How does URL Remote Access method work?

Question

Unfortunately, I still have no answer to my question: Techniques of remote access to non IP IoT devices.

Even though, I made some researches and I found two remote access techniques that do not require a port forwarding on the home Internet gateway.

1) Cloud Broker: (from the answer of @ChrisStratton to the question: Contacting Arduino through internet without port forward) (figure).

2) Cloud Broker with direct URL: (from Domotz) This is similar to cloud broker method, except that that URL method provides the remote user with a direct access link, rather than trusting the broker to dispatch his messages to the IoT device (figure).

My question is about the second method (Direct URL): When the remote user type the URL on his remote web/mobile App, how does the traffic bypass through the NAT of the home gateway? I am not sure, but this method does not suppose to use port forwarding.

Answer 1

Taking your two diagrams as alternatives:

Case 1:

All nodes are responsible for opening the connection to a remote server. Once the connection is open (given the right protocol), the cloud server is able to relay commands to the remote endpoint device (with some protocol translation/abstraction possible at the hub). If the server is removed, connectivity fails.

Case 2:

The endpoint device needs to register it's location with the remote server (allowing for dynamic public IP at the home gateway), and needs to configure the gateway for port forwarding. Now the remote user can discover the public IP/Port for the endpoint from the cloud, and perform direct accesses.

So your supposition is inaccurate, and case 2 requires cooperation from the home gateway.

My feeling is that case 1 is more secure, as it doesn't allow inbound IP connections to be set up to the hub, and any attack needs to impersonate the cloud, yet still can only use the protocol provided by the hub. Case 1 still provides a route for an attacker to replace the hub firmware, at which point they have open access to your network.

Answer 2

If you are still regarding the security, then yes - any device which is connected to the Internet or home LAN with NAT gateway is affected. Especially in IoT world, when vendors releasing these devices like from machine gun and thus often need to upgrade them remotely. And upgrade mean - they (or somebody) can install there anything and you will never know.

So basically all your IoT devices (sometimes very easy) can be controlled by malicious 3rd party software. So the choice is up to you - either you trust them or not +)