Homelab

380 readers

9 users here now

Rules

Be Civil.
Post about your homelab, discussion of your homelab, questions you may have, or general discussion about transition your skill from the homelab to the workplace.
No memes or potato images.
We love detailed homelab builds, especially network diagrams!
Report any posts that you feel should be brought to our attention.
Please no shitposting or blogspam.
No Referral Linking.
Keep piracy discussion off of this community

founded 1 year ago

MODERATORS

[email protected]

Home automation security (alien.top)

submitted 11 months ago by [email protected] to c/[email protected]

6 comments fedilink hide all child comments

So I fall pretty heavy on the paranoid side when it comes to all the Chinesium home automation and IoT devices. However, my wife wants me to put up some security cameras and if I’m going to do that then I might as well add all the other life conveniences that I want. I would love to keep everything 100% air gapped, but I know that would defeat the purpose of most stuff.

Here is a rough linear diagram of what I think I can do: Internet > pfSense > home network > IoT hub > IoT network

The important thing to note is that I want no traffic to make it from the ‘IoT network’ to the Internet. And the only traffic I want going from the ‘IoT hub’ to the ‘home network’ is a browser interface for the software I’m planning on using.

If I understand correctly, this is pretty easy to do with a firewall on the ‘IoT hub’. I should be able use separate NICs, completely lock down the ‘home network’ NIC, and just allow one application access to one port so that I can open my browser interface.

Is this about as secure as it gets? Or is there a better way?

you are viewing a single comment's thread
view the rest of the comments

[–] [email protected] 4 points 11 months ago

I think you might be making this more complicated than it needs to be.

Your pfSense firewall has multiple ports, put them to good use. You probably already have pfSense interfaces labeled as WAN and LAN, create another pfSense interface named IoT and hang all your IoT devices off that (dedicated switch or just a VLAN on existing switch, doesn’t really matter)

For bonus points,if you still have another free port on the pfSense firewall, this might be a good time for a DMZ interface as well.

This option does consume a few more Ethernet ports than the “firewall on a stick” method that uses VLAN trunking, but is a bit simpler to manage for homelabbers that are not networking experts.

Now you have “just another interface” on your existing pfSense firewall, so you can assign firewall rules to the IoT network, doing stuff like blocking outgoing connections to the internet, while still allowing connections initiated from the LAN to reach the IoT network.