It’s desirable to have access to your iHost while you are away from home but it seems to me to raise security implications.
How I see it there are currently 3 ways to access iHost:
- Taliscale.
- iHost’s Pilot Features Remote Access option.
- Router Port forwarding.
With 1) You access using the Taliscale VPN Service which you have to create an account with and can see the devices linked to your account.
With 2) You can access the Log In screen and CAST with allocated urls.
With 3) You can access the Log In screen by router port forwarding a user defined service port to port 80 at the iHost’s LAN ip address. In the same way it is possible to access the Node-Red (port 1880), eWeLink Smart Home (port 8321). Also the CAST user interface can be accessed through port 5800 if iHost is running docker jlesage/firefox set so that the docker Firefox browser is permanently browsing iHost ip address xxx.xxx.xxx.xxx/cast/
Of the three, option 1) would seem the most secure. With option 2) It would appear that if any other person/ undesirable/ unauthorised body has the urls then they can gain access to the iHost Log In and CAST screens. Option 3) is the most insecure as it would be vulnerable to any ‘port sniffing’ on the WAN side of the router.
Despite being thought of as a standalone platform iHost does actually need to have access to the Internet for firmware updates and its BackUp and Restore functions even if restoring from a locally stored backup file.
So what’s the solution ? Clearly when iHost is not connected to the Internet it is not vulnerable to attack from the www. One possible and very simple solution to add an extra layer of protection is to use a cable type router dedicated to just the iHost Home Automation system which has its WAN port connected to a LAN port of the ISP Router via an Ethernet Switch. The Ethernet Switch power supply can be controlled by a smart switch/ socket as a client to a service such as eWeLink, Tapo, Tuya etc on the ISP Router and certainly not in the same LAN as iHost. Would be interested to hear other users thoughts about minimising attack from the Internet.