Network Firewall Requirements for Segregated IoT Network

The official guidance:

Sonos system requirements

General requirements

• High speed wired internet connection such as cable, fiber, or DSL
• WiFi router
• Sonos app and all Sonos products are on the same subnet

Whilst some have had success operating between subnets it simply isn’t a supported configuration.

OK… But that is basically saying that Sonos is not concerned about their clients data security and privacy or any IoT device security flaws that could potentially be installed on a network?

As Sonos is an Apple partner I am very surprised that that they recommend that all IoT HomeKit supported devices including the Sonos Home Theater should be on the same subnet as clients private data networks. If you think about all the privacy laws including CCPA, GDPR and ISO27001 and the security vulnerabilities seen in numerous IoT devices, I think it is very strange that Sonos doesn’t consider their clients data privacy and security a priority.

It wouldn’t be difficult for Sonos to provide a detailed set of guidance to assist clients with detailed segregated network setup.

If anyone who has achieved this setup on a Ubiquiti network recently I would really appreciate any input?
 

Sonos relies on UPnP, and in particular SSDP for the controllers to locate devices. This assumes a flat subnet, as is typically the case in most domestic settings. 

The cloud-based control path, as used by the voice assistants and some direct ‘casting’ from native streaming apps, can however work between subnets. 

That would imply official support, which as I say is lacking. I dare say that Sonos technical support have quite enough on their hands dealing with users’ ‘simple’ network problems to want to deal with such complex setups. 

That said, there are various threads here detailing the forwarding rules that some users have found to work between subnets.

I look at it differently, anybody poking holes in their firewall between LANs is not concerned about security.

I would never consider giving my IOT LAN access to my other local networks! Sonos, my SMB v1 music NAS and my controllers all reside on the same subnet and have no access to my other stuff.

Seriously, if you are going to poke a bunch of holes in your inter-LAN protection why even bother using a different LAN for the IOT stuff? I thought the whole idea was to keep the iffy stuff away from the important stuff.

@Stanley_4 I see you argument but that just doesn’t work with an AppleTV as a Homekit hub. Apple has specifically designed the AppleTV to be the main hub in their Homekit IoT SMART Home setup. 

Sonos has partnered with Apple and Sonos delivers several Home Theater products which logically should be used together with the AppleTV. I am sure we can all agree on this so far… :) 

This is where things get tricky….

So you have an AppleTV that should work with a Home Theater Setup especially from a company partnered with Apple, such as the Sonos ARC, Beam, PlayBar etc

BUT…

You also have an AppleTV as your main Homekit hub for all “Apple Home” IoT devices…

IoT devices a notoriously unsecure but you are using the AppleTV to control these devices.

So you put the AppleTV in a segregated IoT subnet with all the other IoT devices… That definitely makes sense…

Now you have a Sonos Home Theater setup… Where do you put that?

Considering it also has Alexa and Google Assistant plus all the above I would say it makes sense to put it on the IoT subnet…

I would say it is very logical to put the Sonos on the IoT network in this scenario, together with all IoT devices… Not such a strange scenario if you use an Apple Homekit as your IoT SMART hub.

Not to mention splitting network loads from 4K TV signals and other multi media services that can impact your main LAN containing your priority clients.

It makes sense because of the services offered by the devices, privacy, security and network loads as far as I can see and funnily enough I am not the only one thinking along these tracks.

Anyway thanks for your input but what I was looking for was anyone who has successfully implemented this recently, because sonos obviously doesn’t plan to support such a setup which I don’t understand based on the above. There are a lot of articles on the net but most of them a quite old and don’t work anymore...

Good luck, I spent a lot of time looking at the issue for my mostly non-Apple setup and the simple solution for me was just putting my Sonos, SMBv1 NAS, tablets and phones on the IOT LAN.

If you do lock things down well I’d agree that it won’t be that insecure. I still wouldn’t do it though.

What many do is just keep opening things up until Sonos works, that is usually not good.