# A Secure Internet of Things Smart Home Network: Design and Configuration
## 4 Demonstration  
To demonstrate the operation of the proposed design and configuration, we further extend the given network to include the external network with IoT clients and an external web server. The overall design is depicted in Figure 7. Two authorized IoT clients (laptop PC, and a smartphone device), one unauthorized host, and one external web server are located on external network. All hosts on the external network have IP addresses assigned with static or dynamic allocation method depending on the availability of DHCP service on their given network. The routers on the core Internet are running the OSPF routing protocol and interconnected through a serial connection. At first, we show that the NAT/PAT, and ACL configuration defined in the previous section works as we intended and meeting our goals. To show how the hosts on the inside-subnet network connect to the external network, we let the home PC on the inside-subnet send dummy packets to the external web server (120.120.120.20) with a ping command. Then the home PC will access the web server by sending a HTTP request then check if it gets a HTTP response from the web server. The front page of the web server is displayed on its browser. As shown in Figure 8, this process is successfully done. For the first ping packet to the web server 120.120.120.20, a timeout occurs because the Address Resolution Protocol (ARP) table was not constructed on the underlying router of the web server at the initial phase. Once the ARP table is created, all the ping packets will then successfully echo back to the home PC. A similar process is performed from the IoT server to the external web server to check accessibility to the external network from the IoT-subnet. In our ACL configuration on the IoT-subnet interface, we allow the IoT server can access to the DNS server on the inside-subnet. To check the accessibility to the DNS server, the IoT server now connects to the external web server with the domain name (www.jinsukbaek.com (accessed on 27 May 2021), notes: this website exists only in simulation. ) instead of IP address (120.120.120.20). As we can see in Figure 9, the network connection works as we intended. Figure 7: The overall network structure for our experiment. We also require the connection to be initiated from the external network to the IoT-subnet, i.e., IoT client (120.120.120.10) on the external network successfully connects to IoT server. Since we configure NAT/PAT on the home gateway, the inbound packets to the IoT server should be destined to the translated public IP address 20.20.20.1 instead of its original private IP address 192.168.1.2. Figure 10 shows the screenshot of the corresponding process. Of course, hosts in the external network cannot access any hosts on the inside-subnet due to our ACL configuration on the home gateway. Figure 8: Access to the external network from host on the inside-subnet. Figure 9: Access to external network from host on the IoT-subnet. We now consider the case when the IoT server acts as a HTTP server for IoT service. As a simple demonstration scenario, we consider the autonomous window open system depending on the current temperature. To implement this, we require the IoT device, in this case the thermostat, to send its sensed temperature information to the IoT server. The IoT server continuously monitors the temperature data received. When the temperature value is equal or greater than 25 \"C, the server sends the \"open window\" command to another IoT device, in this case, window which will open the window. The corresponding setup is shown in Figure 11.  
The authorized IoT client can access the IoT server and monitor the status of the IoT devices as shown in Figure 12. We can see the window is closed since the current temperature is 0 \"C. If we artificially increase the temperature up to 25 \"C, we could see the window opens. Figure 11: A demonstration on setting condition to control a window-opening system at the IoT server. Figure 10: Access from the external network to the IoT server.