If you have an outdoor Ethernet port—in my case with a WiFi AP connected—how can you go about protecting your network from somebody jacking in?

Is there a way to bind that port to only an approved device? I figured a firewall rule to only allow traffic to and from the WiFi AP IP address, but would that also prevent traffic from reaching any wireless clients connected to the AP?

Edit: For more context, my router is a Ubiquiti UDM and the AP is also Unifi AP

    • brownmustardminion@lemmy.mlOP
      link
      fedilink
      English
      arrow-up
      5
      ·
      3 months ago

      Yeah since the unit is easily accessible I imagine they could just read the MAC address off the sticker and spoof it.

    • sugar_in_your_tea@sh.itjust.works
      link
      fedilink
      English
      arrow-up
      2
      ·
      3 months ago

      Yup, I had to implement this for a customer once, and while it was a paid, it does require authentication before getting access to the network.

  • seang96@spgrn.com
    link
    fedilink
    English
    arrow-up
    8
    ·
    3 months ago

    You could probably do an automation with home assistant to disable the report if the device gets unplugged, notify you about it, then require to you approve / re-enable the port.

    This of course would require the service to be running, but combined with MAC filtering and placing it on an untrusted VLAN that’s probably the best you could do.

  • jet@hackertalks.com
    link
    fedilink
    English
    arrow-up
    3
    ·
    edit-2
    3 months ago

    There are ways to try to identify the device connecting to the network. But that doesn’t prevent a third party from spoofing an appropriately authenticated device and monitoring and collecting traffic as well as injecting traffic. It just raises the difficulty

    Over networks, or access points, that are intrinsically unsafe, the current gold standard is to require clients transiting those networks to then use a VPN. So internal Wi-Fi, with access only to a wire guard server, and your wireless clients connect to the wire guard server.

    Even if a malicious actor takes over the access point, or compromises the ethernet cable itself, the traffic will be encrypted, and only authenticated clients will be able to actually access your infrastructure.

    So you would enforce a VLAN onto the port that the access point has access to, and then that VLAN can only access the UDM wireguard server.

    • jet@hackertalks.com
      link
      fedilink
      English
      arrow-up
      2
      ·
      3 months ago

      Some devices will let you specify a list of allowed MAC addresses per port. I believe ubiquity does allow this.

      Some devices will have a whole port security protocol, if they see a Mac address that hasn’t been authenticated, the port is put into violation requiring an admin to physically validate it after visiting the port to make sure nothing nefarious happened. I do not believe ubiquiti has this