Skip to content

Network Hardening

Jump to bottom
papac0rn edited this page Sep 17, 2026 · 1 revision

Network Hardening

Since MAK Grills has shut down, there's no reason for the grill to ever reach the internet. These steps lock it down so DNS rewriting is bulletproof and the grill can't talk to anything outside your LAN.

DHCP reservation

Lock the grill's IP so firewall rules and DNS settings always apply.

  1. Find your grill's MAC address (it starts with 68:27:19 for MAK WiFi controllers)
  2. In your router's DHCP settings, create a static lease:
    • MAC: 68:27:19:XX:XX:XX
    • IP: Pick a fixed address on the grill's VLAN (e.g., 192.168.10.55)
  3. Reboot the grill to pick up the reservation

Omada example

  • Settings → Wired Networks → LAN → DHCP Reservation
  • Add the grill's MAC and desired IP

Block WAN access (ACL rule)

Block the grill from reaching the internet entirely. Since the grill's DNS query goes to your router (LAN) and its POST goes to HA (LAN or cross-VLAN), a LAN→WAN deny rule doesn't affect normal operation.

Why this works

The grill only needs two things:

  1. DNS resolution — queries go to your router's IP (LAN traffic, not WAN)
  2. HTTP POST to HA — goes to your HA IP (LAN or cross-VLAN traffic, not WAN)

Neither of these touch the WAN interface, so blocking all WAN access has zero impact on the grill's functionality.

Omada ACL setup

  1. Create an IP Group for the grill:

    • Settings → Profiles → Groups → IP Group
    • Name: MakGrill
    • Add the grill's IP (e.g., 192.168.10.55/32)

  2. Create an ACL rule:

    • Settings → Firewall → ACL → LAN → WAN
    • Policy: Deny
    • Source: IP Group → MakGrill
    • Destination: Any
    • Protocol: All
    • Enable the rule

This blocks the grill from reaching any external IP while leaving all LAN communication (DNS to router, POSTs to HA) completely unaffected.

pfSense / OPNsense

Create a firewall rule on the grill's VLAN interface:

  • Action: Block
  • Interface: IoT VLAN
  • Source: Grill IP (or alias)
  • Destination: any (with "Invert match" unchecked)
  • Place it above the default allow rule for that interface

If you have a more permissive setup, you may want to create a pass rule for the grill → HA IP on port 80 first, then the block-all rule below it.

UniFi

In the UniFi controller:

  1. Settings → Profiles → Port and IP Groups
    • Create a group with the grill's IP
  2. Settings → Firewall & Security → Firewall Rules → LAN Out
    • Action: Drop
    • Source: the grill IP group
    • Destination: Any

VLAN isolation (recommended)

If you haven't already, putting IoT devices on a separate VLAN is the strongest isolation:

  1. Create an IoT VLAN (e.g., VLAN 10, subnet 192.168.10.0/24)
  2. Put the grill's WiFi SSID on that VLAN
  3. Allow the grill's IP to reach HA's IP on port 80 (inter-VLAN routing rule)
  4. Block all other cross-VLAN traffic from IoT
  5. Block WAN access for the grill (ACL rule above)

This gives you defense in depth: the grill can only talk to HA, and nothing else.

DNS hardening

Force the grill to use your router's DNS (which has the makgrillsmobile.com rewrite) and prevent it from using any external DNS servers.

Option 1: DHCP DNS setting

Set the DNS server in your DHCP scope for the grill's VLAN to the router's own IP:

  • Omada: Settings → Wired Networks → LAN → DHCP Server → DNS Server → router IP (e.g., 192.168.10.1)

The grill uses DHCP-assigned DNS, so this is usually sufficient.

Option 2: Block external DNS (belt and suspenders)

If you want to be extra sure, block DNS (port 53) to anything except your router:

Omada ACL:

  1. Create an IP Port Group: DNS with port 53 (TCP+UDP)
  2. ACL rule (LAN→WAN): Deny, Source: MakGrill, Destination: Any, Service: DNS

Since you're already blocking all WAN traffic for the grill, this is redundant but makes the intent explicit.

Summary

Layer What it does How
DHCP reservation Fixed IP for firewall rules Router DHCP settings
DNS rewrite makgrillsmobile.com → HA IP Router static DNS
WAN block No internet access ACL: LAN→WAN deny for grill IP
VLAN isolation Grill can only reach HA Separate VLAN + inter-VLAN rules
DNS hardening Force router DNS only DHCP DNS setting + optional port 53 block

With all layers in place, the grill talks to HA and nothing else. The connection is bulletproof even if the grill somehow tries to reach the original cloud servers.

Clone this wiki locally