(Disclosure up front: I wasn’t asked to or compensated in any way by any product or company mentioned in this blog.)
I figured I’d branch out a bit and start a weekend projects blog every now and then to both share exciting things learned and also hopefully help anyone else out there looking to do similar projects. This weekend I solved a visibility issue with my home network security monitoring setup.
I have several smart devices on my network that I want to understand the behavior of better. I previously used Google Wifi to run my wireless network. While the Google WiFi setup was stable, Google requires the primary network node to not be in bridged mode.
Because of the double NAT, the switch that the primary Google Wifi point was plugged into that was mirroring traffic into my Security Onion instance only saw the WAN address of the Google Wifi point. This effectively eliminated all visibility into what was on the inside of the internal Google Wifi IP space. Within the bro logs, Security Onion captured, it was impossible to associate the Wifi based system responsible for a given log entry.
Back to The Drawing Board
A coworker recommended taking a look at Ubiquiti access points as the Ubiquiti access points can act in mesh while using upstream network services. The ability to mesh without requiring NAT allows the DHCP server to be pushed farther upstream in the network resolving the issue of the primary Google WiFi access point IP address being the IP address for all wireless devices in Security Onion.
I ended up using the following devices for the new setup:
|Ubiquiti UniFi Security Gateway||Primary network IPS & DHCP||$112.01|
|Ubiquiti UAP-AC-PRO||Primary and outstation WiFi access points||$126.98|
|Netgear GS108PEv3 Switch||Primary network switch||$84.99|
|Ubiquiti Unifi Cloud Key||UniFi Device Manager||$75.00|
|Ubiquiti UniFi Switch 8 60W||Outstation PoE source & device switch||$109.99|
Ubiquiti’s UniFi Security Gateway (USG) serves both as the edge router and an IPS device. Under the hood, the USG runs Suricata and pulls rule updates every 24 hours. While the IPS feature does significantly slow the throughput, the degraded speed is still more than enough for my home connection. As the edge device for the internal trusted network, the USG can also handle most of the functions a router would be expected to carry out like DHCP and DNS. If you aren’t using pihole internally for DNS, that’s something you should look into. I’ll cover more on pihole in a later series.
By connecting the LAN port of the USG to the Netgear GS108PEv3 switch, it’s possible to monitor all traffic transiting into and out of the network when mirroring the correct switch ports. One of the reasons I went with the Netgear switch over Ubiquiti’s line of switches was that in doing research, it appeared only to be possible to mirror a single source port to a single destination port. With the Netgear switches, it’s possible to mirror multiple source ports into a single destination port. In my case, the destination mirror port went into the sniffing interface of my security onion machine. Additionally, the power over ethernet feature of the GS108PEv3 served as a critical feature to power the Ubiquiti UAP AC Pro access points.
The primary upstream UAP AC Pro access point can mesh with other downstream access points in parts of the house where I don’t have cables run. If visibility is ever a concern in a downstream enclave, the Ubiquiti switch can be swapped with the Netgear switch and a Security Onion sensor can send data to the Security Onion master server. Security Onion sensors on the outstation enclaves enable visibility into device-to-device connections that might not transit back to the main network segment.
Analyzing Collected Data
Collecting the data is only part of monitoring. While it’s now possible to see actual device IP addresses and not have the issues with the double NAT, there’s still work to be done to automate parts of the analysis. It’s pretty impressive that Ubiquiti’s security gateways now ship with Suricata as the IPS feature reduces overall maintenance time. The ability to manage the ruleset and add custom rules will be another significant win when implemented. If you go with a similar setup, definitely ensure you check both the security gateway and Security Onion logs. It’s also possible to use syslog to ship the IPS logs into Security Onion. Further analysis automation is on the future weekend project list.
Obligatory Photo & Parting Thoughts
Hopefully, this post was helpful for someone thinking about getting better visibility of devices on their home network. I’d love to hear about similar projects you’ve worked on or how you’ve automated or made the analysis of your home network monitoring data easier. Feel free to reach out to me on Twitter or via the form below.
Feature image taken by Andres Urena.