19

I received some good answers in the question What do I need to create my own personal cloud for IoT devices? and one of the things that I understood from there is that I need to "expose" my HUB or GATEWAY to the external internet. The proposed solution for that is port forwarding.

I created this as a separate question because it would be difficult to properly to follow-up just with comments on all the answers, someone could get kind of lost. Also, this information may be useful for somebody with a similar question.

I don't like the idea of having to go to my router configuration and configure the port forwarding because that means that I have to configure a device that in spite of being part of the IoT infrastructure, is not one of "my" devices. It has to be as less disruptive of the already existing home network as possible. Also, I've had instances where I don't know the admin password of a particular router and it has been really difficult to get it.

I'm sure that there is a way around that even if that means having a more powerful IoT HUB maybe running Linux, I just don't know what that could be. It is OK to have a bit more complex HUB if that "alternate" way allows avoiding that port forwarding configuration.

I say that I'm sure there is a way thinking about how applications like team viewer don't need to configure port forwarding.

So the question is, does anyone know a way of "exposing" an IoT embedded device to the external internet in order to access it from anywhere in the world that does not involve port forwarding?

Improve this question
0

6 Answers 6

Reset to default
10

If you can't port forward your router, you might have to resort to hole punching:

Hole punching is a technique in computer networking for establishing a direct connection between two parties in which one or both are behind firewalls or behind routers that use network address translation (NAT). To punch a hole, each client connects to an unrestricted third-party server that temporarily stores external and internal address and port information for each client. The server then relays each client's information to the other, and using that information each client tries to establish direct connection; as a result of the connections using valid port numbers, restrictive firewalls or routers accept and forward the incoming packets on each side.

The NAT on your router means that clients outside of your network can't connect to open ports of devices inside your network, but it doesn't restrict devices in your network from connecting to a 'broker'. Using a little bit of indirection, you can establish a direct connection between two devices without actually opening any ports - this is essentially what services like Skype and Hamachi do.

Of course, this does require an external server to co-ordinate the connection, and you would probably want to trust the server that was performing the hole punching.

Peer-to-Peer Communication Across Network Address Translators by Bryan Ford, Pyda Srisuresh and Dan Kegel is an interesting read for more information on the mechanisms of hole punching and how reliable it is.

Improve this answer
4
  • Wonderful! One question, though, can that third-party server or "broker" be also inside my house? And be for example an embedded Linux board? Because otherwise, this approach would introduce even a bigger issue talking about having external-3rd party elements in the IoT deployment. If an embedded Linux board can't be this, then what would it be?
    – m4l490n
    Commented Feb 23, 2017 at 20:27
  • 4
    @m4l490n: It would have to be outside your network in some way. I would imagine it could be a cloud server somewhere, or you could use the Linux board if that was port forwarded. UDP hole punching only works when you have a server/device that is publicly accessible on the Internet somewhere. It's not ideal, but you can't get around the fact that something must be out on the Internet publicly to connect to. I suspect an embedded Linux board in your home network would offer no advantage; you only have to port forward that instead of your IoT device.
    – Aurora0001
    Commented Feb 23, 2017 at 20:32
  • 1
    Excellent! Even though it was not the direct intention of your answer and not the original intention of my question, I finally understand the role of a cloud server in an IoT infrastructure!.
    – m4l490n
    Commented Feb 23, 2017 at 20:46
  • If I understand, the hole is kind of virtual, unlike port forwarding where the router state is modified. Each end of the link is only communicating with the server? So this would be the typical model for IoT, I believe, since the general network is many to many?
    – Sean Houlihane
    Commented Feb 24, 2017 at 8:06
7

In the IoT world where devices has low resources to handle unwanted traffic from external connections and of course the need to handle any port forwarding and firewall issues with routers has led to the following approach that you can see in a lot of IoT back end solutions:

Devices will not accept any unsolicited network information. All connections and routes will be established by the device in an outbound-only fashion. So the device will open an outbound connections, so no firewall/router tweaks will be needed and it will keep the channel open as long as it needs to be.

A nice article: “Service Assisted Communication” for Connected Devices about the communication problems and solutions in the IoT world.

Improve this answer
5
  • For MQTT, the device is a client (publisher or subscriber or both) and initiates the connection to the broker (server).
    – Gambit Support
    Commented Mar 1, 2017 at 16:53
  • "devices has low resources to handle unwanted traffic from outbound connections" ???? that makes no sense at all. Outbound connections can only be initiated inside the network.
    – Chris Stratton
    Commented Dec 19, 2017 at 2:28
  • @ChrisStratton , outbound connections can be directed directly to devices using port forwarding if NAT is being used. They can also have their own IP and can be accessed directly from the internet.
    – shachar
    Commented Dec 19, 2017 at 13:43
  • You seem to be misunderstanding the meaning of the word "outbound" and mistakenly using it where what you actually mean is "inbound". And outbound connection is an IoT device reaching out to a cloud server. An inbound connection is something outside your home network (say your phone, while you are walking down the street) trying to reach in to a device inside your network.
    – Chris Stratton
    Commented Dec 19, 2017 at 16:54
  • @ChrisStratton , You are correct, When I wrote outbound I meant traffic from outside , which is basically the "Inbound" connection for the sensor. I've edited my answer, Thanks
    – shachar
    Commented Dec 20, 2017 at 9:31
3

Try Port Knocking. You still have to port forward, but the port is only open after you send a secret combination(you pick) of pings. Then you can close the port with another secret combo of pings. It can run on embedded linux, such as wifi router with OpenWrt.

Improve this answer
3

While I cannot recommend that you allow any IoT device to be reachable from the public internet, you can achieve this natively using IPv6.

If your ISP and local network are configured for IPv6, and your IoT devices support it, they can automatically obtain an IPv6 address that is routable from anywhere on the internet (IPv6 removes the need for NAT and port forwarding). You would just need to make sure that any stateful firewalls (your router) are configured to allow the traffic to each device. Some may allow this (insecurely) by default.

Improve this answer
2

Setup a VPN server at home, then connect to it from anywhere. I think this would be much more secure than exposing any type of IoT device to the open Internet.

Improve this answer
4
  • Isn't that just some sort of gateway?
    – Helmar ♦
    Commented Dec 30, 2017 at 19:55
  • hm? a VPN is a point-to-point (usually encrypted) connection between a device and a network. it makes the connecting device act as if it was part of the network. I guess you could thinking of it as a gateway... but it's a service.
    – Maurice
    Commented Dec 31, 2017 at 5:44
  • Sure, but that service still has to get past the home router—usually through port forwarding or nonstop outbound connections.
    – Helmar ♦
    Commented Dec 31, 2017 at 10:15
  • yeah, you would still need to port-forward the port the VPN is running on. but it's more secure than exposing individual devices (tho potentially less convenient, depending on what you're trying to achieve)
    – Maurice
    Commented Jan 1, 2018 at 7:21
2

Take a look at this ssh! noports I wrote it for to be able to get to my home office/IoT widgets without having to open up ports to the Interwebs..

Improve this answer
1
  • While the original question was asked 5 years ago, your answer may help someone who has the same question in the future. Thanks, Colin.
    – kalyanswaroop
    Commented Jul 28, 2022 at 16:36

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.