Hacker News Reader

My unifi controller runs in a VM, The APs have no access to anything but that VM. Wondering if I should limit outgoing traffic from my controller.

View on HN

I believe the controller can be configured to be accessible via the cloud UI, but it isn't the default. At least thats the behaviour when configured with a local user.

Absolutely, but I do wonder if I should belt and braces it. Just because it shouldn't contact a cloud doesn't mean it doesn't.

If you have an easy way to do so, you should.

Possibly even proxy the traffic via something able to do SSL strip/re-encrypt and monitor that traffic with an IDS.

I always make an assumption that people writing nefarious communication will check SSL certificates and thus MITMing it would only work if I can load a root certificate (which typically is only doable on proper devices like phones and laptops, and I don't like the extra risk of having a wide open root that I've generated and have to keep secure on my devices as I don't trust myself enough)

However speaking to some people at work who have had experience in the past, seems most malware (and that includes IOT devices) doesn't bother validating certificates or things like ESNI and (validated) DOH, so there's a lot you can find out without breaking TLS, due to the lazineess/incompetence of the malware writers.

Reply on news.ycombinator.com