Locking down Matter/Thread/Zigbee? | Home Assistant | Page 1

modern canyon Jan 30, 2025, 1:19 PM

#

Hi all, I was wondering what steps one should take to lock down these protocols, and devices that use these protocols? I am used to normal VLAN and firewall things, however, I am brand new to these kinds of IoT protocols, and as we all know, the s in IoT stands for security. I would especially want guidance as to whether or not these kinds of devices can access the internet with these protocols.

atomic pasture Jan 30, 2025, 1:24 PM

#

Zigbee is fine, completely disconnected from the Internet unless you are using a manufacturer's hub and then connecting to it via cloud rather than a coordinator and z2m or zha

static bronze Jan 30, 2025, 1:56 PM

#

Thread is also entirely local

If you're using VLANs with Thread and Matter then everything IoT including Home Assistant needs to be on the same VLAN

modern canyon Jan 30, 2025, 2:00 PM

#

How would I give HA internet access then, without something like DPI

#

I’m implementing a hard internet block for IoT

#

Actually nvm

static bronze Jan 30, 2025, 2:01 PM

#

modern canyon How would I give HA internet access then, without something like DPI

Firewall rules?

modern canyon Jan 30, 2025, 2:01 PM

#

I don’t need to worry about that, since my HA container has access to an interface on the IoT vlan

modern canyon Jan 30, 2025, 2:02 PM

#

static bronze Firewall rules?

I’m getting a bit confused, do thread and matter devices have internet access?

static bronze Jan 30, 2025, 2:02 PM

#

Matter could

#

modern canyon Jan 30, 2025, 2:03 PM

#

I searched online and found some sources saying that thread devices could access the internet through a border router, which is currently my nest hub

static bronze Jan 30, 2025, 2:03 PM

#

Yes

modern canyon Jan 30, 2025, 2:03 PM

#

I don’t have an opnsense box yet so this is all planning

modern canyon Jan 30, 2025, 2:04 PM

#

static bronze

So like HTTP

static bronze Jan 30, 2025, 2:05 PM

#

Matter, yes, kinda

#

Thread, no

candid knot Jan 30, 2025, 11:30 PM

#

if you have ipv6 internet connectivity or a border router which supports nat64, thread devices can connect to the internet.

#

(they mostly shouldn't, since thread bandwidth is really limited, but it is possible)

#

I expect that many matter over wifi devices will end up including non-matter cloud features in addition to whatever they do via matter.

modern canyon Jan 31, 2025, 11:19 AM

#

good idea to use Google Nest Hub for Thread Border Router?

#

I already have it, and would rather not spend any extra money buying something else to get thread/matter support if I don't necessarily have to.

static bronze Jan 31, 2025, 11:53 AM

#

Huh?

modern canyon Jan 31, 2025, 12:07 PM

#

this is all kinda confusing

#

I just want to make sure that none of my IoT devices connected through thread, or matter, or both, can access the internet, or my main LAN

static bronze Jan 31, 2025, 12:28 PM

#

Then you don't want to use Google, or Apple, or any other commercial Thread Border Router - because those will need Internet access to work, and so can relay traffic for Thread/Matter devices

modern canyon Jan 31, 2025, 12:49 PM

#

I heard Apple’s devices are good for an offline only thread+matter setup

#

However, insanely pricey, and I don’t like apple and their proprietary garbage

#

Do you know if the home assistant matter controller allows internet access?

candid knot Jan 31, 2025, 1:12 PM

#

the matter controller has nothing to do with it. The home assistant OTBR add-on doesn't do anything to prevent internet access, and even has optional NAT64 support to enable internet access if you have an IPv4-only connection.

modern canyon Jan 31, 2025, 1:29 PM

#

hmmm

#

so what should I do regarding that

#

maybe putting the server container behind a VLAN?

#

seems like macvlan could be a good option

candid knot Jan 31, 2025, 1:37 PM

#

at the network level, matter traffic is just normal udp over ip, and a thread border router is an ipv6 router. the things to make sure are that you don't interrupt multicast/broadcast packets between the matter controller and thread border router (and between the commissioning device - e.g. phone - and thread border router) since those are needed for mDNS queries and ipv6 router announcements to work.

#Locking down Matter/Thread/Zigbee?