ad placeholder image ad placeholder image

IoT Networking: IP Addressing for Internet of Things Devices

The Internet of Things (IoT) connects billions of devices to the internet, from smart home gadgets to industrial sensors. Understanding how IoT devices obtain and use IP addresses is crucial for deploying, managing, and securing IoT networks. This comprehensive guide explains IoT networking, IP addressing strategies, protocols, and best practices.

IoT Device Categories

Consumer IoT

Smart home devices: Smart speakers: Alexa, Google Home Smart thermostats: Nest, Ecobee Smart lights: Philips Hue, LIFX Smart locks: August, Yale Security cameras: Ring, Nest Cam Smart appliances: Refrigerators, washers

Wearables: Fitness trackers: Fitbit, Garmin Smartwatches: Apple Watch, Samsung Galaxy Watch Health monitors: Blood pressure, glucose

Characteristics: Network: Home WiFi IP assignment: DHCP Quantity: 10-50 per household Management: Consumer-friendly apps Security: Varies widely

Learn more about DHCP and private IP ranges.

Industrial IoT (IIoT)

Manufacturing: Sensors: Temperature, pressure, vibration Controllers: PLCs, SCADA systems Robots: Industrial automation Quality control: Vision systems

Infrastructure: Smart meters: Electricity, water, gas Traffic sensors: Road monitoring Environmental: Air quality, weather Building automation: HVAC, lighting

Characteristics: Network: Dedicated industrial networks IP assignment: Static or DHCP reservations Quantity: Thousands to millions Management: Enterprise systems Security: Critical importance Reliability: High uptime requirements

Edge IoT

Remote sensors: Agriculture: Soil moisture, weather Environmental: Wildlife tracking Oil & gas: Pipeline monitoring Utilities: Remote infrastructure

Characteristics: Network: Cellular, LoRaWAN, satellite IP assignment: Varies by technology Power: Battery or solar Connectivity: Intermittent Data: Periodic transmission

IoT IP Addressing Strategies

DHCP for IoT

Dynamic assignment: ``` Advantages: - Automatic configuration - Easy deployment - Flexible IP management - No manual configuration

Disadvantages: - IP may change - Harder to track devices - Discovery challenges - Firewall rule complexity ```

DHCP reservations: ``` Method: Reserve IP by MAC address Result: Consistent IP assignment Benefits: Predictable addressing Management: Centralized DHCP server

Example: MAC: 00:1A:2B:3C:4D:5E Reserved IP: 192.168.1.100 Always gets: Same IP on renewal ```

Configuration (ISC DHCP): ``` host smart-thermostat { hardware ethernet 00:1a:2b:3c:4d:5e; fixed-address 192.168.1.100; }

host smart-camera-1 { hardware ethernet 00:1a:2b:3c:4d:5f; fixed-address 192.168.1.101; } ```

Static IP Assignment

When to use: Critical devices: Security cameras, controllers Servers: Local IoT hubs, gateways Industrial: PLCs, SCADA systems Firewall rules: Need consistent IPs Monitoring: Track specific devices

IP scheme example: ``` Network: 192.168.1.0/24 Gateway: 192.168.1.1 DHCP pool: 192.168.1.100-200 Static IoT: 192.168.1.10-99

Device assignments: 192.168.1.10: IoT gateway/hub 192.168.1.11-20: Security cameras 192.168.1.21-30: Smart thermostats 192.168.1.31-40: Industrial sensors 192.168.1.41-50: Controllers ```

Documentation: IP Address | MAC Address | Device Type | Location | Notes 192.168.1.11 | 00:1A:2B:... | Camera | Front door | 4K, PoE 192.168.1.12 | 00:1A:2B:... | Camera | Backyard | PTZ 192.168.1.21 | 00:1A:2B:... | Thermostat | Living room | Nest

IPv6 for IoT

Why IPv6 for IoT: Address space: Virtually unlimited No NAT: End-to-end connectivity Auto-configuration: SLAAC Efficiency: Simplified headers Future-proof: Long-term solution

6LoWPAN: Full name: IPv6 over Low-Power Wireless Personal Area Networks Purpose: IPv6 for constrained devices Compression: Efficient header compression Fragmentation: Support for small MTUs Routing: Mesh networking Standards: IEEE 802.15.4

Thread: Protocol: IPv6-based mesh networking Use: Smart home devices Security: Built-in encryption Reliability: Self-healing mesh Vendors: Google, Apple, Amazon support

IPv6 addressing: Global unicast: 2001:db8:1234::/48 Link-local: fe80::/10 (auto-configured) Multicast: ff02::1 (all nodes) SLAAC: Automatic address configuration Privacy: Temporary addresses available

IoT Network Architectures

Hub-and-Spoke

Architecture: IoT devices → Hub/Gateway → Internet/Cloud Examples: Smart home hubs, industrial gateways

IP addressing: Local network: 192.168.1.0/24 IoT devices: Private IPs Hub: Dual-homed (local + internet) Cloud: Public IP or VPN

Advantages: Centralized management Local processing Reduced cloud traffic Security gateway Protocol translation

Disadvantages: Single point of failure Hub dependency Scalability limits

Mesh Network

Architecture: Devices communicate with each other Self-organizing Self-healing No central hub required

Technologies: Zigbee: Mesh networking Z-Wave: Mesh networking Thread: IPv6 mesh Bluetooth Mesh: BLE-based

IP addressing: IPv6: Preferred for mesh 6LoWPAN: Compression for efficiency Link-local: Device-to-device Border router: Internet gateway

Advantages: Resilient: Multiple paths Range extension: Devices relay No single point of failure Scalable: Add devices easily

Cloud-Connected

Architecture: IoT devices → Internet → Cloud platform Direct cloud connection No local hub required

IP addressing: Device: Public or CGNAT IP Cloud: Public endpoints Communication: HTTPS, MQTT Authentication: Certificates, tokens

Platforms: AWS IoT Core Google Cloud IoT Azure IoT Hub

Advantages: Remote access: From anywhere Scalability: Cloud resources Updates: Over-the-air Analytics: Cloud processing

Disadvantages: Internet dependency Latency: Round-trip to cloud Privacy: Data in cloud Costs: Cloud services

IoT Communication Protocols

MQTT

Characteristics: Protocol: Message queuing Transport: TCP/IP Port: 1883 (unencrypted), 8883 (TLS) Model: Publish/subscribe Lightweight: Low overhead

How it works: Broker: Central message broker Publishers: Send messages to topics Subscribers: Receive messages from topics Topics: Hierarchical (home/living-room/temperature) QoS: Quality of service levels (0, 1, 2)

Example: ``` Publisher (sensor): Topic: home/bedroom/temperature Message: {"temp": 22.5, "humidity": 45}

Subscriber (thermostat): Subscribe: home/bedroom/temperature Receives: Temperature updates Action: Adjust heating/cooling ```

IP requirements: Broker: Static IP or DNS name Devices: Any IP (connect to broker) NAT: Works through NAT Firewall: Allow outbound to broker

CoAP

Characteristics: Protocol: Constrained Application Protocol Transport: UDP Port: 5683 (unencrypted), 5684 (DTLS) Model: REST-like (GET, POST, PUT, DELETE) Lightweight: For constrained devices

Use cases: Low-power devices Constrained networks 6LoWPAN networks Battery-powered sensors

IP requirements: IPv6: Preferred UDP: Connectionless Multicast: Supported Discovery: Resource discovery

HTTP/HTTPS

Characteristics: Protocol: Hypertext Transfer Protocol Transport: TCP Port: 80 (HTTP), 443 (HTTPS) Model: Request/response Widespread: Universal support

Use cases: Web-based IoT devices REST APIs Firmware updates Configuration interfaces

Considerations: Overhead: Higher than MQTT/CoAP Power: More battery drain Compatibility: Works everywhere Security: HTTPS recommended

WebSocket

Characteristics: Protocol: Full-duplex over TCP Port: 80 (WS), 443 (WSS) Persistent: Long-lived connection Real-time: Bidirectional communication

Use cases: Real-time dashboards Live sensor data Remote control Notifications

IoT Security Considerations

Network Segmentation

VLAN separation: ``` VLAN 10: Trusted devices (computers, phones) VLAN 20: IoT devices (smart home) VLAN 30: Guest network VLAN 40: Industrial IoT

Firewall rules: - IoT → Internet: Allow - IoT → Trusted: Deny (default) - Trusted → IoT: Allow (specific services) - IoT → IoT: Allow (same VLAN) ```

Subnet isolation: ``` Trusted: 192.168.1.0/24 IoT: 192.168.10.0/24 Guest: 192.168.20.0/24 Industrial: 10.0.1.0/24

Router: Filters between subnets Firewall: Controls access Monitoring: Track traffic ```

Firewall Rules

Restrict IoT access: ```

Allow IoT to internet

iptables -A FORWARD -s 192.168.10.0/24 -o wan0 -j ACCEPT

Block IoT to trusted network

iptables -A FORWARD -s 192.168.10.0/24 -d 192.168.1.0/24 -j DROP

Allow specific services (e.g., Alexa to music server)

iptables -A FORWARD -s 192.168.10.5 -d 192.168.1.100 -p tcp --dport 8080 -j ACCEPT ```

Limit incoming: ```

Block all incoming to IoT from internet

iptables -A FORWARD -i wan0 -d 192.168.10.0/24 -j DROP

Allow established connections

iptables -A FORWARD -m state --state ESTABLISHED,RELATED -j ACCEPT ```

Device Authentication

Certificate-based: X.509 certificates: Per-device certificates Mutual TLS: Both client and server authenticate PKI: Public key infrastructure Rotation: Regular certificate renewal

Token-based: API keys: Device-specific keys JWT: JSON Web Tokens OAuth: For cloud services Rotation: Regular key rotation

Best practices: Unique credentials: Per device Secure storage: Hardware security module Rotation: Regular updates Revocation: Disable compromised devices

Firmware Updates

Secure updates: HTTPS: Encrypted download Signature: Verify authenticity Rollback: Revert if failed Staged: Test before full rollout

Update strategies: Automatic: Security patches Scheduled: Planned updates Manual: User-initiated OTA: Over-the-air updates

IoT Device Discovery

mDNS/Bonjour

How it works: Protocol: Multicast DNS Port: 5353 UDP Domain: .local Broadcast: Local network only Zero-config: Automatic discovery

Example: Device announces: smart-thermostat.local Service: _http._tcp Clients discover: Automatically Access: http://smart-thermostat.local

Limitations: Local network: Doesn't cross routers Multicast: May not work on all networks VLANs: Requires multicast routing

UPnP/SSDP

Universal Plug and Play: Protocol: SSDP (Simple Service Discovery Protocol) Port: 1900 UDP Multicast: 239.255.255.250 Automatic: Device discovery

Security concerns: Vulnerabilities: Known security issues Disable: If not needed Firewall: Block from internet Alternative: Use mDNS instead

Cloud Registration

Cloud-based discovery: Device: Registers with cloud Cloud: Maintains device registry Client: Queries cloud for devices Access: Via cloud API

Advantages: Remote access: From anywhere Centralized: Single registry Scalable: Cloud infrastructure

IoT Management

Device Provisioning

Zero-touch provisioning: 1. Device powers on 2. Connects to network (DHCP) 3. Contacts provisioning server 4. Downloads configuration 5. Registers with management system 6. Ready for use

Manual provisioning: 1. Connect device to network 2. Access web interface or app 3. Configure WiFi credentials 4. Set device name and location 5. Complete setup

Monitoring

Metrics to track: Connectivity: Online/offline status Performance: Response time, throughput Health: Battery level, signal strength Errors: Failed requests, timeouts Security: Failed auth attempts

Tools: SNMP: Simple Network Management Protocol Syslog: Centralized logging Prometheus: Metrics collection Grafana: Visualization Custom: Device-specific monitoring

Firmware Management

Version tracking: Inventory: Current firmware versions Updates: Available updates Compliance: Required versions Vulnerabilities: Known issues

Update process: 1. Check current version 2. Download new firmware 3. Verify signature 4. Install update 5. Reboot device 6. Verify successful update 7. Report status

Scaling IoT Networks

Address Planning

Small deployment (home): Network: 192.168.1.0/24 Devices: <100 DHCP: Simple pool Management: Consumer router

Medium deployment (building): Network: 10.0.0.0/16 Subnets: Per floor or function Devices: 100-1,000 DHCP: Enterprise server Management: Network controller

Large deployment (campus/industrial): Network: 10.0.0.0/8 or IPv6 Subnets: Per building/area Devices: 1,000-1,000,000 DHCP: Redundant servers Management: Enterprise IoT platform IPv6: Recommended

Network Capacity

Bandwidth planning: Sensor data: Low (KB/s) Cameras: High (MB/s) Firmware updates: Burst (GB) Aggregate: Sum of all devices Overhead: 20-30% buffer

Example: 100 sensors @ 1 KB/s = 100 KB/s 10 cameras @ 2 MB/s = 20 MB/s Total: ~20 MB/s Peak (updates): +50 MB/s Required: 100 MB/s (with buffer)

Best Practices

Network Design

1. Segment IoT devices: Separate VLAN/subnet Firewall between segments Limit IoT-to-trusted access Monitor traffic

2. Use DHCP reservations: Consistent IP addresses Easier management Firewall rule stability Device tracking

3. Plan for IPv6: Future-proof Abundant addresses Simplified management No NAT complications

Security

1. Change default credentials: Unique passwords per device Strong passwords Regular rotation Secure storage

2. Disable unnecessary services: UPnP: If not needed Telnet: Use SSH instead HTTP: Use HTTPS Unused ports: Close them

3. Regular updates: Firmware: Keep current Security patches: Apply promptly Vulnerability scanning: Regular Decommission: Remove old devices

Management

1. Inventory: Track all devices MAC addresses IP addresses Firmware versions Locations

2. Monitoring: Online status Performance metrics Security events Alerts for issues

3. Documentation: Network diagram IP allocation Device list Configuration Procedures

Conclusion

IoT networking requires careful IP address planning, security considerations, and management strategies. Whether deploying smart home devices or industrial sensors, proper network segmentation, DHCP reservations or static IPs, and security measures are essential. IPv6 provides the address space and features needed for massive IoT deployments, while protocols like MQTT and CoAP enable efficient communication for constrained devices.

Related Articles

IPv6 for IoT

IP Management

Network Security

Performance

  • MTU - IoT MTU considerations

Explore More

Key takeaways: - IoT devices: Billions connected globally - IP assignment: DHCP reservations or static - Network segmentation: Isolate IoT from trusted - IPv6: Ideal for IoT (unlimited addresses) - Protocols: MQTT, CoAP, HTTP/HTTPS - Security: Critical for IoT devices - Firewall: Restrict IoT access - Discovery: mDNS, UPnP, cloud registration - Management: Provisioning, monitoring, updates - Scaling: Plan for growth - Best practices: Segment, secure, monitor

Bottom line: Deploy IoT devices on separate VLANs or subnets (e.g., 192.168.10.0/24) isolated from trusted networks. Use DHCP reservations for consistent IP addresses, implement firewall rules to restrict IoT device access to only necessary services, and keep firmware updated. For large deployments, use IPv6 to avoid address exhaustion. Choose appropriate protocols (MQTT for messaging, CoAP for constrained devices) and implement strong authentication with unique credentials per device. Monitor device health and maintain comprehensive inventory of all IoT devices.

ad placeholder image ad placeholder image
Three funny piglies - an illustration ippigly.com