Circle on Orbi RBR50 external control from Circle app outside the network
I'm rather concerned about the builtin Circle app getting access to my router from outside the Internet (outside the firewall) without a VPN or remote management configured or turned on. Without WiFi turned on I can still control a device (block/pause) in my internal network through the Circle app. In my mind, they have broadened the attack vector to/through the router.
Does anybody know the means/ports Circle on the Orbi is using to breach the firewall? If I knew I might be ablel to selectiverly block these communications on the outer firewall while still controlling Circle while on the LAN or going through a VPN. I'm operating under the assumption that Circle/Orbi is not exposing any services from my network through extra open ports due to the fact it is behind the outer firewall. No Web servers, remote management, etc. are exposed from within the network so most inbound ports are closed.
My best guess is, given how the Circle app is still able to shut off the local device behind two firewalls, is that Circle within the Orbi is setting up a reverse proxy by contacing their cloud server (outbound) and setting up a secure tunnel (inbound) on that same connection or another Circle/Orbi sets up for this purpose. If they did that they could use the Circle app to contact their cloud server and issue commands to the router thorugh this tunnel. We used to do this in a past life to avoid changes to customer's firewall.
It may be the case that the cloud topology is essential to Circle's operation even within the LAN. In other words if I were to block access from Circle/Orbi to it's cloud server the Circle app would not be smart enough or have the ability to talk to the router directly on the LAN.
Let there be light and that may only happen by abadoning the cool idea Circle embodies.
