IoT, Guest, Primary best practice network security RB850

Question

I have an RB853 router with wired and WiFi and presently just a primary network and a Guest Network. I have extensive IoT devices and home automation and would like to get suggestions on best practices for better isolating the IoT devices while not creating problems in controlling them from iPhones that would be on the Primary Network. We appreciate WiFi cameras, security system with the base connected via hard-wired Ethernet, automated lighting and window shades along with other typical Alexa/Google smart speakers and Apple TVs. Which devices inside my home that are on the primary network should be pushed over to either the Guest network, or configured to run on a VLAN / Bridge? Also, I'm aware from Orbi that multiple times per week a particular laptop is getting outside connection attempts blocked from IP addresses outside the US (Netherlands, Belize....). The laptop is on the primary home network, and connected via WiFi. Should this laptop that appears to be subject to hack attempts be segmented onto a VLAN? (I have some network experience from sales engineering with a large router company, but that's getting rusty.) Before I go making changes would appreciate hearing from those more experienced on how to best configure the network to support various devices without creating problems.

Last, I've tried to get Comcast to release and renew my IP by power off for a while, and power back on. But the IP does not change. I thought that would be a basic good idea to change my IP from what the hackers were daily attempting. However my "dynamic IP" does not change on booting back up.

Comcast ISP with Motorola owned modem & GigE speed

CrimpOn · Answer

Like beauty, security practices are "in the eye of the beholder".&nbsp; What one person considers "best" others may think of as "meh".
&nbsp;
Random comments:
&nbsp;
IoT Network. Your observation is correct.&nbsp; Devices connected to the IoT network are in the same IP subnet as everything except Guest devices.&nbsp; The IoT network was created to address a specific customer complaint: that the primary 2.4G and 5G WiFi network has only one SSID.&nbsp; The 2.4G and 5G WiFi networks cannot be given different names, which was a common feature on earlier WiFi routers.&nbsp; Some IoT devices have poorly written smart phone apps and setup struggles when the phone is connected at 5G.&nbsp; Netgear "held the line" for years and finally offered a solution: create a different WiFi network where the 5G signal could be turned off.&nbsp; (There were numerous other solutions Netgear could have implemented, but that's the one they chose.&nbsp; If a particular user finds that all IoT devices are "no problem" to set up, there is no reason to enable the IoT network.
&nbsp;
Guest Network.&nbsp; With the guest network being "separate", it is not possible to access devices on the guest network from the primary network.&nbsp; For the vast majority of IoT devices, this is not a problem because the app managing them goes "through the cloud".&nbsp; If the app will turn on a light bulb from Starbucks or when driving around in a car, being on the guest WiFi network is not a problem.&nbsp; In one sense, therefore, putting IoT devices on the guest WiFi is "more secure" because if some evil person "takes over" the IoT device, there is not much damage they can do.&nbsp; But......really? Are we worried about Dr. Evil commandeering our smart plugs?
&nbsp;
Can you please explain how attempts to connect to a laptop on the Orbi LAN are detected?&nbsp; The laptop is 'hidden' behind Network Address Translation (NAT).&nbsp; It does not have a public IP address.&nbsp; Are ports being forwarded through the router to this laptop?

Serranopr · Answer

Hi CrimpOn, thanks for your comments.&nbsp; WRT the IoT devices my main concern was having them on the primary network would allow them to potentially be a way to sniff into our network in case one of the devices had a known vulnerability (i.e. Purple Air Sensor, weather station, sprinkler system....).&nbsp; I've seen reports of burglaries in the Bay Area with bad guys carrying WiFi jammers and disrupting home security cameras.&nbsp; I'm assuming at some point bad guys that were also "smart" might learn how to gain access to your network and disable security systems or some other malicious crime.&nbsp;&nbsp;&nbsp;As for the concern about the laptop.&nbsp; I just got another Orbi alert notification from yesterday.&nbsp; "Suspicious Connection Blocked.&nbsp; Netgear Armor has detected and blocked a suspicious connection on PC xxxxxxx".&nbsp; If you click through the alert it will state the remote IP was 80.66.88.211 which is the Netherlands.&nbsp; I realize they could be using a VPN and routed through that IP, but nonetheless it is some device somewhere well outside my home apparently attempting to connect to this PC.&nbsp; I see IP connection attempts from Netherlands, Belize, China, Russia, Germany.....and why me?&nbsp; I don't think I'm that interesting a target to go after.&nbsp; Your thoughts on these warnings?

CrimpOn · Answer

Armor is a mystery to me (I have never enabled Armor.&nbsp; Once I saw, "Free Trial", my brain went into "They want money."
&nbsp;
With no experience to draw on, and no documentation about how Armor works, I can only speculate.&nbsp; If there is no port being forwarded through the router to the laptop, then it is literally impossible for anyone to even attempt to connect to the laptop.&nbsp; My guess is that some application on the laptop has attempted to connect to this IP address and Armor said, "No Way!"&nbsp; (Most likely a web browser.) Check this out:
https://www.abuseipdb.com/check/80.66.88.211&nbsp;
&nbsp;
Here's what Bitdefender says:
https://www.bitdefender.com/consumer/support/answer/28376/&nbsp;
Would have been nice to see a link to an actual "list" of these web sites.
&nbsp;
It might be entertaining to look at web browser history and see what was going on right before this alert popped up.

Serranopr · Answer

To answer your question on what was the PC doing prior to the alert coming up..................nothing.&nbsp; Some of these alerts are occurring during the night when the PC is not being used.&nbsp; It's not a URL that the user gets blocked on.&nbsp; Instead it is the alert that an outside IP tried to connect to the PC.&nbsp; That IPabuse website you referenced shows that the IP that is attempting to connect has thousands of user reports/complaints of hacking attempts (bruteforce, SSH...).&nbsp; That PC is a lightly used relic from some years ago although its loaded with current OS, and scanned for malware/viruses using BitDefender and previously Norton.&nbsp; I do know that my email address and prior passwords could have been subject to a breach by Comcast and they have appeared on the dark web.&nbsp; However every password has been changed and two factor authentication on most every important site we access.&nbsp; Nonetheless, still disturbing to see regular what appear to be hacking attempts on a low value home PC.

CrimpOn · Answer

Thanks for the information. Sounds like Black Magic (Voodoo) to me.
&nbsp;
I would love for one of the technically adapt users on the forum to propose a mechanism that would allow someone to attempt to connect to a specific device on the Orbi LAN.
&nbsp;
The Wikipedia article on Network Address Translation (NAT) is pretty specific in stating that it is impossible for an external device to connect to an internal device:
&nbsp;
This method allows communication through the router only when the conversation originates in the private network, since the initial originating transmission is what establishes the required information in the translation tables. Thus a web browser within the private network would be able to browse websites that are outside the network, whereas web browsers outside the network would be unable to browse a website hosted within.[a] Protocols not based on TCP and UDP require other translation techniques.
&nbsp;
If this laptop is powered on when these events happen, it might be doing "something"?&nbsp; My desktop is a busy little guy 24 hours a day, running all sort of updates, backups, and what-not at all hours of the day and night.
&nbsp;
There is a community forum for Armor. Maybe someone there would have more insight?
https://community.netgear.com/t5/NETGEAR-Armor/bd-p/en-home-armor&nbsp;
&nbsp;

Forum Discussion

IoT, Guest, Primary best practice network security RB850

5 Replies