Block Local Network Connections?

[borealis67]

Please excuse me if this isn't being posted in the correct place or has been addressed.

Is there a way to setup my OPNsense router to block or hide all LAN devices from seeing or interacting with each other?

This is something I've been wondering about for a while but after I saw this video I made me want to do this even more.

I would really very much like to keep my devices from doing anything more than using my network to access the WAN. I do not have wifi anymore; I have gone 100% ethernet. I just use the network to get devices on the internet. I don't need the LAN for transferring files or anything like that. I just want all devices to be invisible and inaccessible to each other.

Is this possible? Is there a way to request such a feature to be added to OPNsense? Or is it there and I am just ignorant of its existence?

Any help is appreciated.

[pfry]

Thanks, Steve.

Sure, just run all connections through the firewall. I do this. In general you just need enough compute power in your firewall (varies by application) and appropriate connectivity (e.g. lots of ports on the firewall and/or virtual ports via one or more managed Ethernet switches).

I jail my TV (connect it to a port on the firewall that does not allow outbound communication), as I do not use any "smart" features. I connect it (to Ethernet) to try to dissuade it from connecting to open wi-fi... which may or may not be effective (I believe it is, as my TV is fairly old). I'd remove the wi-fi module, but that effectively disables the remote (which I use occasionally).

[tangofan]

Thanks, Steve.

Sure, just run all connections through the firewall. I do this. In general you just need enough compute power in your firewall (varies by application) and appropriate connectivity (e.g. lots of ports on the firewall and/or virtual ports via one or more managed Ethernet switches).

Just to clarify: That would mean running every device directly into a port on the firewall, would it not? Because if you connect them via a switch, that traffic would never hit the firewall, since the switch would just pass it directly via the applicable port to the target device.

Of course now that I think of it, if you had a managed(!) switch, then you could put each device into a separate VLAN that you also created in OPNsense. Then there would be no intra-VLAN traffic and the switch would forward all traffic to OPNsense. Pretty extreme, but workable. Perhaps someone has a better idea?

[meyergru]

In a strict sense, you would need a separate VLAN for any specific device. Most people only separate an "IoT" VLAN.
There are smart switches and networking equipment, where you can even keep devices on layer 2 separate. Unifi can do that on their WiFi networks ("Client Device Isolation", but it inhibits Airplay, Chromecast and others).

If you do not want network access for a single network device, you can block that specifically on OpnSense, even without having VLANs. Note, however, that this would strip a smart TV from most of its prominent features, like streaming.

As long as your device has internet access, it can spy on you even when it cannot reach its neighbors one way or another. As the video shows, the webcams and microphones are accessible from outside.

[connervt]

Meyergru is pretty spot on with this.

My best you can do solution here at home is to never connect the "Smart" TV itself to my network.  Instead, I have an AppleTV4K and a Chromecast connected to my big family TV.  The AppleTV4K does everything (and more) better than the TV's native apps.  The Chromecast allows for the simple streaming from one device to another.

I have zero trust in any of the smart TV's native operating systems nor the apps that run on them.

[pfry]

[...]Instead, I have an AppleTV4K and a Chromecast
[...]
I have zero trust in any of the smart TV's native operating systems nor the apps that run on them.

Heh. The lesser of two evils? (I imagine your practical choices are limited; I don't pay attention to that class of devices.)

[cookiemonster]

One "solution" I employed only last week where I wanted to isolate my employer-provided laptop from being on my LAN, after failing to utilise ACLs on my CSS mikrotik managed switch, was to add a new VLAN on it. Then put a standalone eero router in bridge mode into that port (port-based VLAN). Appropriate firewall rules for it of course.
Of course no need to use eero just any wifi AP in bridge mode or similar functionality would do.

[connervt]

[...]Instead, I have an AppleTV4K and a Chromecast
[...]
I have zero trust in any of the smart TV's native operating systems nor the apps that run on them.

Heh. The lesser of two evils? (I imagine your practical choices are limited; I don't pay attention to that class of devices.)

Instead of "Lesser of two evils" I think of it more as a decision made after performing a risk assessment.

Apple has shown to have set a higher bar for security, and Chromecast devices are basically dumb where the casting device is likely a bigger risk.

WebOS used by LG (and who knows what by budget TV brands) are certainly more suspect, and the preloaded apps that come on your smart TV are a revenue source for the TV makers, not unlike the bloat of software that came on your Packard Bell PC bought in the 1990's.

[nero355]

This is something I've been wondering about for a while but after I saw this video I made me want to do this even more.

What's the TL;DR version of the exact issue bothering you in the video ?!

I am not a big fan of all those hyped YouTubers so don't feel like watching the video just to discover what's it about...

A very simple TIP I can give you for LG WebOS TV's is to check the EULA's you have accepted and make sure it's only the first one or first two and not all three/four/five of them to avoid your TV being very "chatty" on your network :)

And another very cool thing is to consider using Developer Mode to install YouTube Ads Free for example via the HomeBrew Tool available for both Windows and Linux !!

[passeri]

I would really very much like to keep my devices from doing anything more than using my network to access the WAN. I do not have wifi anymore

For that requirement for the TV you need a basic IoT setup as meyergru said, the TV on its own port or VLAN, configured for outgoing internet access only. Does it matter whether other devices can see each other? If so, you need a VLAN for each, otherwise just the two.

Alternatively, it is possible to lock down the TV so that it can reach nothing but the time of day, and is accessible only from the internal network. A small Mikrotik router can be configured to do this.

I maintain a dumb TV with AppleTV in front like connervt, and imprison an NVR as described in the previous paragraph. Having to VPN in to check what the cameras are seeing is the trade-off when I am out of the house.

[nero355]

I maintain a dumb TV with AppleTV in front like connervt, and imprison an NVR as described in the previous paragraph. Having to VPN in to check what the cameras are seeing is the trade-off when I am out of the house.

This =>

My best you can do solution here at home is to never connect the "Smart" TV itself to my network.  Instead, I have an AppleTV4K and a Chromecast connected to my big family TV.  The AppleTV4K does everything (and more) better than the TV's native apps.  The Chromecast allows for the simple streaming from one device to another.

I have zero trust in any of the smart TV's native operating systems nor the apps that run on them.

?!?!

That's like chosing between two devils that also happen to be twin brothers! LOL! :P


If you really want to get away from it all you need to be a lot more radical and go for something like https://plasma-bigscreen.org/ for example :)