TL;DR

As Internet of Things (IoT) devices become more commonplace managing the risks they bring becomes more of a bother. I’ve chosen to deal with this by having different network zones for different trust levels; implemented mostly with OpenWrt. But it’s still a compromise where various security risks are accepted as OK given the effort it would entail to deal with them properly.

Background

I came across a Mastodon thread from Terence Eden that referred back to his excellent post ‘Designing a Home Network for Hostile Devices‘. It’s over a decade old, and honestly I don’t think things have got any better since (whilst the threat landscape and knowledge of actual exploits and harm suggests that the issues at hand have got noticeably worse).

I’ve posted here many times over the years about techie details of my home network (and associated home lab) and the things attached to it. But I don’t think I’ve ever taken the time to explain the philosophy behind it.

I don’t (yet) run Home Assistant

I should get this out of the way up front… I don’t use Home Assistant (HA).

I’m aware that I probably should be using it. That it’s ‘better’ for security/privacy etc. than the menagerie of services associated with the devices that I’ve bought. But nothing yet has given me the push to adopt HA.

At some stage in the future I’m pretty sure that the service associated with one of the things I take for granted will get rug pulled, forcing me to find an alternative, and HA will be that alternative. And then I’ll get whisked away by an avalanche of HA ‘just one more thing’. The creaking noise from that avalanche is a big reason I’ve chosen not to do HA yet.

Shared services

Home networks have a security problem for the same reason that corporate networks have a security problem – shared services. To wit – file servers and printers.

There’s a simple answer – don’t have shared services. Then everything can ‘just’ connect to the Internet, and you don’t have to worry about the things on your network attacking each other[1]. In the corporate world Google call this BeyondCorp, though the idea originates from the Jericho Forum. More broadly this is the idea that underpins ‘Zero trust architecture‘.

In some ways it’s an easier problem to solve on the corporate environment. Documents/spreadsheets/presentations can be hosted on Google Workspace or Office 365 or whatever without much hassle as the files are (relatively) small. That’s not so true for media files, or .iso images for home lab VMs; which is why I have a Network Attached Storage (NAS) box at home that’s accumulated 13.3TB of stuff. Even with Gigabit Internet hauling those files from cloud based storage isn’t very practical.

Then there’s the printers. I don’t print much; these days nobody in the house does[2]. But when I do want to print I want to be able to get to the printer without hassle.

Whilst I don’t have Home Assistant, I do have various things that I’ve made or bought that need me to connect to them locally over HTTP(S) or SSH or whatever. Also a few things spitting out MQTT. All that stuff causes the same trouble as file and print; which is that the default approach is ‘hard on the outside, soft in the middle’ where you have a perimeter that’s supposedly keeping the bad guys out, and a trusted zone for ‘good’ stuff; and everything gets bent out of shape when something/somebody abuses/exploits that trust :(

Zones of trust

Rather than A network I effectively have 3, which are defined by their VLAN/subnet/SSID (implemented on OpenWrt routers and access points):

0. Null – I have a whole bunch of things that could be connected to WiFi but that simply aren’t. If I don’t benefit in some way from connectivity being established then it stays offline.
1. Devices – this is where all the stuff that just needs Internet goes. There’s no access to any shared services, and client segmentation is in place so things can’t even see each other.
2. Guest – for house guests (especially back when some portion of those were teenage boys).
3. Home – this is where the shared services live, and all the things that need to access them.

There are definitely cases where I need presence in more than one network, and that’s pretty easy with multi-homing (especially on virtual machines where I can allocate a virtual network interface to a given VLAN). I generally use that to get to the management interfaces of things that have a local web server; but in principle it could also be used to provide (limited) access to shared services.

Side eyes Fire sticks

The more I learn about TV sticks and their apps the less comfortable I am having them on the Home network. But… one of the apps I most frequently use is Kodi, to play media from the NAS.

I could go back to using Raspberry Pis for Kodi, and then the Fire sticks could be evicted to the Devices network. But then that’s a whole bunch of added complexity (not least in remote controls), and extra energy consumption, and sysadmin work keeping stuff up to date. I’d also have to invest in more VLAN capable managed switches, as most of the Fire Sticks are Ethernet connected rather than subjecting myself to the vagaries of WiFi.

MUD in the stuck

Terence referred to the issues of configuration complexity in his blog post. In theory we should have fine grained firewall rules defining exactly what can connect to what (and how), but in practice that’s too much bother.

That’s a problem that should have been solved by Manufacturer Usage Description (MUD), which was defined by RFC8520 back in 2019. But nobody seems to have told the device manufacturers that they have to do that. It’s one thing for US government departments to say something’s a good idea, quite another for it to be mandated by regulation[3].

Conclusion

Does having multiple networks help me against ‘hostile devices’? Yep – at least the ones that might be obviously hostile. But my present design is too trusting, and it remains that way because it’s too much bother to do things differently. If everything I bought came with a MUD, and that description could easily be put to use, then things might be different.

Notes

[1] Though you do still need to worry about things being exploited just for your Internet access. Residential proxy malware is a real problem, which is why the FBI had to publish ‘Evading Residential Proxy Networks: Protecting Your Devices from Becoming a Tool for Criminals‘ and Brian Krebs has been doing sterling work with posts like ‘Read This Before You Buy That TV Streaming Stick‘ and ‘LG to Ban Residential Proxies from Smart TV Apps‘.
[2] Teacher $wife used to print LOTS at home, but has now chosen to use the printers at work – yay :)
[3] The European Union (EU) Cyber Resilience Act (CRA) gets a lot right, but this is an open goal that they missed.