IoT Network basics

[David Cavalli]

Those who have recently updated to 3006, like me, are making many posts about the "IoT Network" addition. Unfortunately for me, I don't have the basic background to understand IoT and other posts on the subject seem to assume a basic understanding. My Google research only gives me a basic idea. If I understand right, the purpose is to isolate certain devices from your main network, so if/when they are ever compromised, they are limited to their own subnet. Also, if I understand the purpose, this smaller sub-network isn't given access to as much as my main network. In my own world, I use two Guest networks (2.4 and 5) so that when people come over to the house, they don't need my main infrastructure one, nor access to the intranet. I assume IoT is another "guest" type network, that has some other features that make it IoT. (... or is it just a guest network that has a convenient alternate naming convention?) If IoT has other "features", would love to understand what, over "guest".

So everything is working on my main infrastructure network right now, but I see the potential long-term security benefit from putting them on this new IoT sub-network. Here's the list of things that strike me as obvious to add to the IoT: Feit lights, Kasa on/off switches, Ecobee thermostat, Kwikset front door deadbolt, Ring chimes / video doorbells. I'm also assuming that I can probably add my Google Nest Hubs, which can control the prior listed IoT devices, but they also control my smart TV devices too. Here's where I'm not sure: Onn 4k TV streaming devices and my Visio smart TV. Those devices need to access my Linux Plex server, which specificially does need intranet/internet access, so it can't be on IoT.

If I IoT the obvious devices alone, is that the best solution? Any suggestions on the TV related clients / servers? Internet telephone on IoT? Printer on main? Do I have the right idea? Thanks in advance for any/all feedback.

 

[bennor]

If you haven't done so already, see how Asus explains the whole Guest Network Pro feature, and what the IoT profile setting is.

[Guest Network Pro] What is Guest Network Pro? | Official Support | ASUS Global

[Guest Network Pro] How to set up IoT Network? | Official Support | ASUS Global

Generally people will recommend putting "IoT" (Internet of Things) devices onto their own network and isolate it from the main network (main LAN). The reasons vary, including mitigating possible security risks from those IoT devices.

It really comes down to your use case. Do you need to segregate your devices into different networks? If so, do you need those different networks to communicate with each other?

PS: One can setup multiple Guest Network Pro profiles to create one segregated network for guests who need WiFi access, another segregated network for IoT devices and so on. It all depends on one's use case and what they're trying to achive.

 

[David Cavalli]

Perfect answer! That's exactly what I needed to get started! Thanks!

If you haven't done so already, see how Asus explains the whole Guest Network Pro feature, and what the IoT profile setting is.

[Guest Network Pro] What is Guest Network Pro? | Official Support | ASUS Global

[Guest Network Pro] How to set up IoT Network? | Official Support | ASUS Global

 

[Seth Harman]

One suggestion I have is you may still want to be able to directly access some of your IoT devices from the main network (I have a security camera NVR and and a Hubitat device that can be managed through web interfaces that I don't want to expose to the outside world). If that's the case you can put a line in your firewall-start script located in /jffs/scripts/ that looks something like this:

iptables -I FORWARD -i br0 -s 192.168.1.0/24 -d 192.168.53.0/24 -j ACCEPT # Added for access to IoT network from main network
(Note: Replace 192.168.1.0/24 and 192.168.53.0/24 above with whatever you LAN and VLAN IP ranges are)

In my case I made the entire .53.x VLAN accessible from the entire main LAN but you can do it on an individual device basis by just having a line for each device instead of the entire .53.0/24 subnet, including limiting access to specific IPs on the main LAN instead of the entire .1.0/24 subnet.

 

[bennor]

Perfect answer! That's exactly what I needed to get started! Thanks!

There are other past discussions that may help understand Guest Network Pro. Like the following:

Trying to understand Guest Network Pro limitations

Using an AX-86U Pro on FW 3006.102.4_beta1, I'm experimenting with Guest Network Pro and VLANs and I must be missing something. I've created a VLAN (tagged as 3) and set ethernet port 3 as an access port tagged with that VLAN. I've then created a new guest network with that same VLAN, turned on...

www.snbforums.com

In particular there is my following post that explains how to use a firewall-start script to handle certain things like having intranet access disabled but allowing access from the Guest Network Pro Profile to a specific main LAN client. Along with other examples.
https://www.snbforums.com/threads/t...st-network-pro-limitations.94438/#post-952345