Coffee shop network pentest
& full remediation
An authorized penetration test on a live small business network — uncovering critical vulnerabilities including accessible security cameras via default credentials — followed by a ground-up network rebuild using OPNsense, VLANs, and managed switching.
Authorized engagement: This test was conducted with the full knowledge and written consent of the business owners, who are family members. All findings were disclosed immediately. No data was accessed beyond what was necessary to demonstrate the vulnerability. Credentials were changed during the test to prevent third-party access.
Overview
My parents’ cafe was running a typical small business network: a TP-Link mesh router, a handful of devices and a Lorex security camera system, all on the same flat network with no segmentation. When I offered to take a look at it from a security perspective, they agreed and I conducted a structured penetration test against the live environment.
The findings were significant. Within minutes of scanning the network, I identified the security cameras by their MAC address fingerprint, accessed their web interface using factory default credentials that had never been changed and had full control of the camera system including live feeds. A malicious actor posing as a regular customer on the WIFI could have done the same thing.
The engagement didn’t stop at the report. I designed and physically built a replacement network from scratch: a custom OPNsense firewall router running on a repurposed Dell Optiplex, a managed switch and properly segmented VLANs. I turned our pentest findings directly into a remediated infrastructure.
Before & after
- Single flat network — all devices on the same subnet
- Customer WIFI and staff devices on the same network
- Security cameras reachable from guest WIFI
- Lorex cameras running factory default credentials
- TP-Link mesh router with no VLAN support
- No firewall rules between device classes
- No network visibility or logging
- Three isolated VLANs — guest, staff, and IoT/cameras
- Customers on isolated guest VLAN — no LAN access
- Cameras on dedicated IoT VLAN — unreachable from other segments
- All default credentials changed on cameras and network gear
- OPNsense firewall with explicit inter-VLAN deny rules
- Managed switch enforcing VLAN tagging at port level
- Separate SSIDs per VLAN with WPA2 on all networks
Penetration test — attack chain
The following documents the steps taken during the authorized test, from initial recon through full camera access. The entire sequence took under 30 minutes from a device connected to the guest WIFI. Diagrams will be used in place of screenshots to protect the confidentiality of the coffee shop’s network infrastructure.
nmap -sn 192.168.1.0/24 # All hosts visible from guest network (no segmentation) 192.168.1.1 — TP-Link router 192.168.1.10 — Staff laptop 192.168.1.11 — POS terminal 192.168.1.20 — Unknown device (Lorex Technology OUI) 192.168.1.21 — Unknown device (Lorex Technology OUI) 192.168.1.22 — Unknown device (Lorex Technology OUI)
nmap -sV -p 80,443,554,8000 192.168.1.20-22 192.168.1.20: 80/tcp open http Lorex IP camera webserver 554/tcp open rtsp RTSP stream 8000/tcp open http Device management interface # Confirmed: Lorex IP cameras with web management enabled # MAC OUI: 00:1A:07 → Lorex Technology Inc.
admin / admin). Login succeeded immediately. The credentials had never been changed since installation. This granted full administrative access to all cameras.# Finding 1 — CRITICAL Title: Default credentials on Lorex IP cameras Impact: Unauthorized access to live security footage, camera controls, and system config Vector: Network-adjacent (guest WIFI → camera subnet) Status: Remediated — credentials changed during test # Finding 2 — CRITICAL Title: Flat network — no segmentation between guest, staff, POS, and IoT devices Impact: Any guest WIFI user can reach all LAN hosts Status: Remediated — VLAN rebuild (see below) # Finding 3 — MEDIUM Title: Camera RTSP streams unauthenticated on LAN Status: Remediated — cameras moved to isolated VLAN
Remediation — network rebuild
Rather than patching the existing TP-Link mesh setup (which has its incompatibilities with our plans for network segmentation), I designed and built a replacement network from scratch, one that treated the findings as requirements and built proper segmentation in from the ground up.
The router is a Dell Optiplex repurposed as an OPNsense firewall appliance. OPNsense is an open source FreeBSD-based firewall and routing platform used in enterprise environments. Running it on commodity hardware gives full control over firewall rules, VLAN configuration, DHCP, and DNS without the limitations of a consumer router. A managed switch sits downstream of the router, enforcing VLAN tagging at the port level and trunking tagged traffic to the WIFI APs.
Rebuilt network architecture
VLAN configuration
OPNsense firewall rules (excerpt)
# VLAN 10 — Guest rules BLOCK VLAN10 → 192.168.20.0/24 # block guest → staff BLOCK VLAN10 → 192.168.30.0/24 # block guest → IoT ALLOW VLAN10 → WAN # internet only # VLAN 20 — Staff rules BLOCK VLAN20 → 192.168.10.0/24 # block staff → guest BLOCK VLAN20 → 192.168.30.0/24 # block staff → IoT cameras ALLOW VLAN20 → WAN # internet ALLOW VLAN20 → VLAN20 # intra-staff LAN # VLAN 30 — IoT / camera rules BLOCK VLAN30 → 192.168.10.0/24 # block IoT → guest BLOCK VLAN30 → 192.168.20.0/24 # block IoT → staff ALLOW VLAN30 → WAN port 123 # NTP only ALLOW VLAN30 → WAN port 80,443 # firmware updates BLOCK VLAN30 → WAN # block all other outbound # Default inter-VLAN policy BLOCK ANY → ANY # implicit deny all
Findings & remediation summary
| Finding | Severity | Impact | Status |
|---|---|---|---|
| Default credentials on Lorex camerasCameras shipped with admin/admin — never changed | Critical | Full camera admin access from guest WiFi | Remediated |
| Flat network — no segmentationAll devices on a single /24 subnet | Critical | Guest users can reach POS, staff machines, cameras | Remediated |
| Unauthenticated RTSP streamsCamera video streams accessible without credentials on LAN | High | Live video accessible to any LAN device | Remediated |
| No guest network isolationGuest WiFi had same LAN access as staff devices | High | Customers could attempt lateral movement to POS | Remediated |
| Router using default admin passwordTP-Link admin panel accessible with default credentials | Medium | Full router config access to any LAN device | Remediated |
Outcome: The rebuilt network has been running in production at the coffee shop since deployment with zero issues. All three VLANs are operational, the cameras are fully isolated, and the guest network provides internet access without any visibility into business systems. The OPNsense dashboard provides ongoing visibility into traffic and firewall activity that the previous TP-Link setup had no equivalent for.