Designing a Home Network for Hostile Devices
You can do it with a capable (read enterprise grade) router that does packet filtering. You can do it with a linux box and a lot of ethernet network cards as well, but your speed will suffer because every packet needs to be inspected before being forwarded. Hardware assist in packet inspection makes a major difference. See also Software Defined Networking[1].<p>You probably won&#x27;t need &quot;deep packet inspection&quot; for a few years, until the IoT people get smarter about hiding their traffic. That was sarcasm. Maybe. The fact that they cannot do secure networking competently implies they won&#x27;t be able to hide their traffic competently either, but the incentives are much stronger for the latter.<p>Anyway...<p>Step 1: <i>FORCE ALL THE TRAFFIC THROUGH THE ROUTER.</i> Shouting here because, if the traffic does not go through the router, you cannot control (block) it. Forcing the traffic through the router can be difficult. You need to &quot;home-run&quot; all ethernet (wired and wireless) to the router.<p>1a) Hard-wired ethernet is simple. Home run it to the router.<p>1b) Do not permit any small network switches on any of the ethernets (this principle is breakable if you understand that all units on the satellite switch will be unprotected from each other).<p>1c) Best: Do not allow <i>any</i> wireless. This is unrealistic today. Better: have a <i>separate</i> wireless access point (with WPA encryption and good passwords) for every group (class) of wireless devices that then gets home-runned to the filtering router. The filtering router can then prevent your light bulbs on the light bulb[2] WiFi AP from talking to the refrigerator on the kitchen appliance AP. &quot;Better than nothing&quot; is to have multiple SSIDs on one WiFi AP.<p>Step 2: Create a shitload of subnets by either using all of the Class C networks 192.168.0.0&#x2F;16 or subnetting 10.0.0.0&#x2F;8[3] Put each device or logical grouping (class) of devices on a separate subnetwork.<p>Step 3: Disallow all packet routing by default. Bask in the glory of a perfectly secured (albeit perfectly useless) network. Crack open a beer. Drink it fast... the local residents won&#x27;t let you finish it because they will impress on you their pain of not being able to &quot;facebook&quot; because your network is too secure.<p>Step 4: Re-allow all packet routing to tamp down the mutiny.<p>Step 5: Write a shitload (more) routing rules defining which device (class of devices) can talk to which other device on which physical ethernet ports on which ethernet IP addresses (subnets) and IP ports (i.e. whitelist only the necessary traffic).<p>Step 6: Re-enable the packet filtering in the router. Crack open a beer, you deserve it.<p>Step 7: Goto step 4.<p>After a few iterations, you might be able to finish your beer in step 6. After a few weeks, you might even get enough time to enjoy your beer.<p>[1] <a href="https:&#x2F;&#x2F;en.wikipedia.org&#x2F;wiki&#x2F;Software-defined_networking" rel="nofollow">https:&#x2F;&#x2F;en.wikipedia.org&#x2F;wiki&#x2F;Software-defined_networking</a><p>[2] Most light bulbs are not directly on WiFi but are instead on a low power network like Zigbee or Z-Wave. They come with a ethernet-to-Z* gateway. This is actually pretty good, because you can plug the gateway into your filtering firewall and be in pretty good shape because you can treat all of your lightbulbs as a device class and filter them with their ethernet attachment to your router.<p>[3] Subnetting 10.0.0.0&#x2F;8 can be a problem because your internet provider thinks that they need to use 10.0.0.0&#x2F;8 for the two IP networks on your side of their internet attachment point. This is really stupid because their ToS probably specify that you can have only one computer on their precious network (that was sarcasm again. maybe.), so they are blocking 16777214 IP addresses so that they can have one for themselves (10.0.0.1) and provide 1 for you.