A lot of devices require internet for st least one time to set them up.
How can I set them up such that as soon as I’ve programmed them/set their schedule, I can deny them access and prevent them from being chatty back with the mothership?
Many commercial routers have a parental controls section, you can block access to the internet per device.
If your IoT devices are TPLink Kasa devices there is a github project that lets you connect to them first and change them from remote server to local server and configure them for your wireless LAN. It only works on certain firmware as the company has been updating the hardware and firmware to stop this.
Hopefully someone else can chime in with the specifics/confirmation because I just think I know broadly, but setting up a pihole (or sim) should let you do what you want. Essentially, most of the time the device itself isn’t going to let you block its access, so you go further up the chain to your router, and have all data coming into/going out of your network funneled through a raspberry pi. Installing the right software (which I think is pihole) should let you block unauthorized communications outside your local network. Hopefully this is a pointer in the right direction for you
After setup I blacklist the IP on the firewall to not allow internet traffic.
Firewall on what? The ISP router?
If you have access to it you can. But I have my own router I can control internet access through.
Set up a dedicated Wi-Fi SSID for your iot devices, only. Allow those devices to connect to a non-internet routed VLAN.
Don’t blacklist IP addresses, or Mac addresses, you’re trusting the device not to change itself to get around your blacklist. Keep them completely segmented from your normal network. That’s the best way
If they must have internet, you can use a white list while you’re setting them up, and then remove the waitlist
Lots of good suggestions.
The simplest answer assumes you have a router with a firewall that you can configure.
The basic idea is a deny rule targeting the ‘source’ IP address from reaching the ‘destination’ ip addresses.
There are various ways to do this, the best way will be very precise. Some folks have said separate VLAN, very good practice but not required. Some folks suggest pihole, thats really hit or miss unless you know your device relies explicitly on DNS and you also know how to manage that.
It will be easies for you to learn the basic traffic policy before proceeding to other more advanced suggestions, but you will have to probably at least learn that bit of network security to attempt this task. Low difficulty in the grand scheme of things networky.
Look, do i need to buy some seperate doohickey or can this sort of business be usually dealt wirh it theu rhe routers portal wheee you type in your IP address in the browser or something?
Yeah most routers will allow you to configure the traffic policy through their admin console. Some of the ISPs equipment won’t, if that’s all you’re using.
I wonder if i can use my phone hotspot thing, would vastly prefer that quick bag and shag
Yeah, maybe. Could be a work around for some devices that will support it. I don’t see why not.