Skip to content

Sandbox IOT Network

date: 2024-04-27

Introduction

This is a scheme for connecting your smart devices to an sandboxed subnet such that they cannot reach or be reached from anywhere outside of their subnet, with the only exception being that each smart device can reach, and be reached from an application server.

Using a wireguard tunnel between the application server and (wifi) ap server both enables the flow of traffic between the application server and smart devices on the sandboxed subnet, but also encrypts the mqtt traffic.

iot sandbox network

Hostapd

First install hostapd on your RaspberryPi. The relevant config file is /etc/hostapd/hostapd.conf. And then start/enable hostapd with systemctl.

Describe Wifi AP interface

Without explicitly routing traffic between eth0 and wlan0, no devices connecting to the wifi ap will be able to reach, or be reached from, the internet or your home network. 

# /etc/network/interfaces.d/wlan0

auto wlan0
iface wlan0 inet static
        address 10.0.8.1
        network 10.0.8.0
        netmask 255.255.255.0
        broadcast 10.0.8.255

Install and configure dnsmasq (for dhcp)

Each device connecting to the wifi ap will need to know its' ip address, therefore you can use dnsmasq for dhcp service.

Assuming you can figure out how to navigate the tasmota webui of each device well enough to set the hostname and figure out the mac addr, on the RaspberryPi wifi ap install dnsmasq and edit the config file. 

# /etc/dnsmasq.conf
listen-address=10.0.8.1
interface=wlan0
dhcp-range=10.0.8.150,10.0.8.200
dhcp-host=bedroomlight,34:ab:95:c5:27:15,10.0.8.2
dhcp-host=kitchenlight,40:f5:20:11:a9:5d,10.0.8.3
dhcp-host=bathroomlight,70:03:9F:C5:7C:4C,10.0.8.4

Create Wireguard Tunnel Between Application Server and Wifi AP

The wireguard tunnel both encrypts traffic between the application server and the wifi ap server, but also enables communication between the dashboard application server and the smart devices. The devil is in the configuration details.

I think you need to enable forwarding in sysctl on the wifi ap server so that traffic can pass between wlan0 and wg0 (but I'm not entirely positive). 

# /etc/sysctl.conf
net.ipv4.ip_forward=1

Configure wg-quick@wg0 on the wifi ap server as follows. 

# /etc/wireguard/wg0.conf
[Interface]
Address = 10.88.1.1/24
PrivateKey = <private key>
ListenPort = 4449

[Peer]
PublicKey = <public key>
AllowedIPs = 10.88.1.2/32

Configure wg-quick@wg0 on the application server as follows. The magic is in the AllowedIPs value. 

[Interface]
Address = 10.88.1.2/24
PrivateKey = <private key> 

[Peer]
PublicKey = <public key>
AllowedIPs = 10.0.88.0/24,10.0.8.0/24
Endpoint = 192.168.1.88:4444
PersistentKeepalive = 25

Next Step

The next step, not represented in the diagram, is to attach your application server to a second wireguard tunnel such that it can be reached from your client devices.

Note that you can also double-nat the application server in this scheme, because why not? Everything happens inside wireguard tunnels. In my diagram the application server is an virtual machine that is double-natted on an libvirt subnet.