The good thing is that you don’t need to know which ports to block. You just set your firewall up to deny by default and then start whitelisting the things you want to allow.
Even easier if you put your “smart” devices in a separate network, then it’s just:
Allow traffic from home net to Internet
allow traffic from home net to iot-net
drop the rest
Now you can surf the internet, control your devices and they can’t phone home
There are a lot of things that won’t play by those rules. A roomba will tell you to f right off without internet access. You have to pick and choose your hardware or make concessions to what can access the outside.
Probably implied in this person’s post (which is what I do) is that you just don’t buy things like that. I started with generic wifi devices which require internet and phone home. I moved everything over to zigbee. Another point is that if you trunk them into vlans like this, the problem with them phoning home is much less of a concern because they can’t get much data more than when you turn the devices off/on which is pretty benign imo.
But even still, the main reason for doing this for me anyway would be less because I am worried about that data going to the companies (which is bordering on useless in this scenario for non-nefarious purposes) and more about reducing the attack vectors. If that company gets hacked, they have basically useless data. If one of the devices become an attack vector and allows someone into your network, it’s trunked so there is no where to go…
The good thing is that you don’t need to know which ports to block. You just set your firewall up to deny by default and then start whitelisting the things you want to allow.
Even easier if you put your “smart” devices in a separate network, then it’s just:
Now you can surf the internet, control your devices and they can’t phone home
There are a lot of things that won’t play by those rules. A roomba will tell you to f right off without internet access. You have to pick and choose your hardware or make concessions to what can access the outside.
Probably implied in this person’s post (which is what I do) is that you just don’t buy things like that. I started with generic wifi devices which require internet and phone home. I moved everything over to zigbee. Another point is that if you trunk them into vlans like this, the problem with them phoning home is much less of a concern because they can’t get much data more than when you turn the devices off/on which is pretty benign imo.
But even still, the main reason for doing this for me anyway would be less because I am worried about that data going to the companies (which is bordering on useless in this scenario for non-nefarious purposes) and more about reducing the attack vectors. If that company gets hacked, they have basically useless data. If one of the devices become an attack vector and allows someone into your network, it’s trunked so there is no where to go…
Ty!