POE doorbell security

Hardware
1

Hi

Not directly Home Assistant related yet but this is the first step.

I am looking to install a Reolink POE doorbell and having very little network knowledge was unsure if there is a security risk having an ethernet cable running into the back of the doorbell. If someone were to remove the doorbell they would have access to the ethernet cable, could they then access devices and data on my network? Should there be any security steps I should take when installing security via ethernet outside?

For further information I have not decided yet if i’m using an nvr or a nas to record the video, I know i want it to be local and avoid the cloud, and I will certainly be running it through Home Assistant and want to receive the usual notifications and possibly run a few automations based on doorbell ring or presence detection.

Any network security help would be appreciated.

Thanks

Dan

2

I mean it’s possible but how probable is it in the area in which you live?

e.g. Around here it is exceedingly more likely that a brick will be used to gain access to the house.

Also keep in mind that someone who wants to gain access that way would be in plain view of the camera before they could get access.

If it is a likely scenario then you can segment your network with VLANs.

2 Likes
3

Ah yes I appreciate it’s unlikely, I just wasn’t sure of best practice when setting up

4

Best practice would be not expose your network to the “outside” without taking extra measurements like encryption and authentication. While this is the “default” for WPAx WIFI’s the ordinary ethernet is missing this. :unlock:

Ether only provide power (the P in PoE) over the cable and use wifi for coms or implement at least some authentication if you prefer the wires. You also wanna make sure that the ethernet is not (too) easy accessible - maybe by using some security screws or so :nut_and_bolt:

1 Like
5

I just find video doorbells only require a paperclip to remove from the mount so the screws are largely irrelevant. I’m probably being overly cautious as someone plugging in a laptop outside my house to the ethernet would be quite obvious

6

Thank you for coming back so quickly on this.

I was going to avoid WiFi because whilst I have a strong WIFI connection I’m certain some delivery companies have used WiFi blockers in the past as some events doesn’t get recorded correctly.

7

Some doorbells have tamper switch. Connect that to your alarm system, or just to a powefull siren. Anyone who will unscrew doorbell will trigger it.

1 Like
8

Ok I’ll check if Reolink does before I buy it

9

I have a Unifi Poe switch, so I have created a mac address filter on the port that goes to the camera. That way the link only works with that one mac address… if someone was to plug in another device it would not work.

1 Like
10

Sounds ideal, I’ll look into this as I’m not that network savvy so will need to find a tutorial on setting that up

11

Well, that is some protection, but bear in mind that mac of network card can be easily changed in laptop…
Regarding tamper switch: if unit doesn’t have it you can add any microswitch, it will also do it’s job.

1 Like
12

Check out

about 3 minutes in to the video, gives pros and cons of this approach

13

Thank you, that made it really clear. I was looking at the Netgear GS308EP managed poe switch on Amazon which looks like it’ll do just that

14

Can you share how it went? I am in the same situation, also have a Netgear POE switch, and wondering how to go about securing the external LAN connector.

15

There are many guides out there and here is one example of how to set up a secure network:

In most setups VLAN 1 is the default untagged route so you setup say VLAN 2 for the internal network, 3 for IoT devices and 4 for guest devices and for each VLAN you setup a dedicated subnet IP i.e 192.168.1.1/24 for VLAN 1, 192.168.2.1/24 for VLAN 2 etc

Then at the firewall level you can designate to allow the IoT VLAN to access only your home assistant host on the internal network and no other deivces.

16

As well as what Robert has suggested you could lock down that ethernet port to only allow data from the MAC address of the doorbell.

17

Don’t tell anyone spoofing a MAC is one of the simplest thing to do :shushing_face:

It’s often even supported by an OS (without any additional tools) :point_down:

image

Beside MAC randomization is an common privacy measurement these days… :ninja:

18

Sure, but they would need to know the MAC that is being allowed so would need to get that from the doorbell first. It’s all time spent standing at your door when a brick through the window is an easier option.

19

This is why you do layered security, if you can make them waste time then its more time for the cops to get them and its more evidence of property damage if you can get it for cases against them.

Then again there are people that just vandalize and run.

20

That’s like 2 seconds with the correct tool after the doorbell was ripped off :hammer_and_wrench:

In anyway suggesting half backed and easy to circumvent solutions while proper (secure) ways do exist (like VLAN) is not that smart of a move. Many people out there still believe that locking network access to certain MACs is a security feature as people sadly not getting tired repeating this false claims :person_facepalming:

It’s even funnier when people do this for WIFI as the MACs are usually broadcast openly :joy: