I’ve got one of these transmitters and one of these receivers and I’m getting ready to attempt to make a one way bridge from one network (which isn’t on the Internet) to a machine in a different network (which is on the Internet).
The goal is to get data from my non-Internet network and post it to a website without risk of hackers being able to get into my non-Internet network devices (a half dozen IP cameras and some solar equipment which I do not want compromised but which I’d like to monitor while I’m away).
I’m thinking I will have a machine on the non-Internet network run a script and send the data one-way to a machine on the Internet connected network for processing and for sending to my website. Should be able to monitor the solar equipment and watch live camera feeds, but I won’t be able to move cameras or direct any actions.
I’m always surprised more people don’t seem interested in data diodes (and really surprised at the costs of what should be a simple device), maybe that will change as AI continues to make hacking so much easier. I’m sure network security professionals running more powerful firewalls and routers and such are able to defend networks (I wish I was that knowledgable) but I’m not sure I’d want to rely on software these days for such things. I’m hoping this provides a physical barrier for added security.
Of course I know little more than squat about networking, something I hope to cure eventually since I think any internet connection is going to only increasingly become a threat to any network that hosts it.
1 Like
They are somewhat common in industrial control applications. Not nearly as common as people in the know would like them to be, but they exist in the wild.
Genua and Opswat are two examples. The trick to data-diodes is faking the ACK in the TCP transfer.
The issue is that with rising security, productivity/convenience takes a nosedive and price skyrockets.
Even getting basic network segmentation and two-stage firewall setups past management is an uphill battle.
1 Like
If my little Lantronix one way idea works, it will then make me wonder why people spend all that money on data diodes in industrial applications.
Perhaps the reason is just use case. Maybe the diodes allow for other features I’m not thinking about. Or maybe my idea is doomed to fail for some reason or isn’t actually secure (although that seems unlikely).
I wonder the same sometimes honestly.
With few exceptions, all firewalls I know are commodity x86-hardware running some Linux or BSD with MAC’s on board so various PHYs can be slotted in depending on connection requirements.
The one exception I know is an L4-Microkernel based hellscape of bespoke hardware setup that costs high five digits per unit. I am not naming that company since I do not wish that horr on anyone else..
Clavister, Sophos, Lancom, Stormshield, etc. all seem to have the same hardware underneath.
One exception is Fortinet who cook up their own ASIC, not that that is any reason to get excited.
There is also the “cool kids”-option in Palo Alto.
My advice for any business who actually cares is to pick any two firewall brands, put one at the internet-facing side and use the other to keep internal networks walled off. Yes it sucks to configure and maintain, it sucks a lot more to be woken up on a Sunday morning because a 10 CVE was scored.
2 Likes
Firewalls allow for two way communications and such from what I understand, so I think I can see why they differ from a unidirectional data diode. I just don’t know if I can trust that they work. So complicated, seems like ripe for smart people to somehow bypass, but I don’t know what I”m talking about. I still need to ditch my dumb off the shelf router and learn to make my own and administer it and get my own firewall. I don’t trust any of these off the shelf companies with their firmware.
But if this Lantronix thing works, neither their spyware firmware or my ignorance should put devices on my walled off network at risk.
Firewalls are usually 2-way.
Datadiodes are mostly 1-way.
Securing stuff is a multi step continuous effort. Think of a castle: Moats, earth works, walls, gates, guards.
Not maintaining the walls or earth works takes away from their protection, not paying the guards, letting the moat clog up, etc.
If this is a learning exercise, great! Buckle up and enjoy the ride!
Food for thought: What is your threat scenario? You being dumb when configuring a new toy, your neighbor being weird, doing wrong-think in a totalitarian state, having an outside secret service after your invention, etc.
About that… 
1 Like
My threat scenario is anybody on the Internet messing with my solar equipment for any reason whatsoever. My understanding with the Lantronix setup is that equipment will only physically be able to send data to the Internet side (light traveling only one way through one single fiber and multiple media converters, transmit and receive) so I think it would be physically impossible for somebody on the Internet to access that equipment. But of course I don’t know what I don’t know.
They would be able to see data coming from that equipment, but I’m not too concerned about that. I am concerned about them commanding my equipment to overcharge my batteries and starting a fire though.
1 Like
I know of a device which does functions very similar as your requirements.
But it’s not fully it, I’ll just explain what it is and how it functions.
It might give you some ideas or inspiration in adapting it.
A device like this is available for fiber optic cable.
Intelligence agencies love to abuse and install it everywhere.
We call it a prism in the industry, but it’s official name is a Passive Test Access Point aka the TAP point. (You can probably guess why prism is used in open conversations)
A Passive TAP acts like a prism and is able to redirect a tiny bit of light from the main fiber in a optical receiver.
This receiver can passively record all traffic in either direction on the fiber, without interfering or even weakening the signal inside.
Oh and it’s unidirectional, as in both data channels goes toward the passive optic recorder.
It’s lacks any transmission optics as it’s main goal is to record.
I wasn’t joking about the intelligence agencies installing them everywhere btw.
But it’s legitimate use in telecom and IT is as a real time, zero latency, low interference way to record/copy and feed the data streams in air-gaped logging appliances like a intrusion detection system or secure recording appliance as immutable backup/audit single point of truth for regulatory purposes.
But it’s also used for real time analytics you want to happen outside the firewall.
This way no port mirrors or extra load is required from the firewall and it’s a few nano seconds faster as the firewall retransmitting.
Also it’s as reliable and available as the connection it’s tapped to.
And you are not required to record both ways, I called it a recording optic but it’s usually 2 or more.
So all data you send from your side can be recorded. But the other side does not go in the recorder.
It will require some software or diy script which can intrepid the network data lacking the other side of handshakes, acknowledgements and what not.
As the data itself will be fully transmitted and recorded if it’s your side.
This is a good read for more application in the industry:
https://www.datacenterdynamics.com/en/opinions/monitoring-networks-with-passive-optical-taps/
And this is more practical write up of implementations:
https://www.thefoa.org/tech/ref/install/Optical_splitter.html
2 Likes
Since that thing is just a transmitter and not a diode, it will work only with udp traffic. So camera feeds yes, http and most apis no
How about using a vpn
1 Like
My plan is to send the feeds and also a dictionary of real time values (representing solar equipment metrics) over UDP to a linux machine that will then publish it on a website. I want the physical layer of separation rather than merely software.
So you know what you are doing. What are you using to send the stream of real time values over udp? I’m curious now.
I said that’s my plan. That certainly doesn’t mean I know what I’m doing!
I’m planning on having a python script grab the solar values (as it already does) package them up into a variable (or variables) and send that variable every second or so via UDP through the one way fiber to a second linux machine that will have a python script that will grab the latest values and then publish them to a website. Then something similar for each camera stream.
I’ll probably start working on this tomorrow so we’ll see how well my plan matches with reality.
Got it up and running. One way fiber delivers a half dozen camera live feeds and some constantly updated data to a website on the Internet side. So, assuming these one way media converters and single fiber line can’t be hacked into delivering light in the opposite direction, it should be a physically walled off network sharing info into the wild Wild West of the Internet.
Of course other vulnerabilities might exist, but that fiber line to the Internet shouldn’t be one I don’t think.
I am probably missing something here, but couldn’t the same functionality be replicated with two standard (bidirectional) BASE-T/SFP(+) media converters, a normal two-fiber SFP, and then one only connects one fiber instead of the whole pair so that only half of the link is established?
Are these unidirectional media converters just to provide convenience and to prevent user errors?
1 Like
From what I understand, yes, it can be done as you suggest, but it might require a third media converter. I think you don’t get the fiber connection light unless both are plugged into the normal media converters, but there are probably so many variations of these things.
1 Like
