I have several Amazon Alexa devices (an Echo, two Dots) and a Belkin Wemo smart switch. The Alexa app allows you to scan for smart home devices, and it will automatically add anything it finds. This is normally handled by communication between the app, Amazon, and the device's network cloud, but apparently the Wemo in particular uses SSDP device discovery instead. Alexa finds the Wemo almost every time.
I actually want it to fail, while allowing remote control to the Wemo from IFTTT. Yes, I know that's a weird use case :) My initial attempt was to set up a secondary network and stick the Wemo on it. But for some reason the Wemo and router won't stay connected for more than about a minute on that network. So I gave up on that and tried to do it via firewall rules - which are well outside my comfort zone. I'm also unfamiliar with SSDP/UPNP, but am getting the idea quickly. I'm using DD WRT on the router. I've assigned each Alexa device, my phone, and the Wemo a static IP address.
Given that I don't know the details of Alexa's discovery mechanism, I assume I need to drop both receiving M-SEARCH messages from the Echo and sending NOTIFY announcements from the Wemo. I would like to keep device discovery generally working on my network; I use iTunes remotes and Plex and may add more similar devices. I'm also not sure which Alexa/phone device would initiate discovery, so I'm happy blocking all of them.
So what I need is some router rules that drop SSDP communication between two devices, without disabling the entire protocol or normal HTTP communication (which I assume IFTTT is using) to either device.
What I've tried, where A is the Wemo's IP local IP address and B is one of the other four device's IP addresses:
iptables -I FORWARD -s A -d B -j logdrop iptables -I FORWARD -s B -d A -j logdrop
The responses are supposed to be unicast, so I would have thought that would drop the response to the M-SEARCH. Maybe I'm using the wrong table?
iptables -I INPUT -s A -d B -j logdrop iptables -I INPUT -s B -d A -j logdrop repeat for OUTPUT, PREROUTING, POSTROUTING
Nope. Tried adding UDP (and separately TCP, or neither, just for good measure - while keeping the above table variations):
iptables -I FORWARD -p udp -s A -d B logdrop iptables -I FORWARD -p udp -s B -d A logdrop
So that still didn't work. Maybe I can try messing with the ability to multicast?
iptables -I FORWARD -p udp -s A -d 18.104.22.168 -j logdrop iptables -I FORWARD -p udp -s 22.214.171.124 -d A -j logdrop iptables -I FORWARD -p udp -s B -d 126.96.36.199 -j logdrop iptables -I FORWARD -p udp -s 188.8.131.52 -d B -j logdrop also the INPUT/OUTPUT/PRE/POSTROUTING tables
So I've tried a lot of combinations (not every permutation of what I've shown, but a lot of them) and as a rule have been unable to keep them from finding each other. Heck, I even tried disabling UPNP entirely on the router. Even that didn't seem to work. I don't know how these darn devices are communicating! I'd packet sniff, but it's wifi and I'm on Windows, so apparently that's hard. I've had some luck with more general rules, e.g.
iptables -I FORWARD -d A -j logdrop but they're too drastic and of course broke IFTTT's ability to connect, and I had difficulty figuring out which rules were doing the magic even then.
So after two night's of trying on my own, it's time to ask for help. What's the right way to set up the firewall rules? Or what am I fundamentally misunderstanding about SSDP or routing rules (or theoretically Alexa)?