Network Isolation for Gadgets

Lesson 2’s industrial picture was a finance PC that could talk to a PLC. The home picture is a ransomware Tuesday on a laptop that can now see the NAS, the printer, and the baby monitor because they all joined the same SSID the day the mesh kit was unboxed. Isolation does not make a camera “unhackable.” It bounds the blast: a stuffed gadget should not get a free path to the device that holds mail, MFA, and homework. Guest Wi-Fi on consumer routers is the control most households already have. An IoT SSID or a VLAN tagged on a box you administer is the same idea with a fancier name. AP isolation (clients on that SSID cannot talk to each other) is an extra tick some vendors offer — useful for a camera network, still only on gear you own.

Write the legal sentence before you rewrite anyone’s DHCP: original Cyberlium teaching mapped to the CEH v13 IoT and OT hacking domain — not official EC-Council training, not a cert, not exam dumps. Reconfiguring a workplace SSID, a dorm controller, or a family member’s mesh without them asking is not this lesson. If you only have one SSID and the router has no guest toggle, write that honestly: “single SSID — compensating control is unique passwords + firmware + no WAN admin,” and still refuse to expose the DVR. Do not buy a second router with a stolen card. Do not jump onto a neighbor’s guest network to “practice isolation from the other side.” Isolation is a setting on YOUR box, not a pivot through someone else’s NAT.

cat >> "$NOTES" << 'EOF'
flat_lan_fail: gadgets beside laptops
fix_direction: guest/IoT SSID (Lesson 16 cousin)
EOF

Put cameras, plugs, speakers, and cheap hubs on the guest or IoT network. Keep laptops, phones you bank on, and the NAS on the main network. The intended default is: IoT cannot start sessions into main. Some consumer gear implements that as “guest cannot see LAN.” Some mesh apps have an IoT tile. Read the screen you actually have; write the path. If a camera app insists it must live on the same SSID as the phone, that is a vendor convenience that fights isolation — note it, keep the unique password, still do not port-forward, and consider a vendor that can live on guest. This course will not give you a client-isolation bypass so the app “just works” across VLANs. Living with a slightly annoying app is cheaper than a DVR on the internet.

Printers are awkward: you want the laptop to print, and you do not want the printer’s ancient web UI on the WAN. A common household compromise is printer on main with a unique password and firmware current, cameras on guest. Write the compromise you actually chose. Do not invent a “printer VLAN attack lab” against a school copier. Do not enable WAN IPP because a blog said printers are fun. Discovery protocols (mDNS, UPnP, vendor BLE pairing) make gadgets easy to find on a flat LAN — that is why the guest island exists. Naming mDNS is literacy. Walking a café with a discovery app to inventory other guests’ Chromecasts is not literacy; it is other people’s devices.

Three exposure shapes, still without a how-to for punching them. (1) Manual port-forward — you mapped 80/554/443 on the WAN to the DVR because a phone app wanted “watch from work.” That DVR is now a website. Turn it off on gear you own. Use the vendor’s official app path if you must watch remotely, and prefer a factor you control; still keep the camera on guest. (2) UPnP — the gadget asked the router to open a hole and the router said yes. Disable UPnP on a router YOU administer if you do not need it; do not disable it on a café gateway. (3) WAN-side router admin — a checkbox “allow administration from the internet.” Off. SSH and HTTPS to the router from the WAN are not a Cyberlium lab on a stranger’s CPE. IPv6 and “exposed host” / DMZ-host features that dump a gadget past NAT are the same class: named so you turn them off at home, not so you hunt them on an ISP’s customers.

Vendor clouds are a trade: the camera talks out to a relay so you never forwarded a port, and in exchange a company you may not be able to audit holds a path to the lens. That is a threat model, not an assignment to intercept the relay. Defender ticks: unique password, MFA on the vendor account if offered, a vendor still shipping updates, isolation so a stuffed camera does not walk to the NAS. Do not MITM the vendor. Do not register a classmate’s serial. Do not scrape a cloud API you do not own. If you refuse the cloud, LAN-only viewing on guest Wi-Fi is a valid choice you write in the notes.

An isolation note is a diagram in sentences. Date (UTC). Main SSID vs guest/IoT SSID (or “single SSID — no guest toggle”). Which gadgets sit where. Whether guest is blocked from LAN (yes/no/unknown). WAN admin off (yes/no). UPnP off or not needed (yes/no/unknown). Port-forwards you removed (or “none found”). Ethics: no café controller, no dorm VLAN rewrite, no neighbor NAT, no discovery stroll of other people’s gadgets. Legal line: original Cyberlium teaching mapped to the CEH v13 IoT and OT hacking domain — not official EC-Council training, not a cert, not exam dumps. File: $HOME/cyberlium-lab/iot-isolation-notes.txt, chmod 600.

Empty “I will do guest later” fails. Honest “router has no guest — passwords + no WAN admin + firmware” passes if you write it. Screenshots of a school wireless controller fail. World-readable 777 fails. Lesson 4 will ask default-changed Y/N and on-guest-net Y/N; this lesson is why those columns exist. Do not fill them with a hallway camera you spotted on a guest SSID that is not yours.

On a computer you own, log into YOUR router or mesh app as the owner. Read guest/IoT toggles, WAN admin, UPnP, port-forward list. Fill the template. chmod 600. The block writes notes and a checker — there is no WAN scanner, no UPnP exploit, no extra host.

cat >> "$NOTES" << 'EOF'
turn_off_if_unneeded: UPnP, WAN remote admin
vendor_cloud: least privilege / unique password — still MY account
EOF

A filled notes file that says “single SSID, WAN admin off, unique passwords” is complete. A filled notes file that lists a café gateway password or a dorm controller dump is not. Re-run the checker after you replace parentheticals. Do not gist port-forward tables from a workplace. Lesson 4 will ask you to tick default-changed and on-guest-net for devices YOU own — including “none owned.” You now treat isolation as the household compensating control: cameras on guest, admin not a website. This is original Cyberlium teaching mapped to the CEH v13 IoT and OT hacking domain — not official EC-Council training, not a cert, not exam dumps. Next — Lab — Inventory Gadgets You Own — one locked table, chmod 600, still never a plant or a neighbor lens.