How safe is a fixed IP directed to home Pc

[xrapidx]

Oh no, let me cancel my vumatel fibre as once you get a dynamically assigned IP it never changes.

No hacker is going to spend days never mind weeks to get into your silly home network. If they really want to get in they will be in within a few minutes, static or dynamic IP, that does not matter. All depends on your your firewall setup in the end

ok.

 

[GoB]

I left Windows Remote Desktop on once and the hacking attempts killed my 2mbps ADSL. Also some problems when running IIS.

So now I've got the dynamic dns set up via MikroTik's default mynetname.net , then a VPN (works via my android phone) , then the firewall rules and nothing unsecured on the network.

 

[SauRoNZA]

Have to disagree on that.

Why? Someone would just lookup your IP against the domain name then even if it changes.

Sure the automated bot scans might miss you but at the end of the day if the same ports are open the same ports are still open.

Static or Dynamic the configuration remains pretty much the same.

 

[xrapidx]

Why? Someone would just lookup your IP against the domain name then even if it changes.

Sure the automated bot scans might miss you but at the end of the day if the same ports are open the same ports are still open.

Static or Dynamic the configuration remains pretty much the same.

The process of changing your static host will be lot less of a hassle than changing your fixed IP if you pick up a repeated attack attempts.

 

[SauRoNZA]

The process of changing your static host will be lot less of a hassle than changing your fixed IP if you pick up a repeated attack attempts.

Changing stuff is the wrong way to go about security, attacks will always happen.

Rather accepting that attacks will happen is the better way to go about it.

You could integrate something like the Sophos UTM Home Edition on an old PC for instance.

https://www.sophos.com/en/products/free-tools/sophos-utm-home-edition.aspx

But there are many other options too.

 

[neoprema]

Of course... the attacker can just brute force Dynamic DNS names and just keep attacking you via the hostname which will always be updated to point to your IP... So saying a fixed IP is more risk than a dynamic one is a bit weak. You still need proper security behind it.

 

[Ho3n3r]

Whilst it's safer to have it dynamic, it is annoying in some instances, i.e. I host a TS server from time to time and I have to give the other users the new IP every now and then.

 

[Batista]

Keep your pc bare bones, I have the same thing at home, there is linux on that pc.There is nothing else so if an attacker got it, they could wipe my hdd, all 50 mb of it.

I guess it would be fun to hack into someones network and play with the lights.

What sort of home automation? Doors or the basics like lights?

 

[xrapidx]

Changing stuff is the wrong way to go about security, attacks will always happen.

Rather accepting that attacks will happen is the better way to go about it.

You could integrate something like the Sophos UTM Home Edition on an old PC for instance.

https://www.sophos.com/en/products/free-tools/sophos-utm-home-edition.aspx

But there are many other options too.

Well aware the odd attempt will happen - can see that in logs

The biggest problem I have is the Pi needing access to the other devices on the network - I suppose I could also setup the entire home automation environment on its on network - its seldom I'd need access from one network to the other.

EDIT: forgot about media access... so will partially work

Of course... the attacker can just brute force Dynamic DNS names and just keep attacking you via the hostname which will always be updated to point to your IP... So saying a fixed IP is more risk than a dynamic one is a bit weak. You still need proper security behind it.

How is an attacker going to brute force Dynamic DNS names and find the correct one? If you move from xyz.dyndns.com to abc.no-ip?

 

[xrapidx]

Keep your pc bare bones, I have the same thing at home, there is linux on that pc.There is nothing else so if an attacker got it, they could wipe my hdd, all 50 mb of it.

I guess it would be fun to hack into someones network and play with the lights.

What sort of home automation? Doors or the basics like lights?

At the moment, lights, door locks, alarm, cameras, pool, garden irrigation , media devices, presence detection and tracking (vehicles).

 

[SauRoNZA]

Well aware the odd attempt will happen - can see that in logs

The biggest problem I have is the Pi needing access to the other devices on the network - I suppose I could also setup the entire home automation environment on its on network - its seldom I'd need access from one network to the other.

EDIT: forgot about media access... so will partially work

But your Pi would be BEHIND your firewall so what's the problem? Don't understand why that is a concern. Those devices would talk to each other on the LAN, not the WAN.

How is an attacker going to brute force Dynamic DNS names and find the correct one? If you move from xyz.dyndns.com to abc.no-ip?

Why on earth would you do that? Just implement proper security.

You will be attacked every day. Do you plan to change hostnames every week?

 

[SauRoNZA]

At the moment, lights, door locks, alarm, cameras, pool, garden irrigation , media devices, presence detection and tracking (vehicles).

Which is surely all secured by decent authentication mechanisms?

So even if someone gets past your firewall and gets access to the box they can't just directly access all these devices.

 

[xrapidx]

But your Pi would be BEHIND your firewall so what's the problem? Don't understand why that is a concern. Those devices would talk to each other on the LAN, not the WAN.

You'd still have port forwarding to the device - which, due to potential vulnerabilities, could allow access to the rest of LAN? Granted, not many people are bored enough.

Why on earth would you do that? Just implement proper security.

You will be attacked every day. Do you plan to change hostnames every week?

This is based on fixed IP vs dynamic - if someone is relentless and won't give up - you could just change the host and they'd be gone.

 

[xrapidx]

Which is surely all secured by decent authentication mechanisms?

So even if someone gets past your firewall and gets access to the box they can't just directly access all these devices.

You'd hope so - smart devices are generally poorly protected - its why I took all of mine off their respective cloud services.

 

[SauRoNZA]

You'd still have port forwarding to the device - which, due to potential vulnerabilities, could allow access to the rest of LAN? Granted, not many people are bored enough.

Sure but that would be the case for any networking arrangement which is why you block them from coming in.

So first they need to find the port, then they need to authenticate against with the correct protocol.

Only then would they need to gain open access to a means to connect to the other devices.

You would need to be absolutely targeted and then by a professional to break all authentication and protocols before you were able to kick them out.

This is based on fixed IP vs dynamic - if someone is relentless and won't give up - you could just change the host and they'd be gone.

Sure...or you could just use something to auto block their IP from repeated failures.

Which is why I recommended an intelligent firewall or something basic like fail2ban.

What OS is this box that you are port forwarding to? And what are you port forwarding to it?

Why port forward to the box instead of the devices directly on their own protocols? Then separate vulnerability.

Are you using random ports instead of industry standard ones?

There are many many ways to secure your problem outside of changing hostnames and IP's.

 

[SauRoNZA]

You'd hope so - smart devices are generally poorly protected - its why I took all of mine off their respective cloud services.

So you are using this box as a gateway then? So just make sure it's impenetrable and your problem is solved.

Forward as little ports as possible and implement 2FA or RSA Keys (depending on OS).

If you try to connect to my house you'd firstly need to come from a Whitelisted IP range (vastly reducing the amount of attacks), then you'd have to have a password that is deeply complex, then you'd have to have my RSA keys loaded to authenticate with said password.

That's all assuming you guessed the username.

Impenetrable? I'm not that naive. Unlikely to succeed? Almost certainly.

 

[xrapidx]

Sure but that would be the case for any networking arrangement which is why you block them from coming in.

So first they need to find the port, then they need to authenticate against with the correct protocol.

Only then would they need to gain open access to a means to connect to the other devices.

You would need to be absolutely targeted and then by a professional to break all authentication and protocols before you were able to kick them out.



Sure...or you could just use something to auto block their IP from repeated failures.

Which is why I recommended an intelligent firewall or something basic like fail2ban.

What OS is this box that you are port forwarding to? And what are you port forwarding to it?

Why port forward to the box instead of the devices directly on their own protocols? Then separate vulnerability.

Are you using random ports instead of industry standard ones?

There are many many ways to secure your problem outside of changing hostnames and IP's.

So you are using this box as a gateway then? So just make sure it's impenetrable and your problem is solved.

Forward as little ports as possible and implement 2FA or RSA Keys (depending on OS).

If you try to connect to my house you'd firstly need to come from a Whitelisted IP range (vastly reducing the amount of attacks), then you'd have to have a password that is deeply complex, then you'd have to have my RSA keys loaded to authenticate with said password.

That's all assuming you guessed the username.

Impenetrable? I'm not that naive. Unlikely to succeed? Almost certainly.

The device is running Rasbian - the site itself is on port 443 - its on a standard port because non-standard ports are blocked at client sites. Being a Pi, I guess any brute force attacker would die of boredom.

The site itself is forms authentication - but IP ban after 3 failed attempts (I actually need to check this, I suspect it'll ban the internal gateway's port - but at least access is stopped)

I still need to check what the router offers beyond the standard firewall. I know I can restrict incoming IP addresses - but - I'll need to check how advanced that is, it'd be great if I could whitelist just South African addresses.

 

[SauRoNZA]

The device is running Rasbian - the site itself is on port 443 - its on a standard port because non-standard ports are blocked at client sites. Being a Pi, I guess any brute force attacker would die of boredom.

That's fine but then mix up the ports. Like put use the RDP port for SSH or the other way round. Or even use DNS port (almost always open) externally forwarding to 443 internally.

I still need to check what the router offers beyond the standard firewall. I know I can restrict incoming IP addresses - but - I'll need to check how advanced that is, it'd be great if I could whitelist just South African addresses.

If it's a standard consumer Router unlikely it would support country lists.

Which is why I like the Sophos UTM option.

***

Since it's Rasbian another option would be to have only SSH open which means you can setup both Password and Key-based authentication.

Then set it up to forward the other local ports through your encrypted SSH-tunnel and then you can open browser access on your client machine from localhost:443.

That way you only have one open port and means to secure.

****

Seems fail2ban is also supported. http://kamilslab.com/2016/12/11/how-to-install-fail2ban-on-the-raspberry-pi/ it's a nice extra.

 

[Batista]

At the moment, lights, door locks, alarm, cameras, pool, garden irrigation , media devices, presence detection and tracking (vehicles).

Sheesh, then ignore my post then.

 

[xrapidx]

<snip>

Will revert back tomorrow or Saturday.

Sheesh, then ignore my post then.

I'm a sucker for automating menial tasks. Repetition will be the death of me