So I fall pretty heavy on the paranoid side when it comes to all the Chinesium home automation and IoT devices. However, my wife wants me to put up some security cameras and if I’m going to do that then I might as well add all the other life conveniences that I want. I would love to keep everything 100% air gapped, but I know that would defeat the purpose of most stuff.

Here is a rough linear diagram of what I think I can do: Internet > pfSense > home network > IoT hub > IoT network

The important thing to note is that I want no traffic to make it from the ‘IoT network’ to the Internet. And the only traffic I want going from the ‘IoT hub’ to the ‘home network’ is a browser interface for the software I’m planning on using.

If I understand correctly, this is pretty easy to do with a firewall on the ‘IoT hub’. I should be able use separate NICs, completely lock down the ‘home network’ NIC, and just allow one application access to one port so that I can open my browser interface.

Is this about as secure as it gets? Or is there a better way?

  • whodatdair@lemm.eeEnglish
    5·
    10 months ago

    Home Assistant on a pi with a zigbee / zwave stick imho, no 802.11 devices.

    Zigbee is an RF standard and I don’t think there’s licensing so the devices tend to be cheaper but more wild west-y, while zwave is a controlled standard and has the cost overhead associated with that. Both standards support nodes being repeaters on the network so a chain of devices can pass instructions to devices not necessarily in range of the base. Also because they’re established standards, zigbee/zwave devices will still be useful after the company that makes them goes under, unlike fly by night wifi crap.

    If you insist on having it wifi based, look into ESP custom firmware flash-able devices - there are open source firmwares that you can know won’t be trying to make any shady calls home.

    My solution to “iot devices be shady” is to run my own network connected base and then everything else is a dumb device that takes commands.

    Oh and if you do go ha on a pi, buy a usb hdd adapter and boot from that - I’ve found sd cards to be unreliable.