Hacker News Reader

Comment by amluto | Hacker News Reader

Ubiquiti cannot do what I’m describing. Frankly a plain firewall cannot do it securely.

I want the protected device to be on its own subnet with no plain IP packets passed through. It gets access through an authenticating proxy (speaking TCP and maybe UDP) and maybe through a VPN specific to that device.

Conventional network gear can fudge this by putting each protected device on its own VLAN. This does not scale. It’s also vulnerable to anyone who compromises basically any network device with access to a trunk port.

I would expect my device to be considerably more expensive per port than UniFi. (A VLAN capable UniFi switch port costs about $10.)

View on HN

That’s just a local subnet w/DHCP + VPN? They definitely can do it.

There would be no VLAN, just plug the protected device directly into the firewall’s ‘LAN’ port.

A VPN is just a network level proxy for all traffic (roughly speaking), modulo firewall rules.

I’ve done this before. It isn’t even particularly hard to do, assuming the VPN provisioning isn’t a nightmare.

It could be made easier/more commodity of course. I guess we’d need some IoT logic and an app? (Cringes inside)

The cost of shipping a preconfigured Cisco firewall to some location, finding an appropriate place to put it, configuring it and maintaining it will be orders of magnitude higher in all respects than a bespoke device. And it still may not support the TCP-level proxy features that it really should have unless that’s all offloaded to some remote concentrator, which makes for either a not-so-fun HA configuration or an unfortunate single point of failure for access to the entire fleet. UniFi won’t be any better (you’ll be stuck setting up each node as its own “site” and you’ll be stuck with maintaining a bunch of sites on the ever-changing UI platform).

What is your point? You keep moving the goalposts.

None of what you just said is particularly relevant to the original statement.

I'm literally suggesting that some company could make a little device designed to be inserted inline between an IoT or industrial device and the LAN/Internet that would, effectively, retrofit a security policy onto the device without interfering with its normal operation or requiring rework of the device. You're saying that plant operators could use an off-the-shelf firewall, too. I'm saying that using an off-the-self firewall is both weak and a pain to configure and that I think a bespoke device could do a much better job for quite a few reasons.

I don't think any goalposts have moved.

Uh, how do you expect configuring these policies would get any easier than literally the systems designed to configure those policies in the exact same situation?

Or be actually as secure?

I’m just pointing out these things already exist. You can buy and configure them right now.

At first you seemed to deny it, then it’s ’too hard’? Then ‘oh, but what about feature x or y’?

Pick a lane.

Reply on news.ycombinator.com