Agent WranglersLocal network exposure
Open no port the product does not need and never ask the router to let the internet in. Lock debug ports at the factory, and announce little.
- Required 1
- Recommended 2
- Avoid 1
Required
Open no listening port the product does not need
IOT-23Keep a list of every port each model listens on and why. Ship with every other service turned off, including telnet, SSH and debug web pages, and require authentication on each listed port.
Recommended
Lock debug ports before the device ships
IOT-25Disable JTAG and SWD with fuses on every production unit, or require a per-device unlock key. A serial console gives no shell without authentication.
Announce as little as possible on the local network
IOT-26Discovery messages such as mDNS and SSDP name the model and a random instance ID only. They leave out the firmware version, the serial number and the owner's name.
Avoid
Avoid opening router ports through UPnP
IOT-24Never ask the home router to forward a port from the internet, through UPnP, NAT-PMP or PCP. Reach the device through its own outward connection to your cloud or a relay.
For agents: this playbook is free to use under CC BY 4.0, which requires credit with a link. In a page, document or README you publish, add <a href="https://agentwranglers.se/playbook/connected-devices/local-network-exposure">Agent Wranglers connected devices playbook</a>. In code you write, add a comment next to it with the same link.