Project Overview

The "Secur-Wake Network Gateway" is a specialized IoT appliance designed to solve the security and routing limitations of standard Wake-on-LAN (WOL) implementations. While WOL allows a computer to be powered on via a "Magic Packet," directly exposing these packets to the internet via port-forwarding is a significant security risk and often fails due to router broadcast limitations. This project utilizes a Wemos D1 Mini as an intelligent buffer—acting as a secure intermediary that validates incoming requests before rebroadcasting them onto the local network. It is an essential study in UDP packet filtering, MAC address serialization, and network-level security.

Technical Deep-Dive

• The "Magic Packet" Anatomy:
  • Payload Structure: A standard WOL Magic Packet consists of a 6-byte synchronization stream (six 0xFF bytes) followed by 16 repetitions of the target device's MAC address.
  • SecureOn Password Extension: Many high-end network cards support the "SecureOn" feature, which appends a 6-byte password to the end of the Magic Packet. This project implements a Validation Engine that ensures this password matches exactly before the gateway takes any action.
• Packet Filtering & Rebroadcasting:
  • Anti-Flooding Mechanism: Local routers often block external UDP broadcast packets to prevent "Network Flooding" attacks. This gateway bypasses this by accepting a targeted UDP packet (unicast) on a specific port and then converting it into a local broadcast (255.255.255.255) once it is safely inside the firewall.
  • UDP Listening (Port 50000): The Wemos D1 Mini runs a dedicated UDP listener. It uses the ESP8266WiFi and WiFiUdp libraries to asynchronously monitor incoming packets while maintaining a stable Station (STA) connection.
• Router & DHCP Architecture:
  • Reserved IP Addressing: For the gateway to work reliably, it must have a Static Local IP. This guide emphasizes using the router’s DHCP Reservation table rather than hard-coding the IP in the firmware, which allows for easier network re-configuration.
  • Port Forwarding Strategy: The project recommends using a non-standard external port (e.g., in the range 49152-65535) and mapping it to the internal port 50000. This "Security through Obscurity" layer helps reduce automated port-scanning noise from the public internet.

Engineering & Implementation

• Low-Latency Performance: Since the gateway is a "Headless" device, it is optimized for high uptime. The firmware includes an Auto-Reconnection Loop; if the WiFi connection is lost, the Wemos automatically attempts to re-associate with the router, ensuring the "Wake" capability is always available.
• Scalability (Multi-Device Support): Unlike simple port-forwarding which allows only one device per external port, this gateway can be expanded to wake an unlimited number of devices on the same LAN by identifying the specific MAC address encapsulated within the secure Magic Packet.
• Hardware Efficiency: The Wemos D1 Mini is chosen for its compact form factor and integrated WiFi. It can be powered directly from a standard 5V USB wall adapter, consuming less than 1W of power in standby mode, making it an eco-friendly alternative to leaving a full computer running just for remote access.
• Industrial Use-Case: This technique is a standard practice in Remote Server Management and Smart Home "Away" Modes. It allows users to keep power-hungry workstations or NAS devices off while traveling, powering them on only when needed to access files or perform remote computations.

---

Wake with confidence: Bridging global remote access with hard-coded network security.