Why IoT devices are a risk
Cameras, video doorbells, smart plugs, thermostats, robot vacuums and smart TVs are small computers connected to your network. Many ship with weak defaults, receive updates irregularly and stop receiving them altogether after a few years. Attackers scan the internet for vulnerable devices and recruit them into botnets that send spam, launch denial-of-service attacks or act as a foothold into the rest of the network.
You cannot install antivirus on a light bulb. What you can control is the network the device sits on, and DNS is one of the most effective places to do it.
How DNS filtering protects IoT
Compromised devices almost always need to contact servers on the internet: to download additional malware, to receive instructions or to send data out. With malware protection enabled, FirewallDNS refuses lookups for known command-and-control and malware distribution domains, which cuts those connections. Newly registered domain blocking adds protection against fresh infrastructure that is not yet on any list.
See what your devices are doing
The query log is often eye-opening for smart home owners. It shows every domain your devices look up, including how often they contact the manufacturer's cloud, analytics services and advertising networks.
- Spot a device that suddenly contacts unfamiliar domains
- Identify telemetry you would rather block
- Notice repeated blocked malware lookups that suggest an infection
- Understand which cloud services a device depends on before you block anything
Reducing telemetry and advertising
Smart TVs and streaming devices are among the noisiest devices on a home network. Ad and tracker blocking, combined with your own blocklist, can reduce the amount of data these devices send to advertising and analytics services. Be careful: some devices stop working properly if a telemetry or update domain is blocked, so make one change at a time and check that the device still works.
Network segmentation helps
DNS filtering works best combined with good network design. If your router supports it, put IoT devices on a separate network or VLAN from your laptops and phones. That way a compromised camera cannot easily reach your personal computers. Many routers covered in our guides, such as UniFi and MikroTik, support this well.
Keep devices updated
DNS filtering reduces the impact of a vulnerable device, but it does not fix the vulnerability. Change default passwords, apply firmware updates when they are available, disable features you do not use such as remote access or UPnP, and replace devices that no longer receive security updates. These basic steps, together with DNS filtering, address the most common IoT attacks.
IoT in small businesses
Offices have IoT too: printers, conference room displays, door access systems, security cameras and building controls. These devices often sit on the same network as staff laptops and rarely receive attention after installation. Pointing the office network at FirewallDNS covers them automatically, and the query log helps identify unknown devices that are calling home to unexpected services. For MSPs, this visibility can be the start of a useful conversation about segmentation and replacing unsupported equipment.
Know what you own
Many households and offices have more connected devices than they realise. Walk through your space and list them, then compare that list with the activity in the query log. Anything you cannot identify deserves a closer look.
Devices with hard-coded DNS
Some devices ignore the DNS server your router hands out and contact a public resolver directly. These devices will not appear in your FirewallDNS log at all. If you suspect this, block outbound DNS on port 53 to anything except FirewallDNS on your router or firewall. Devices that use encrypted DNS on port 443 are harder to control and may require blocking the specific resolver addresses they use. Check your query log afterwards to confirm the device now appears, and that it still works as expected.
Getting started
Register your network's public IP address in the dashboard, enable malware protection, phishing protection and newly registered domain blocking, and set your router's DNS to FirewallDNS. Then watch the query log for a few days to learn what is normal for your devices. Note that some devices are hard-coded to use a specific public DNS resolver; blocking outbound DNS to other servers on your router forces them to use your filtered resolver.