15

I received some good answers in the question What do I need to create my own personal cloud for IoT devices? and one of the things that I understood from there is that I need to "expose" my HUB or GATEWAY to the external internet. The proposed solution for that is port forwarding.

I created this as a separate question because it would be difficult to properly to follow-up just with comments on all the answers, someone could get kind of lost. Also, this information may be useful for somebody with a similar question.

I don't like the idea of having to go to my router configuration and configure the port forwarding because that means that I have to configure a device that in spite of being part of the IoT infrastructure, is not one of "my" devices. It has to be as less disruptive of the already existing home network as possible. Also, I've had instances where I don't know the admin password of a particular router and it has been really difficult to get it.

I'm sure that there is a way around that even if that means having a more powerful IoT HUB maybe running Linux, I just don't know what that could be. It is OK to have a bit more complex HUB if that "alternate" way allows avoiding that port forwarding configuration.

I say that I'm sure there is a way thinking about how applications like team viewer don't need to configure port forwarding.

So the question is, does anyone know a way of "exposing" an IoT embedded device to the external internet in order to access it from anywhere in the world that does not involve port forwarding?

10

If you can't port forward your router, you might have to resort to hole punching:

Hole punching is a technique in computer networking for establishing a direct connection between two parties in which one or both are behind firewalls or behind routers that use network address translation (NAT). To punch a hole, each client connects to an unrestricted third-party server that temporarily stores external and internal address and port information for each client. The server then relays each client's information to the other, and using that information each client tries to establish direct connection; as a result of the connections using valid port numbers, restrictive firewalls or routers accept and forward the incoming packets on each side.

The NAT on your router means that clients outside of your network can't connect to open ports of devices inside your network, but it doesn't restrict devices in your network from connecting to a 'broker'. Using a little bit of indirection, you can establish a direct connection between two devices without actually opening any ports - this is essentially what services like Skype and Hamachi do.

Of course, this does require an external server to co-ordinate the connection, and you would probably want to trust the server that was performing the hole punching.

Peer-to-Peer Communication Across Network Address Translators by Bryan Ford, Pyda Srisuresh and Dan Kegel is an interesting read for more information on the mechanisms of hole punching and how reliable it is.

  • Wonderful! One question, though, can that third-party server or "broker" be also inside my house? And be for example an embedded Linux board? Because otherwise, this approach would introduce even a bigger issue talking about having external-3rd party elements in the IoT deployment. If an embedded Linux board can't be this, then what would it be? – m4l490n Feb 23 '17 at 20:27
  • 3
    @m4l490n: It would have to be outside your network in some way. I would imagine it could be a cloud server somewhere, or you could use the Linux board if that was port forwarded. UDP hole punching only works when you have a server/device that is publicly accessible on the Internet somewhere. It's not ideal, but you can't get around the fact that something must be out on the Internet publicly to connect to. I suspect an embedded Linux board in your home network would offer no advantage; you only have to port forward that instead of your IoT device. – Aurora0001 Feb 23 '17 at 20:32
  • 1
    Excellent! Even though it was not the direct intention of your answer and not the original intention of my question, I finally understand the role of a cloud server in an IoT infrastructure!. – m4l490n Feb 23 '17 at 20:46
  • If I understand, the hole is kind of virtual, unlike port forwarding where the router state is modified. Each end of the link is only communicating with the server? So this would be the typical model for IoT, I believe, since the general network is many to many? – Sean Houlihane Feb 24 '17 at 8:06
7

In the IoT world where devices has low resources to handle unwanted traffic from external connections and of course the need to handle any port forwarding and firewall issues with routers has led to the following approach that you can see in a lot of IoT back end solutions:

Devices will not accept any unsolicited network information. All connections and routes will be established by the device in an outbound-only fashion. So the device will open an outbound connections, so no firewall/router tweaks will be needed and it will keep the channel open as long as it needs to be.

A nice article about the communication problems and solutions in the IoT world.

  • For MQTT, the device is a client (publisher or subscriber or both) and initiates the connection to the broker (server). – Gambit Support Mar 1 '17 at 16:53
  • "devices has low resources to handle unwanted traffic from outbound connections" ???? that makes no sense at all. Outbound connections can only be initiated inside the network. – Chris Stratton Dec 19 '17 at 2:28
  • @ChrisStratton , outbound connections can be directed directly to devices using port forwarding if NAT is being used. They can also have their own IP and can be accessed directly from the internet. – shachar Dec 19 '17 at 13:43
  • You seem to be misunderstanding the meaning of the word "outbound" and mistakenly using it where what you actually mean is "inbound". And outbound connection is an IoT device reaching out to a cloud server. An inbound connection is something outside your home network (say your phone, while you are walking down the street) trying to reach in to a device inside your network. – Chris Stratton Dec 19 '17 at 16:54
  • @ChrisStratton , You are correct, When I wrote outbound I meant traffic from outside , which is basically the "Inbound" connection for the sensor. I've edited my answer, Thanks – shachar Dec 20 '17 at 9:31
3

Try Port Knocking. You still have to port forward, but the port is only open after you send a secret combination(you pick) of pings. Then you can close the port with another secret combo of pings. It can run on embedded linux, such as wifi router with OpenWrt.

3

While I cannot recommend that you allow any IoT device to be reachable from the public internet, you can achieve this natively using IPv6.

If your ISP and local network are configured for IPv6, and your IoT devices support it, they can automatically obtain an IPv6 address that is routable from anywhere on the internet (IPv6 removes the need for NAT and port forwarding). You would just need to make sure that any stateful firewalls (your router) are configured to allow the traffic to each device. Some may allow this (insecurely) by default.

2

Setup a VPN server at home, then connect to it from anywhere. I think this would be much more secure than exposing any type of IoT device to the open Internet.

  • Isn't that just some sort of gateway? – Helmar Dec 30 '17 at 19:55
  • hm? a VPN is a point-to-point (usually encrypted) connection between a device and a network. it makes the connecting device act as if it was part of the network. I guess you could thinking of it as a gateway... but it's a service. – Maurice Dec 31 '17 at 5:44
  • Sure, but that service still has to get past the home router—usually through port forwarding or nonstop outbound connections. – Helmar Dec 31 '17 at 10:15
  • yeah, you would still need to port-forward the port the VPN is running on. but it's more secure than exposing individual devices (tho potentially less convenient, depending on what you're trying to achieve) – Maurice Jan 1 '18 at 7:21

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.