I configured a new zone for my IoT devices, where I only allow certain flow and block all the rest
I've setup the zone to drop on INPUT,OUTPUT and FORWARD and only configured the traffic that is allowed through the traffic rules.
However when I connect my laptop to my IoT zone, it seems that the firewall rules are not applied properly, as some flows still go through...
for example, I still have access to my Synology NAS (192.168.5.250) that has one of the interfaces in the same subnet.
Can you please explain me what I'm doing wrong? I really need those firewall rules to work as expected to ensure security...
This is easier to diagnose if you post your configuration in text form (rather than screenshots). Also, how is the laptop connecting (wired or wireless), and what specific tests have you run.
This is expected behavior if the NAS has an interface on the same subnet as the IoT network that the laptop using. Traffic on the same subnet is switched (L2) and does not reach the firewall (which is only involved for routed/L3 connections).
Please copy the output of the following commands and post it here using the "Preformatted text </> " button:
Remember to redact passwords, MAC addresses and any public IP addresses you may have:
What specific tests have you performed? Please provide details.
Also, all of your firewall rules that have a source and destination in the same zone have zero purpose since the traffic will not pass through the firewall.
Ping test from host on LAN @ 192.168.1.7 to Diskstation @ 192.168.2.10
expected result: fail
actual result: succeeded
But we also need to know other things that might be relevant such as "the Diskstation also has an address on the 192.168.1.0/24 network -- 192.168.1.10" or whatever.
Yes the firewall works at layer 3, it can't regulate traffic between devices that are bridged at layer 2.
In order for the firewalling to work, the NAS needs to be in a different network, with a different subnet and layer 3 routing of desired traffic from other zones to it.
Generally speaking, no. The principle of L2 is that the traffic is switched and never goes through the firewall.
First, I wouldn't say this is strange or complex at all... this is standard for networking. You don't need to setup individual subnets for every device, but rather for groups of devices. So. if you want to make sure your IoT devices can't communicate with devices on your trusted LAN, you just need 2 networks to handle that. If you need to further divide the networks to limit specific connections, you could do that, too, but generally you can just do it by broad categories. It really depends on how granular you want to get.
There are a few ways that you can limit things beyond the different subnets, but these are a bit more nuanced on how they function:
Wireless client isolation -- this has the ability to prevent wireless devices from connecting to each other, but this only works for devices on the same AP, and does not limit wired-wireless connections. A good example of where this may be useful is a cafe where you have users connecting via wireless and you wish to prevent communication between customer devices (this can be a security benefit to prevent a bad actor or a malware infested system from trying to hack other people's machines).
local firewalls -- you can set the firewalls on the individual host systems to only accept connections from designated IP addresses. How this is achieved will depend on the specifics of each host operating system and the services that are being hosted, but this is another way to limit connectivity.
Bridge firewall: https://openwrt.org/docs/guide-user/firewall/fw3_configurations/bridge -- this is a method of firewalling L2 connections, but it requires that all traffic actually traverse the bridge. It will not work if there are other paths that the traffic can take (such as through a hardware switch. You can think of this like blocking a road -- it will work well to prevent people from getting from one point to another as long as that road is the only path that connects them. If there are other roads that have not been blocked, people can simply take a detour.
Alright... after an evening of fuzzing around... I think I managed to get up to something that looks more like to what I want, following your feedback above (thanks it was very well explained).
I moved my 2 servers (diskstation & HA) to a new interface that is based on a different subnet.
I've setup my IoT interface on the wireless side to have client isolation. As the nodes only talk to the servers (and having servers now in different subnet/interface), the firewall rules apply and I can better segregate the traffic flowing between the individual components.
With this I'm able to strongly increase my home security in case of a breach on one of my IoT devices.
At least it is a protection for lateral movement in a network.
But the most common breach for IoT devices is DDoS bots living inside them and making them support big DDoS networks with very limited WAN traffic from each IoT over the whole world.
But a firewall will not stop this traffic since it is normally allowed forwarded network to wan traffic.
Well not in my case...
I restricted all traffic from my IoT devices to WAN and reverse... only a few devices I have authorized to reach WAN (Like Tuya as they are still based on cloud polling, and Hue for updates)
The IoT network cannot be accessed directly from WAN and neither from LAN. that fully protects my IoT devices.
Niceđ
A little off point but still OpenWRT/OpenVPN server based tip.
Hue (the Philips thing). I managed to evade their cloud based remote control with my VPN tunnel. Then I could use the app to control the Hue hub from within the network even if I was away from home.
But the Hue is still allowed to update it self.
I have a Netatmo weather station also but that is 100% cloud based. And it doesnât seem to update firmware that often (or at all?). So I am a bit skeptical about the Netatmo cyber security.
But I havenât had time to do that much tweaking with the IoT network other than make it and put the IoT devices inside of it and block it from reaching the admin network.
So I have this work âstill in progressâ.
How did you as easy as possible you find out what wan connections every IoT must be allowed to have? Did you log the packages for a time?
Using Home Assistant, it talks to local API's on the bridge. Hence a traffic rule from my 'servers' towards my 'iot' subnet is sufficient to turn on/off my lights... I almost never use the Hue app itself.
Currently I have traffic rules enable for some devices to reach internet. But I will disable them soon, as like you mentioned, updates don't occur that often... So if I enable them once a month, it should be sufficient.
If you start of your firewall rules to put Deny on input, output & forwarding, you can also enable logging for that zone.
In your system log you will then see source ip, destination ip and corresponding port numbers...
Based on this trace you can open up some routes to internet.
I currently have generic routes open (towards full internet), but I still need to work further on putting some ip restrictions to make it more secure.
