Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

MikroTik routers are forwarding owners’ traffic to unknown attackers

blog.netlab.360.com

Post reply on HN
Print view View original

31–40 of 151 posts

Re: MikroTik routers are forwarding owners’ traffic to unknown attackers

#31

Post by dboreham »

CallMeZach wrote: post #21
kibwen wrote: post #14

Can anyone suggest a wireless router that someone can buy today that either ships with or can be flashed with OSS firmware? I've been trying to shop around for one compatible with DD-WRT or OpenWRT and been rather disheartened so far; every promising model I've found either requires you to play roulette with the specific hardware version of the router that you receive (which is never advertised on product pages), or…

I like Mikrotik hap ac(at work) or hap ac lite (at home). they simply work. always.

Although RouterOS is based on OSS (Linux kernel), parent wanted to flash the unit with software they built themselves from source. This afaik isn't possible with Mikrotik hardware.

Edit: actually, it is possible at least for some MT hardware : https://wiki.openwrt.org/toh/mikrotik/common

Re: MikroTik routers are forwarding owners’ traffic to unknown attackers

#32

Post by pbasista »

kibwen wrote: post #14

Can anyone suggest a wireless router that someone can buy today that either ships with or can be flashed with OSS firmware? I've been trying to shop around for one compatible with DD-WRT or OpenWRT and been rather disheartened so far; every promising model I've found either requires you to play roulette with the specific hardware version of the router that you receive (which is never advertised on product pages), or…

There are a lot of them, but depending on which features you need and where you live, it might be difficult to get one.

Take a look e.g. at OpenWrt's list of devices "Ideal for OpenWrt": https://openwrt.org/toh/views/toh_available_864

Consider TP-Link Archer C7, for instance. It is an older one, but has reasonably fast hardware, supports IEEE 802.11ac and is available on Amazon. New costs ~75 USD, a "certified refurbished" version costs ~50 USD.

Re: MikroTik routers are forwarding owners’ traffic to unknown attackers

#33

Post by pjmlp »

kibwen wrote: post #14

Can anyone suggest a wireless router that someone can buy today that either ships with or can be flashed with OSS firmware? I've been trying to shop around for one compatible with DD-WRT or OpenWRT and been rather disheartened so far; every promising model I've found either requires you to play roulette with the specific hardware version of the router that you receive (which is never advertised on product pages), or…

Here in Germany there is the Fritz brand.

If I am not mistaken FRITZ!OS is a Linux distribution.

Re: MikroTik routers are forwarding owners’ traffic to unknown attackers

#34

Post by alias_neo »

kibwen wrote: post #14

Can anyone suggest a wireless router that someone can buy today that either ships with or can be flashed with OSS firmware? I've been trying to shop around for one compatible with DD-WRT or OpenWRT and been rather disheartened so far; every promising model I've found either requires you to play roulette with the specific hardware version of the router that you receive (which is never advertised on product pages), or…

For something with hardware offload, get a Ubiquiti EdgeRouter. I run one at home, it's debian based, I have lots of tools I've written in Go compiled and running on it for various purposes and you can install debian packages for things you need.

The other option I've heard good things about are the PCEngines devices. They don't, as far as I'm aware, have hardware offload, so make sure their performance suits, but they use OSS U-Boot and you install the OS of your choice. It's one of the most open devices in a router form factor I've come across.

Depending on the number of ports you need, you could also use one of the Jetway devices. They make them with varying numbers of ports as SBCs in a case and you add RAM/M.2 SSD. I got a Celeron one with 2 ports and run it as a Suricata IPS. It performed just fine with my 100M pipe.

Re: MikroTik routers are forwarding owners’ traffic to unknown attackers

#35

Post by EmmEff »

pbasista wrote: post #32
kibwen wrote: post #14

Can anyone suggest a wireless router that someone can buy today that either ships with or can be flashed with OSS firmware? I've been trying to shop around for one compatible with DD-WRT or OpenWRT and been rather disheartened so far; every promising model I've found either requires you to play roulette with the specific hardware version of the router that you receive (which is never advertised on product pages), or…

There are a lot of them, but depending on which features you need and where you live, it might be difficult to get one. Take a look e.g. at OpenWrt's list of devices "Ideal for OpenWrt": https://openwrt.org/toh/views/toh_available_864 Consider TP-Link Archer C7, for instance. It is an older one, but has reasonably fast hardware, supports IEEE 802.11ac and is available on Amazon. New costs ~75 USD, a "certified refurb…

Sadly, the Archer C7 cannot exceed 60Mbit/s without hardware offload when running OpenWRT. I had to replace mine with a Ubiquiti wireless access point and a dedicated pfSense box.

Re: MikroTik routers are forwarding owners’ traffic to unknown attackers

#37

Post by bipson »

kibwen wrote: post #14

Can anyone suggest a wireless router that someone can buy today that either ships with or can be flashed with OSS firmware? I've been trying to shop around for one compatible with DD-WRT or OpenWRT and been rather disheartened so far; every promising model I've found either requires you to play roulette with the specific hardware version of the router that you receive (which is never advertised on product pages), or…

Interestingly enough, MikroTik routers are mostly well supported by OpenWrt it seems. At least that's what my search for something that is beefier than regular OTS Routers has yielded. Flashing OpenWrt is a little cumbersome though.

TP-Link, the former manufacturer of my choice, unfortunately has become a version roulette it seems.

If power consumption does not bother you, maybe banana pi? Or something atom based?

Re: MikroTik routers are forwarding owners’ traffic to unknown attackers

#38

Post by sokoloff »

discreditable wrote: post #30
sokoloff wrote: post #19

Earlier quoted context omitted.

I just last weekend retired a pair of Asus RT-AC66U routers/access points. They ran stable for years on Tomato (version tomato-RT-AC66U_AT-RT-AC6x-3.4-140-AIO-64K.trx) and I think all the hardware revisions work, but confirm that yourself. I retired them mostly because the Ubiquiti management is much easier and that hardware also affordable (though the software is not open, so not a fit for your use case).

Same case for me. I had an AC88U. I got tired of it because the 5GHz 802.11ac radio seemed like it'd be forever broken in OSS firmwares. I felt asuswrt was pretty crappy too. I went ubiquiti. Their management is nice, and they actually seem interested in fixing bugs in their firmware.

On the AC66U, 5GHz radio seemed to work well and I got consistent 105-ish Mbps in the same room as the AP.

(I'm not disputing your experience, but don't want other readers to conclude that 5GHz doesn't work on any of them.)

Re: MikroTik routers are forwarding owners’ traffic to unknown attackers

#39

Post by [deleted] »

24gttghh wrote: post #23
isostatic wrote: post #6

My home router has the following /ip firewall filter add action=accept chain=input connection-state=established add action=accept chain=input connection-state=related add action=accept chain=input dst-port=5000 protocol=udp add action=accept chain=input dst-port=6000 protocol=udp add action=accept chain=input dst-port=6001 protocol=udp add action=accept chain=input protocol=icmp add action=accept chain=input dst-port…

You could limit only certain ICMP types as well, and change your SSH port. And you can ask yourself: Do I really need access to my firewall from work?

[deleted]

Re: MikroTik routers are forwarding owners’ traffic to unknown attackers

#40

Post by dsr_ »

yjftsjthsd-h wrote: post #22
kibwen wrote: post #14

Can anyone suggest a wireless router that someone can buy today that either ships with or can be flashed with OSS firmware? I've been trying to shop around for one compatible with DD-WRT or OpenWRT and been rather disheartened so far; every promising model I've found either requires you to play roulette with the specific hardware version of the router that you receive (which is never advertised on product pages), or…

I know this doesn't help friends and non-technical folks, but I finally gave up and bought an APU[0], installed Debian, and configured dnsmasq+hostapd+iptables. With unattended updates, it was the most secure thing I could think of. Well, I suppose using openbsd would have been potentially more secure, but there were driver issues with the wireless card that I wanted. [0] https://pcengines.ch/apu2.htm

I highly recommend this sort of roll-your-own, with Debian or OpenBSD depending on your skill set.
Post reply on HN