Broadband Tech > Security > Security > Router security

reply to Juggernaut

Re: Router security

reply to norwegian

reply to norwegian

reply to norwegian
BTW this whole thread has got me thinking about what devices I have on wi-fi. With a little bit of work (hardware + firewall setup) I could make some of them hardwired (cabled). That'd just decrease the probability that they could be reached.
--
Don't feed trolls--it only makes them grow!

reply to norwegian
Disable WPS if you can.

Linksys gives the illusion of allowing one to disable it but it is just an illusion.

DDWRT will let you do it.

Dave
--
I may have been born yesterday. But it wasn't at night.

reply to StuartMW
Yeah, everything I've read says that hiding SSID is useless. I have done it only to keep casual users from trying to connect, but that probably just ensures that the only attempts will be malicious or non-casual. The router wifi is secured anyway with a strong password in WPA2 and also the administrator name and password are unique and remote administration is disabled. There's really no need for remote administration for most people, anyway, is there?

The key remains LAN access, doesn't it. How does one log onto the LAN, users and user levels, passwords, etc? If it is easy to log onto the LAN locally, then once the wifi connection and strong password are known, logging onto the LAN will also be easy, won't it?
--
It is easier for a camel to put on a bikini than an old man to thread a needle.

reply to StuartMW
I have a really old D-Link at home that is not wireless, so I don't have to worry about that one, at least when it comes to WPS. I have verified that the wireless router at an office I have some responsibility for is not vulnerable to that attack because it does not support WPS.
--
It is easier for a camel to put on a bikini than an old man to thread a needle.

reply to norwegian
I suggest investigating VLANs as a possible security feature. It essentially lets you define specific paths between specific points and a trunk connection to border routers or shared printers. Since VLAN switches provide layer 2 data link level switching, they are impervious to many of the LAN side malware spreading exploits extant today.

Configuration isn't a trivial matter, but once it's set up, it's low maintenance.

Here's a couple of educational links to review the subject;

»computer.howstuffworks.com/lan-switch15.htm

See »www.cisco.com/web/about/ac123/ac···ion.html

For a nice discussion on wireless router hardening, see
»Harden your router/AP in five steps

Stuart, you may like this configuration example;

Do I understand you to mean that the smartphones, etc., do not have WPA2 enterprise support? I think that must be true, as I have not seen that available in smartphones that I allowed. They do support WPA2 (non-enterprise).
--
It is easier for a camel to put on a bikini than an old man to thread a needle.

OK, that's what I thought. The router I have dealt with in this situation can support VLAN and also WPA2-Enterprise, but all those smartphones don't understand WPA2-Enterprise.

I wonder whether you can use WPA2-Enterprise mixed and it would work with the smartphones? I have not tested this. After some checking, I think this probably would not work, either. I also found some commentary about WPA2-Enterprise and Apple iOS5 having issues with connecting.
--
It is easier for a camel to put on a bikini than an old man to thread a needle.

reply to norwegian

reply to EGeezer

reply to HELLFIRE

change AP name
hidden SSID
use ONLY WPA2-PSK with AES
Turn off remote port admin
Turn off WIfi Admin

No that's the trick...
Save your settings in Admin menu (settings.bin) in your computer, THEN
TURN OFF ALL ADMIN login options (no login even in plugin LAN port)!!!

All is left for 'break-in' to tamper your setting is RESET BUTTON , but after reset, you can notice your wifi won't work, (wrong AP name, wrong SSID & wrong WPA2 password), the ALARM is rang

reply to norwegian
In any network it is by nature weaker from the inside. on home routers it is that they trust all from the inside many times and there is always the ability from the inside if one has physical access to set it back to factory.

I have always seen network security as working exactly like building security. Once you get access via some method or person inside the initial barriers your job has become many times easier because buildings like networks use the outer walls as their primary line of defense. Once passed that primary wall a skilled hacker will be able to find weaker sub systems that can lead to the main system.
--
[65 Arcanist]Filan(High Elf) Zone: Broadband Reports

reply to StuartMW