Hacker News Reader

Hacker News

Comment by lazide | Hacker News Reader

Parent Full thread

lazide

That’s just a local subnet w/DHCP + VPN? They definitely can do it.

There would be no VLAN, just plug the protected device directly into the firewall’s ‘LAN’ port.

A VPN is just a network level proxy for all traffic (roughly speaking), modulo firewall rules.

I’ve done this before. It isn’t even particularly hard to do, assuming the VPN provisioning isn’t a nightmare.

It could be made easier/more commodity of course. I guess we’d need some IoT logic and an app? (Cringes inside)

View on HN

The cost of shipping a preconfigured Cisco firewall to some location, finding an appropriate place to put it, configuring it and maintaining it will be orders of magnitude higher in all respects than a bespoke device. And it still may not support the TCP-level proxy features that it really should have unless that’s all offloaded to some remote concentrator, which makes for either a not-so-fun HA configuration or an unfortunate single point of failure for access to the entire fleet. UniFi won’t be any better (you’ll be stuck setting up each node as its own “site” and you’ll be stuck with maintaining a bunch of sites on the ever-changing UI platform).

What is your point? You keep moving the goalposts.

None of what you just said is particularly relevant to the original statement.

I'm literally suggesting that some company could make a little device designed to be inserted inline between an IoT or industrial device and the LAN/Internet that would, effectively, retrofit a security policy onto the device without interfering with its normal operation or requiring rework of the device. You're saying that plant operators could use an off-the-shelf firewall, too. I'm saying that using an off-the-self firewall is both weak and a pain to configure and that I think a bespoke device could do a much better job for quite a few reasons.

I don't think any goalposts have moved.

Uh, how do you expect configuring these policies would get any easier than literally the systems designed to configure those policies in the exact same situation?

Or be actually as secure?

I’m just pointing out these things already exist. You can buy and configure them right now.

At first you seemed to deny it, then it’s ’too hard’? Then ‘oh, but what about feature x or y’?

Pick a lane.

Reply on news.ycombinator.com