Yes, there are a lot of steps here, but this makes me feel a bit safer. The EdgeRouter Lite happens to be running an NTP server which is quite convenient.
#Surfboard port forwarding securityspy software
Re-configure your security software (in my case SecuritySpy) with the new IP addresses.Select the new interface, select Configure IPv4 Manually.Enter the VLAN ID for the Tag and give it a name.Click the + button and select New VLAN.
#Surfboard port forwarding securityspy mac
On my Mac (the machine recording video), go into Network settings, click the gear and select Manage Virtual Interfaces.Power cycle that port and the device will come up on the new VLAN.Click Ports and locate a port with a camera. Goto Devices and select the UniFi Switch.Before leaving this area, click on DNS and add the VLAN as a Listen Interface and click Save.After setting up the DHCP server, you may want to Configure Static Map to assign specific IP addresses for each MAC address.Click Services at the top of the Edge Router interface.Create a new rule for DHCP using UDP port 67.Create a new rule for DNS using UDP port 53.Enter NTP for the description and select Accept.To the right of the LOCAL ruleset, click on Actions and select Edit Ruleset.IN and OUT are now complete basically we have just made all traffic from this new VLAN never goto the Internet or receive data from the Internet.Repeat the above steps for the OUT and LOCAL rulesets.Select the VLAN (ethernet port + VLAN ID) and the direction.After the rules are saved, select Actions to the right of the IN rule.Repeat for CAMERAS_OUT and CAMERAS_LOCAL (in is for data coming from the camera subnet, out is for data going to the camera subnet, and local is data to and from the router. Setup the VLAN similar to the picture.From the Dashboard, click on Add Interface and then Add VLAN. On the EdgeRouter Lite, setup a new VLAN.Using this equipment, I was easily able to separate out the camera traffic on a VLAN that has no access to the Internet. In my case, I now have managed switches UniFi Switch 8 and the 16 port version as well as an EdgeRouter Lite. I decided to see what I could do to isolate the traffic this is something I’ve wanted to do for 3.5 years ever since I got a Cisco router that did VLANs, but couldn’t figure out a reason and didn’t have the knowledge to do it. Since my IP cameras only need to talk to my server that is recording video, there is absolutely no need for them to connect to the Internet.
I’m pretty good at securing my network from people coming in, but what about things going out? A lot of these IoT devices talk to a server for firmware updates or whatever. While I don’t have that brand of camera, my cameras have accounts that I can’t remove and apparently one ONVIF account with a username/password that can’t be changed. One of the devices that is vulnerable is an IP camera that has a default username and password. The recent distributed denial of service attack is said to have been caused by the Mirai botnet which basically turns IoT devices in attackers.
0 kommentar(er)
