone down the shortcomings. If you're running the iOS 25 Developer Beta 1 on your supported iPhone model, you can follow these steps to make things a little better: Go to the Settings app on your iPhone. Scroll down and tap on Accessibility > Display & Text Size. Next, you'll find two toggle options: Reduce Transparency and Increase Contrast. When you enable the Reduce Transparency toggle button, iOS 26 can "improve contrast by reducing transparency and blurs on some backgrounds to increase legibility." The other toggle, Increase Contrast, does what its name suggests. It can "increase color contrast between app foreground and background colors." Enabling each of these toggle buttons individually or simultaneously will have different effects on your iPhone's user interface. Control Center is being criticized for the extra transparency, making the UI look cluttered and difficult to focus. Here, the Reduce Transparency button adds a darker background to make the Control Center UI elements stand out. Liquid Glass transparency issues are also prevalent in the Notification Center and the navigation controls of various apps. In the image above, see how the text of the navigation buttons has become unreadable or hard to focus on with certain backgrounds. It's challenging to determine what can trigger such behavior, as one can have countless color combinations on their device. In the image below, this is how these buttons look when both Reduce Transparency and Increase Contrast are enabled. It's still a hit or miss depending on what colors you are dealing with. Part of the blame also goes to the fact that iOS 26 is still an early beta, and the change doesn't render as intended every time. You can also notice the difference in the look and feel of the Control Center when reduced transparency is turned on. On a side note, you can add the Reduce Transparency and Increase Contrast buttons in the Control Center for quicker access. That said, let's wait to see what changes Apple will implement as it continues to gather feedback through the beta program. Hopefully, the software will become more stable when the first public beta of iOS 26 arrives sometime in July. Interested users can try out the latest iPhone update through the developer beta program, noting that early builds might come with unexpected bugs and issues.
    • Austin residents rally against Tesla's robotaxi launch by Hamid Ganji Tesla's plan to launch its robotaxi service in Austin, Texas, has sparked protests in the city. While the EV maker targets June 22 as the launch date, local residents are raising their voices against the plan due to political disagreements and safety concerns. As reported by CNBC, public safety advocates and political protesters are organizing protests against Tesla's robotaxi launch in Austin. Members of the Dawn Project, Tesla Takedown, and Resist Austin have cited safety issues with Tesla's automated driving systems. Meanwhile, Elon Musk's involvement in Donald Trump's administration and his work in the Department of Government Efficiency (DOGE) has prompted another group of people to join the Austin protests against Tesla. To show Austin citizens the safety problems of Tesla's self-driving system, The Dawn Project brought a Tesla Model Y to the protest, equipped with the company's Full Self-Driving (FSD) software (version 13.2.9). In the demonstration, the Model Y with FSD software reportedly zoomed past a school bus with a stop sign held out and ran over a child-sized mannequin placed in front of the car. The FSD package includes automatic lane-keeping, steering, and parking. It is unclear to what extent this test was conducted under standard conditions or what Tesla's defense is. However, multiple cases of Tesla FSD software malfunction in the past have resulted in collisions or severe accidents, according to data collected by National Highway Traffic Safety Administration. Interestingly, The Dawn Project CEO Dan O'Dowd is the CEO of another company that sells embedded safety and security solutions to carmakers like Ford and Toyota. It remains to be seen whether Tesla could launch a robotaxi service in Austin despite the residents' protests. Earlier this week, Elon Musk demonstrated the new version of Tesla's FSD software in a post on X. Musk's decisions on DOGE fuel public backlash against Tesla. While Musk left the Trump administration after a beef with the president, he's still a target of public criticism, which directly imapcts Tesla. As a result, the slow sales have even caused Tesla to sell its Cybertruck with 0 percent APR to boost sales.
    • I'm sure Denmark would stand to lose a lot if US consumers stopped buying Danish products, whether that's Lurpak butter or hi-fi equipment.
    • JD Vance will be the next President. Who've the Democrats got? Harris again? lol....
  • Recent Achievements

    • Week One Done
      LagFighterZ earned a badge
      Week One Done
    • First Post
      ThatGuyOnline earned a badge
      First Post
    • One Month Later
      5i3zi1 earned a badge
      One Month Later
    • Week One Done
      5i3zi1 earned a badge
      Week One Done
    • Week One Done
      julien02 earned a badge
      Week One Done
  • Popular Contributors

    1. 1
      +primortal
      546
    2. 2
      ATLien_0
      229
    3. 3
      +FloatingFatMan
      166
    4. 4
      Michael Scrip
      119
    5. 5
      +Edouard
      91
  • Tell a friend

    Love Neowin? Tell a friend!