[DARARepeater] LAN Routing

[Derek Gooley]

Having the devices on separate subnets or VLANs won't secure anything if
they're still routable to eachother. You need to create firewall rules to
block traffic between them.

You could create a rule allowing traffic from your secure network to your
IOT network, a rule allowing established connections from your dirty
network to a secure network (so devices can communicate with hosts on your
secure network once a connection is established), and a rule disallowing
all other outbound and inbound traffic from your dirty network to achieve
what you're asking.

Here's some guides on how to add firewall rules to Ubiquiti EdgeRouter:

https://help.ui.com/hc/en-us/articles/218889067-EdgeRouter-How-to-Create-a-Guest-LAN-Firewall-Rule
https://help.ui.com/hc/en-us/articles/204962154-EdgeRouter-How-to-Create-a-WAN-Firewall-Rule
https://help.ui.com/hc/en-us/articles/204952154-EdgeRouter-Zone-Based-Firewall

On Mon, Oct 12, 2020, 11:06 Mark Erbaugh <mark.election at gmail.com> wrote:

> I’ve started adding IOT devices to my home. Following some security advice
> https://pcper.com/2016/08/steve-gibsons-three-router-solution-to-iot-insecurity/)
> , I’ve configured two sub-nets, one for my computers which are secure (at
> least I’m running security software on them) and one for the IOT devices
> which I don’t trust as much. Hopefully, this will prevent an attacker from
> exploiting a weakness in one of my IOT devices to attack my secure
> computers.
>
>
>
> But I have found a need for an exception to my configuration. I have a
> couple of devices that I don’t fully trust to be on my secure network that
> I need to communicate with from my computer on the secure network:
>
>
>    - FlexRadio 6700 (internal Linux software with unknown security)
>    - Raspberry Pi running OctoPi server to control my 3d printer
>
>
>
> Right now, I’ve left the Flex on the secure network, so I’m trusting the
> Flex developers and I’m not using the OctoPi.
>
>
>
> Is it possible to put these devices on the secure network but configure
> the router (I’m currently using a Ubiquity EdgeRouter X) so that they can
> be accessed from inside the network, but that they can’t access the
> internet? I’m assuming that if the device can’t access the Internet, the
> Internet can’t access the device – is that a valid assumption?
>
>
>
> If so, how?
>
>
>
> One suggestion I saw was to implement parental controls on those devices,
> but I see no mention of parental controls in the EdgeRouter configuration.
>
>
>
> 73,
>
> Mark
>
>
>
>
>
>
>
>
> ______________________________________________________________
> DARARepeater mailing list
> Home: http://mailman.qth.net/mailman/listinfo/dararepeater
> Help: http://mailman.qth.net/mmfaq.htm
> Post: mailto:DARARepeater at mailman.qth.net
>
> This list hosted by: http://www.qsl.net
> Please help support this email list: http://www.qsl.net/donate.html
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://mailman.qth.net/pipermail/dararepeater/attachments/20201012/db3c5484/attachment.html>