1

My company use sensors on doors to track activity and access control on the doors for many sites throughout the UK. We need to log this activity by sending UDP packets from the sensor's receiver to the public server via a 4G router where the data will be received and access control logs will be saved.

We had a solution were the receiver was programmed to send the data to the public servers static IP address and the router was set as the default gateway, therefor when the server was not found on the network it would be sent to the router and then sent to the server. However this means that if we changed server IP address we would have to reprogram every receiver we use in the UK on site which is not good practice.

Because of this we need a solution that comes from a routing rule of sorts that sends all data from the receiver to the public IP address of the server so that we can change the routing config remotely.

Any help would be appreciated

  • 2
    Any reason you are using raw IP addresses and not hostnames that can be updated to point to the new server when it moves? – hardillb Oct 25 '19 at 13:33
  • 1
    note: UDP does not guarantee packet delivery – jsotola Oct 25 '19 at 22:45
  • @hardillb using hostnames would require data to come back to the receiver meaning we would need to open the firewall to internal traffic and we are trying to keep the traffic going only externally for simplicity and security. This is why we are using UDP as well. – Nicky McKenzie Oct 28 '19 at 10:53
  • But it doesn't make things simpler, it makes them a lot harder. What is your threat model here? – hardillb Oct 28 '19 at 10:58
  • Also what mitigation do you have against spoofed records? – hardillb Oct 28 '19 at 11:01
2

I think you are approaching the problem from the wrong direction.

DNS is the known proven solution to decoupling the IP address/physical machine a service is provided on. Trying to re-invent a solution to this problem at a network routing level is not the right way forward.

Secondly using UDP packets over the general Internet to try and deliver data that should not be lost (if it can be lost, what's the point of trying to collect it in the first place?). Also given the context it is possible that this data may be potentially sensitive in nature. Unless the content is encrypted and also contains things like timestamps then there is nothing to stop an adversary replaying or faking messages as well as spoofing UDP src addresses is trivial (see the majority of DDoS attacks).

Firewalls can be set up to only allow traffic that is initiated from with in the network and to only allow access to trusted srcs for things like DNS

I suggest you look at the following:

  1. Running a VPN on your router/gateway. This means all traffic is encrypted and will terminate inside your network.
  2. Look at getting a custom/private APN (e.g. from O2) from your Cellular network provider. Again this means that all the traffic will terminate within your network. While not encrypting the traffic it is not exposed to the Internet and you don't have to run the receiving server exposed to the world.
| improve this answer | |
  • thank you for your answer, I will try and push to not use udp and to also use a VPN as security was our next problem to tackle. Speaking of VPN's is it possible to set one up between the local network the data is coming from and a cloud server like say google cloud? – Nicky McKenzie Oct 28 '19 at 15:13

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.