• 80 Posts
  • 104 Comments
Joined 3 years ago
cake
Cake day: June 15th, 2023

help-circle

  • I have a VR headset from Facebook that is on its own VLAN because it defaults to randomizing its MAC address by default and this allowed it to bypass the firewall, phone home, and nonconsensually install new anti-features after being blocked because the setting got reset back to random when changing something.

    That is infuriating and I’d do the same.

    Plenty of reports of devices like LG TVs acting as gateways to external devices and LG in particular seems to be a privacy nightmare. I bought a couple of appliances that advertised their smart features only to find LG’s app was required. That app actually required both Internet access AND my exact location at all times to function at all! I shut it all down and disconnected everything from wifi.

    You may be right to be concerned even about printers though. At some point we’re going to be reading about some built-in AI hacking other network devices for Internet access and transmitting our private information to the world.




  • You’re overthinking this with 2 & 3. All you need is to block all Brother Internet traffic.

    Set up a static DHCP IP for the printer in Openwrt and create firewall rules to drop all WAN packets to/from that IP.

    If you want to see evidence those packets are being dropped in real time use tcpdump. When watching LAN traffic you will see the printer sending packets to the WAN interface (they won’t get there) but will never see a response directed back to the printer.

    I have a Brother printer (plus cameras & TVs) and an Openwrt router set up that way and have had zero issues.



















  • I had the same setup and the same problems with VPN (in my case Wireguard) server availability. While looking for a solution I realized I was trying to solve an architecture problem with software.

    Instead of trying to find a software solution to work around my WG server uptime issues, I moved the Wireguard endpoint to an OpenWRT router. Now if my router is up, my WG endpoint is up and my network is accessible. I’ve been running this configuration for years and it has been 100% accessible.

    I’m comfortable with the security of WG - open ports for WG endpoints are invisible to network scanners because they do not respond at all and appear closed unless they are sent the the correct key. Even if an attacker has some way of know a WG peer is listening on a specific port, cracking a 256-bit key would take trillions of years. I was then free to choose a remote access application without worrying about remote attackers gaining access to my servers because of some company’s failed security.

    FOSS VNC server apps work OK, but I found them somewhat limited so I added NoMachine as my primary option and run both. It’s a commercial app but it’s free, and is one of the only closed source app I use. It can be run 100% locally (although they have a paid option that uses their servers). It allows full control over your servers including file transfer and audio.

    Doesn’t check all your boxes, but it comes close.