Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Security Begins at the Home Router

insights.sei.cmu.edu

Post reply on HN
Print view View original

131–140 of 177 posts

Re: Security Begins at the Home Router

#131

Post by FredFS456 »

ipython wrote: post #55
agentx3r wrote: post #52

Earlier quoted context omitted.

Ubiquiti makes great prosumer stuff, if you're willing to pay ~$120 for the 'router', and then another ~$100 for the wireless access point. That's not 'cheap', but it's about on par what you'd pay for a fancy consumer router that looks like a spaceship. You'll get a great interface, frequent firmware updates with new features and security fixes, and you'll have a good strong signal at your neighbour's house if you're…

You can get the EdgeRouter X for ~$50 and that will scale to symmetric gigabit connections, if your needs are simple (ie. you're just doing basic routing & firewalling, not trying to do traffic shaping, etc). Budget AP option then is a UAP-AC-Lite which you can buy off Amazon for ~$80, bringing your total to $130 all said and done. That's cheaper than most all-in-one routers, and while you won't get the best single-c…

I believe that the ER-X doesn't scale to gigabit symmetric, while the EdgeRouter Lite does.

Re: Security Begins at the Home Router

#132

Post by [deleted] »

acidburnNSA wrote: post #109
securityn0w wrote: post #95

Earlier quoted context omitted.

Do you realize that OpenWrt is not very secure and DD-Wrt is even worse?

One thing I hated about ddwrt was how hard it was to get a TLS download and/or hash. Like seriously, if I'm putting this on my router I don't want it coming down by http!

[deleted]

Re: Security Begins at the Home Router

#133

Post by wtallis »

flukus wrote: post #127
wtallis wrote: post #120

Earlier quoted context omitted.

> I've looked at various possibilities and the whole scene is a mess similar to phone ROMs where you have to trawl through random forums, pull down random ROMs, trawl through more forums to find out why x doesn't work in $country with $ISP. That's describing pretty much all the alternative firmware distributions, except OpenWRT, which is actually well-organized and delivers real stable releases. If you're digging thr…

> it's almost certainly because you got fooled into buying hardware that requires closed-source drivers. Bingo, that seems to be about all that's available. I'm looking at off the shelf hardware I can purchase locally, hardware I know works with local ISP's, I have no idea if we use the same standards as America for this stuff, what connections and adapters I'll need, etc. Buying locally eliminates these variables. I…

> hardware I know works with local ISP's

Your ISP is irrelevant, unless you're shopping for an integrated modem+router. Rule number 1 is don't do that, and keep your modem separate and just a modem. Then your router only needs the universal standard Ethernet port as its WAN interface, and at worst you might have to configure PPPoE instead of just using DHCP to get your public IP.

Re: Security Begins at the Home Router

#134

Post by stock_toaster »

stamps wrote: post #16
dsr_ wrote: post #5

I don't fear rebooting my router because it takes less than 30 seconds to do a complete cycle; TCP sessions can withstand that. It probably helps that it runs Debian stable, too, so security updates are frequent and regular.

Care to share some more information about your setup? I'm a PFsense user currently and am always looking for ways to tinkering with my networks.

Take a look at VyOS (a vyatta fork). Pretty slick.

Ubiquiti did their own fork of vyatta for their edgeos offering, I believe.

Re: Security Begins at the Home Router

#135

Post by wtallis »

FredFS456 wrote: post #131
ipython wrote: post #55

Earlier quoted context omitted.

You can get the EdgeRouter X for ~$50 and that will scale to symmetric gigabit connections, if your needs are simple (ie. you're just doing basic routing & firewalling, not trying to do traffic shaping, etc). Budget AP option then is a UAP-AC-Lite which you can buy off Amazon for ~$80, bringing your total to $130 all said and done. That's cheaper than most all-in-one routers, and while you won't get the best single-c…

I believe that the ER-X doesn't scale to gigabit symmetric, while the EdgeRouter Lite does.

ER-Lite has a really weak CPU, and can only get close to 1Gbps using its hardware offloads, which limit what you can do to the traffic passing through the router. ER-X has a faster CPU and can get reasonably close to 1Gbps with software packet forwarding for simple rules, and can handle traffic shaping at far higher speeds than the ER-Lite (though neither can shape anywhere close to 1Gbps).

Re: Security Begins at the Home Router

#136

Post by zrm »

zanny wrote: post #106
zrm wrote: post #54

Earlier quoted context omitted.

So there are two main issues with consumer routers. The first is that the hardware is garbage. This isn't universally true, but it's a strong general rule, and models get released and discontinued all the time so the short list of models that aren't garbage changes every year. The main security issue is that the vendors stop issuing security updates after they stop selling the router even though people are still usin…

I've always wanted to just use an old junk PC as a router instead of paying for what is basically an overpriced Pi with a 4 jack ethernet card attached. But the problem then is that getting enough ethernet ports in the thing to equal the average router is price prohibitive. I wish there were $20-$30 PCI-E bridge cards of >2 1Gbit ethernet jacks but they don't exist.

> But the problem then is that getting enough ethernet ports in the thing to equal the average router is price prohibitive.

Unless you actually need the ports to do some kind of network segmentation, one solution is to just plug the inside port into a five port switch (~$15). Which is how a lot of the consumer grade routers are implemented internally anyway.

You also can find quad port gigabit cards around those prices. Currently $22: https://www.amazon.com/HP-NC375T-Gigabit-Ethernet-539931-001...

There are scads of used quad port cards for even less on eBay.

Re: Security Begins at the Home Router

#137

Post by kqr »

firefistace77 wrote: post #36

I'll take this opportunity to ask the community, what is a recommend router? It's going to be me and my roommate only (with friends and family over) and I would like to get something secure and also reliable (and preferably on the cheaper side) Any suggestions? I believe we have Cox if that is any factor....

I did something slightly different: I was donated various low-power, low-noise PC parts from a friend, one of which was a motherboard with two ethernet ports. Chucked FreeBSD on it, configured one port as WAN and the other LAN, connected LAN to cheap-ish switch and from there also to wifi bridge.

Never had a better setup.

It blows any consumer router I've used out of the water in terms of stability, performance, flexibility, security, and user experience.

Getting emails for potential security issues, custom DNS domain for local network, fail2ban bruteforce prevention, QoS, alerting when WAN goes down, and so on, has all been a breeze to set up.

Re: Security Begins at the Home Router

#138

Post by _emacsomancer_ »

securityn0w wrote: post #95
j45 wrote: post #49

Earlier quoted context omitted.

Solid firmwares like OpenWRT run on a lot of routers already. It should be possible to have some amount of regular updates, if not automatic.

Do you realize that OpenWrt is not very secure and DD-Wrt is even worse?

So we should just stick with the inscrutable pre-installed proprietary firmware?

Re: Security Begins at the Home Router

#139

Post by ethbro »

wtallis wrote: post #92
neospice wrote: post #42

Earlier quoted context omitted.

It seems obvious that this should be developed, but to take it a step further it would be great if consumers could purchase something that gave them access to these plugins without needing to know how to setup OpenWRT. This will be challenging because most ISPs provide the router and firmware for the majority of their customers.

ISPs will have to start requiring the OEMs to offer some form of ongoing software maintenance, rather than just the rare bug fix on a distribution that otherwise dates to when the SoC inside first taped out. I can't imagine the OEMs or the SoC vendors being willing to do that kind of maintenance in-house, but the large ISPs certainly have enough leverage to require upstream support in OpenWRT.

Ha.

In a choice between mandating people rent their routers, or pushing vendors to offer patches, I wouldn't bet on ISPs picking the latter.

Re: Security Begins at the Home Router

#140

Post by 713233eb »

OldSchoolJohnny wrote: post #103
Covzire wrote: post #63

For the average consumer / prosumer, The best I've found are Asus routers. I have a 3-4 year old Asus that still gets regular security updates. If you want to go deeper, get any cheap NUC or system with 2 NICs, install OpenBSD and configure it as a firewall / router.

I would have said that too based on our RT-AC68U right up until I read this post and thought "time to update that router" and when I did so, for the first time in many updates I was presented with a license agreement allowing ASUS to send basically every bit of data to a 3rd party (Trend Micro) for features I didn't ask for. I should have captured it but the data they described was basically every bit of data you can…

Is this the case with Merlin's firmware too or just the OEM FW?
Post reply on HN