1–10 of 14 posts
http://routersecurity.org/checklist.php is really great, but kind of verbose. My attempt to boil it down to a simpler checklist: https://github.com/jonmbake/router-security-checklist.
Don't check for updates. Find a router that updates itself automatically.
It's a marathon, not a sprint. Find a company that writes their own firmware and uses the same firmware for multiple generations. This shows that they are willing and able to invest in security.
Or just check if the brand is Google or Apple.
Don't change the password. Find a router that uses pairing instead of passwords. Don't check for updates. Find a router that updates itself automatically. It's a marathon, not a sprint. Find a company that writes their own firmware and uses the same firmware for multiple generations. This shows that they are willing and able to invest in security. Or just check if the brand is Google or Apple.
I worked as a wireless router firmware developer for a while and as a result... I don't use them anymore. The whole industry is just producing unfixable tire-fires.
Different level of caring, but if security is important to you, put cable/dsl/fiber ntu in bridge mode.
Get a pcengines apu (or your favourite sbc), install your favourite os (ubuntu or debian for me). Don't bother with ui, just use a few nftables rules.
It actually worked out cheaper for me than the netgear thing shaped like a stealth fighter.
The other thing which really annoyed me was my ISP periodically updating settings on their stock router. Yeah, they can do that remotely if you use their unit and there's usually no good way to turn it off.
- SELinux Enabled
- Sysctl tuning applied
- Inbound/Outbound/Forward iptables rules enabled
- ipset iptables rules enabled
- iptables intercept rules to route all ntp/dns over VPN
to VPS nodes.
- Unbound DNS overriding many spammy domains
- tinc vpn enabled to multiple VPS nodes.
-- Each VPS node load balancing to multiple datacenter open resolvers that
are NOT OpenDNS or Google.
- ip route blackhole about 20k bad networks from firehol on github
- syslog to internal host
- Surricata IDS logging to syslog
- tc cbq traffic shaping enabled
- haproxy L4 vips for sending select traffic to select squid proxies.
- power conditionor / ups enabled, one for router, one for cable modem.
Don't change the password. Find a router that uses pairing instead of passwords. Don't check for updates. Find a router that updates itself automatically. It's a marathon, not a sprint. Find a company that writes their own firmware and uses the same firmware for multiple generations. This shows that they are willing and able to invest in security. Or just check if the brand is Google or Apple.
Can you elaborate on that? I've never seen a router that doesn't use passwords. Does this mean to use WPA2-PSK vs WPA2?
I just don't trust the local network in the first place.
Don't change the password. Find a router that uses pairing instead of passwords. Don't check for updates. Find a router that updates itself automatically. It's a marathon, not a sprint. Find a company that writes their own firmware and uses the same firmware for multiple generations. This shows that they are willing and able to invest in security. Or just check if the brand is Google or Apple.
> Find a router that uses pairing instead of passwords. Can you elaborate on that? I've never seen a router that doesn't use passwords. Does this mean to use WPA2-PSK vs WPA2?
- SELinux Enabled - Sysctl tuning applied - Inbound/Outbound/Forward iptables rules enabled - ipset iptables rules enabled - iptables intercept rules to route all ntp/dns over VPN to VPS nodes. - Unbound DNS overriding many spammy domains - tinc vpn enabled to multiple VPS nodes. -- Each VPS node load balancing to multiple datacenter open resolvers that are NOT OpenDNS or Google. - ip route blackhole about 20k bad ne…