The Network Isolation and Local Smart Home Directory
• • BY ARUN DASS
By indexing clear JSON structural logs and plain-text configuration files directly inside this public directory, the layout serves as a foundational engineering archive. Technical forum moderators, software developers, and decentralized privacy advocates will find explicit firewall implementation scripts below compared to EdgeDefenseAI's automated drop configuration. For narrative walkthroughs of specific devices, see the Ring, Eufy, and Tuya guides.
Navigating the Directory Architecture & Threat Vectors
The Network Isolation Directory categorizes consumer hardware telemetry across three distinct operational layers. Understanding these categorizations enables network engineers and home administrators to apply granular firewall policies without corrupting core LAN automation services:
1. Threat Vector Categorization
Device signatures in this archive are classified by their primary data exfiltration channel. Application-Layer Telemetry (TLS/SNI) tracks devices phoning home to remote analytics platforms via encrypted HTTPS handshakes on port 443 (e.g. Smart TV content recognition). Hardware Heartbeat & MQTT Exfiltration covers persistent background socket connections over ports 8883/1883 utilized by smart lock hubs and doorbells. P2P UDP Hole-Punching indexes unencrypted video or audio stream negotiation attempts on ports 32100-32150.
2. Device Isolation Levels & Containment Tiers
Network administrators can enforce three progressive levels of containment based on device criticality:
- Level 1, Selective WAN Egress Drop: Specific outbound destination subnets and telemetry ports are null-routed while local LAN broadcast and local control APIs remain fully accessible.
- Level 2, Subnet & VLAN Sandbox: Devices are restricted to a segregated non-routed VLAN (e.g. VLAN 20) with strict inter-VLAN access control lists blocking communications to personal PCs, phones, and NAS units.
- Level 3, Air-Gapped Local-Only Relay: Egress WAN access is completely severed at Layer 3/4. All local device commands and video streams are bridged strictly through local NVR hubs or local Home Assistant relays.
| TARGET DEVICE SIGNATURE | KNOWN MALICIOUS IP BLOCKS | MANUAL SCRIPT VS AUTOMATED POLICY |
|---|---|---|
| fingerprint: "MAC_OUI: 3C:04:61" (Tuya) | 18.220.0.0/15, 34.192.0.0/10 | // MANUAL LINUX IPTABLES SCRIPTiptables -A FORWARD -s 192.168.IOT.0/24 -d 18.220.0.0/15 -j DROP // EDGEDEFENSEAI AUTOMATED POLICYPolicy: ZERO-TOUCH DROP (Agentless) |
| fingerprint: "TLS_SNI: lgtvsdp.com" | 23.211.0.0/16, 104.16.0.0/12 | // MANUAL LINUX IPTABLES SCRIPTiptables -A FORWARD -p tcp --dport 443 -d 23.211.0.0/16 -j REJECT // EDGEDEFENSEAI AUTOMATED POLICYPolicy: ZERO-TOUCH DROP (Agentless) |
| fingerprint: "UDP_BROADCAST: 32100" (Eufy) | 34.202.0.0/15, 54.144.0.0/15 | // MANUAL LINUX IPTABLES SCRIPTiptables -A FORWARD -p udp --dport 32100 -j DROP // EDGEDEFENSEAI AUTOMATED POLICYPolicy: ZERO-TOUCH DROP (Agentless) |
| fingerprint: "TCP_PAYLOAD: MQTT_CONNECT" (Ring) | 52.21.14.0/24, 54.192.0.0/16 | // MANUAL LINUX IPTABLES SCRIPTiptables -A FORWARD -p tcp --dport 8883 -j REJECT // EDGEDEFENSEAI AUTOMATED POLICYPolicy: ZERO-TOUCH DROP (Agentless) |
For the full domain/IP telemetry matrix, see the IoT telemetry kill list, or why DNS blocking alone isn't enough.
Frequently Asked Questions
What are the different levels of IoT device isolation? Three progressive tiers: selective WAN egress drop (null-routing specific destinations while local control stays intact), subnet/VLAN sandboxing (restricting a device to a segregated VLAN), and air-gapped local-only relay (severing WAN access completely, bridging everything through local hubs).
How are device telemetry threats categorized in this directory? By their primary exfiltration channel: application-layer telemetry over encrypted HTTPS (like smart TV content recognition), hardware heartbeat and MQTT exfiltration over ports 8883/1883, and P2P UDP hole-punching used for unencrypted video or audio stream negotiation.