1

Got some IP data-loggers (that measure temp., humidity, light-level) sitting inside bunch of warehouses / stores with each warehouse / store being a different customer from my standpoint. These data-loggers provide information over clear-channel HTTP (Basic-Authentication). Also, my server sends out commands (again over HTTP) to data-logger, to reboot, do firmware upgrade etc. The way I have it rigged up today is those are assigned IP-address in the private-192.168.X.X range, each with a unique TCP port#, and the ADSL-Router does port-mapping to make those visible to my server which polls those data-loggers (at each site) every 5 minutes, to download base64 encoded data. The data-loggers cannot be software upgraded (I've no control over them), yet, I would somehow secure the flow of information from the ADSL-router to my server. Today the number of such customers is small and manageable, but I would like to scale this out, thus looking for a solution that scales well, provides me with necessary security, and is cost-effective.

My expectations of 'security' here are:- - No eavsdropping / snooping - No man-in-the-middle - No tampering - No spoofing It is safe to assume that my main interest is in ensuring that the connectivity between my server and the ADSL-router is secure. Inside the warehouse, I am not worried as much.

On the ADSL router, I have the firewall up, with holes poked (obviously) for the specific ports corresponding to the data-loggers and the mapping created. Could VPN be an answer ? What are some of the alternatives, gotchas, pit-falls etc.

Appreciate explanation, pointers, suggestions etc.

TIA, ~i++

3 Answers 3

0

I face a similar problem so I'll be watching the answers carefully too!

I take it the data-loggers are proprietary devices and not customisable servers? If the latter, have you considered sticking with your existing setup and encrypting the data you send, that might be a good first step without the additional complexity of the https / VPN etc to get started

Can your remote routers be configured to only accept requests from certain IP address ranges of your known central server(s?) That should give additional reassurance from "casual" hackers

One thing that is troubling me in my setup is that to scale, at some point you will need multiple VPN landing pads and the remote clients might need to be configured to talk to specific ones, unless some multihost/dns trickery (?beyond me) can be setup. However VPN does seem a reasonable solution if your remote routers are able to regularly deal with all the interruptions that seem to go on at remote sites.

The other thing you need to weight up is if this additional infrastructure (cost / time / support) is worth it compared to inherent value of the data to you or your businesses' clients.

Sorry I don't have a great deal more to add, as I say I am grappling with this too.

1
  • these are certainly proprietary devices. do not know VPN mechanics well, but I do foresee scaling such infrastructure to be a serious challenge. Not sure if this requires the 'SSL acceleration' boards etc. That would completely ruin my plan of eventually moving to AWS. As for the inherent value, well, this is rapidly gaining a pull vector. Not sure how happy the customers may be when I propose passing on the cost (which could be significant) of this value-add, so evaluating all options.
    – icarus74
    Feb 9, 2011 at 14:01
0

If you have no control over the devices themselves, you'll need to rely on a secure transport, like a site-to-site IPSec tunnel.

The good news is that it's a common standard and interoperability between vendors is very good, so any decent firewall will have IPSec support.

The bad news is that you'll need to deploy IPSec capable firewalls to all these warehouses, which may/may not be under your control (you didn't specify whether the network equipment belongs to you or not).

5
  • thanks for the answer. Could you recommend any specific router ? I can't make the solution very expensive, but changing the ADSL router is a viable option, if there are ADSL routers capable of IPSec or other secure transport means.
    – icarus74
    Feb 9, 2011 at 17:22
  • See serverfault.com/questions/24813/… for recommendations on ADSL+VPN Feb 9, 2011 at 17:25
  • I really like pfSense + ALIX, and for your location (the "spoke" for your tunnels), I'd go with pfSense + Hamakua hardware. See www.netgate.com for more information.
    – gravyface
    Feb 9, 2011 at 18:59
  • thanks for the suggestion. Definitely looks like something doable, but rather than assembling together a router+fp from kit, wondering as to whether I could take a related approach by burning one of the openWRG / similar firware on the existing ADSL router. Currently, the ADSL routers are used for my dataloggers, and a simple RFID access-control unit which I am pretty familiar with. The routers are all out of Warranty anyway, and I provide support for those as well, so in a way, doable. My virtual vote up for you, don't have enough reps to do a real one.
    – icarus74
    Feb 10, 2011 at 7:51
  • @ernest-mueller, excellent suggestion regarding ADSL+VPN. Looks like something very doable. Responded to @gravyface before reading the link you provided, but it reaffirmed my faith in the approach.
    – icarus74
    Feb 10, 2011 at 7:53
0

Yeah, that's going to be touchy to do low cost. Basically your options are:

  1. Get the device to do SSL or otherwise be secure (some small embedded targets we have here can't do SSL but can do SRP + manunal encryption OK). Are you sure it's not something that can be "turned on" on the devices?

  2. Get the router to VPN tunnel - via whatever, ipsec or ssl or even pptp. I assume you've looked at what options it provides there, because all the next options involve "drop a box there so you can gateway."

  3. Drop your own bastion host - ideally some little cheap Linux device - and then ipsec (openswan) or ssl (openvpn) or pptp (pptpd) VPN from there. (Or something more ghetto like stunnel).

You mentioned AWS; I tried for a while to get OpenSwan working there and was thwarted; OpenSSL would probably be your best bet. Or pptp seems to work, I haven't done it. Amazon does supply a VPN product (VPC) but I'm not sure if it would fit your needs. There's a better commercial product, VPNCubed. Neither of these solve the "endpoint problem" though, unless your ASDL router can do vpn and is compatible.

Unless you are sampling room temperature at 10 Hz+ (which would be psychotic) I don't think you need to worry about the SSL overhead. Depends on the raw number of endpoints you have, but assuming it's only in the hundreds I wouldn't expect scaling problems (and if there are, ideally running on AWS, scaling is easy and hopefully an additional $72/month is a drop in the bucket for what you're charging these guys..)

Posting what router and what the collector devices are might help folks give you more specific help...

1
  • @ernest-mueller Thanks for your answer. I don't hv enough reputations for a vote-up, so plz consider this as a ^^vote up^^. Now coming to the questions. (1) Device modification isn't in my hand, else that wd have been my first choice for sure. (2) The current router doesn't seem to have any VPN capability (I double checked). These are Netgear, D-Link and UTStarcom ADSL routers. The dataloggers are Taiwanese OEM devices, directly imported. (3) Bastion host isn't an option, as I am already struggling with backup power/space etc. I guess changing router/fwall is the only option.
    – icarus74
    Feb 10, 2011 at 4:30

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .