Security Begins at the Home Router • Hacker News Board

Re: Security Begins at the Home Router

#151

Post by walrus01 » Tue, Jul 31, 2018, 8:11 AM UTC

wtallis wrote: post #125

walrus01 wrote: post #112

The best advice I can offer for people who know what they are doing (eg: HN readers), for their homes and home offices, is to separate the functions of modem, router and wifi . Have a DOCSIS3 / DOCSIS3.1 modem that is a dumb L2 bridge. TP-Link makes decent ones that are compatible with Comcast. You can find them and their reviews on Amazon. Use something like a Ubiquiti ER-X (Edgerouter X) for your WAN-to-LAN interfa…

> Have no wifi functions in your router!!! Separating the ISP-controlled modem from the router is certainly good advice, but I can't see any strong reason to recommend separating the AP from the router. If you know your AP needs to be located far from the router in order to provide decent coverage, then it makes sense. Otherwise, there's no technological or economic justification for putting three exclamation marks o…

The Venn diagram overlap of routers that have serious admin features and routers that have wifi built in is not very large. Separating the wifi allows you to replace or change wifi without bringing down services to local hardwired home servers.

Re: Security Begins at the Home Router

#152

Post by flukus » Tue, Jul 31, 2018, 8:15 AM UTC

wtallis wrote: post #133

flukus wrote: post #127

Earlier quoted context omitted.

> it's almost certainly because you got fooled into buying hardware that requires closed-source drivers. Bingo, that seems to be about all that's available. I'm looking at off the shelf hardware I can purchase locally, hardware I know works with local ISP's, I have no idea if we use the same standards as America for this stuff, what connections and adapters I'll need, etc. Buying locally eliminates these variables. I…

> hardware I know works with local ISP's Your ISP is irrelevant, unless you're shopping for an integrated modem+router. Rule number 1 is don't do that , and keep your modem separate and just a modem. Then your router only needs the universal standard Ethernet port as its WAN interface, and at worst you might have to configure PPPoE instead of just using DHCP to get your public IP.

> Rule number 1 is don't do that, and keep your modem separate and just a modem

I think I'm going to have to go down this path, I was just hoping to avoid it. It means having another device to configure, another set of blinking lights, another weird shaped plug to try and squeeze into the power board and learning whatever PPPoE is just to transform Ethernet packets into the ADSL equivalent.

It also possibly means a more complicated setup controlling outbound connections so that a compromised server cannot reach the modem.

Re: Security Begins at the Home Router

#153

Post by izacus » Tue, Jul 31, 2018, 8:44 AM UTC

gascan wrote: post #101

izacus wrote: post #70

Earlier quoted context omitted.

I've found the ASUS RT-AC series to be pretty good (both 56U and 66U can route my gigabit internet connection and provide about 400Mbit worth of wifi). But for a bit more you can get a Ubiquiti router + AP for an even better experience.

Also important, they are popular. Which means more continued support, and more forks.

Yes, I was surprised that my 1st gen 66U (which is now quite a few years old) is still getting security updates. The fact that it runs ddWRT by default also means that I don't have to flash it at all.

Re: Security Begins at the Home Router

#154

Post by izacus » Tue, Jul 31, 2018, 8:45 AM UTC

wyldfire wrote: post #73

izacus wrote: post #69

Earlier quoted context omitted.

You really want to get rid of any kind of ISP provided router and Wifi as soon as possible.

I've been very particular about using my own router and/or wifi in the past, installing one of openwrt/dd-wrt/tomato and tweaking to my heart's content. I would create a DMZ for one or more servers, do the dynamic DHCP, the whole bit. But now, the ISP provides a single device that is where they terminate the DOCSIS connection and originate the Wifi router. And casual investigation leads me to believe that I "can't" r…

Hmm, no idea for your ISP, but most of the ISPs I've used had the option to switch their equipment to so-called "bridge mode", where it just did the DOCSIS/DSL thing, gave you one unfirewalled external IP and let your router do NAT etc.

They usually didn't advertise that though.

Re: Security Begins at the Home Router

#155

Post by fulafel » Tue, Jul 31, 2018, 9:59 AM UTC

Cynical take on the situation from a consumer POV: Keeping your ISP-provided CPE box but viewing it as the bug-ridden vulnerability christmastree that it is keeps you from lulling yourself into the "secure internal network" fallacy, while maybe keeping the liability on the ISP side.

Re: Security Begins at the Home Router

#156

Post by _b8r0 » Tue, Jul 31, 2018, 10:15 AM UTC

securityn0w wrote: post #100

NickBusey wrote: post #94

Earlier quoted context omitted.

It sure sounds like you are describing Turris OS. https://project.turris.cz/en/software

Why did not they add the features to OpenWrt trying to make it better? Almost all the forks of OpenWrt die in months. Some lasted only few years. I am afraid that it is a wasted effort.

OpenWRT development was stale when Turris started. Don't forget the LEDE fork was born out of problems with OpenWRT development.

Re: Security Begins at the Home Router

#157

Post by deno » Tue, Jul 31, 2018, 10:17 AM UTC

ateesdalejr wrote: post #56

ozim wrote: post #44

Earlier quoted context omitted.

When I have to generate pw for such use case I use: http://www.dinopass.com/

Only reason I would be concerned about using that specific generator in particular would be the fact that it severely limits your passwords to the "kid-friendly" set.

That’s the only reason? And the fact that it’s exclusively online?

Re: Security Begins at the Home Router

#158

Post by Piskvorrr » Tue, Jul 31, 2018, 10:23 AM UTC

wtallis wrote: post #71

rb808 wrote: post #64

Earlier quoted context omitted.

I have always used consumer routers and they worked great. I finally got persuaded by the "consumer routers are garbage" attitude and bought an Ubiquiti edgerouter and instantly regretted it. Yes I can now do very complex configurations and control lots of things I couldn't before. But I really dont want to do that and I can't notice the difference in performance so it was a bit of a waste. My guess the if you get a…

> and I can't notice the difference in performance so it was a bit of a waste. That's because Ubiquiti Edgerouters and APs use the same processors and radios as consumer routers. If there's any truth to the memes about hardware quality, then the differences lie in things like the power supplies. Most of the perceived improvement in stability that Ubiquiti Edgerouters offer comes from having software that is actively…

...if you're willing to actively maintain your setup. Probably a safe assumption here; for a normal user, that would be too much of a burden.

Re: Security Begins at the Home Router

#159

Post by Fnoord » Tue, Jul 31, 2018, 10:41 AM UTC

corndoge wrote: post #85

CommanderData wrote: post #40

I'd like explore making a small ecosystem of open security plugins built on top of OpenWrt. The goal is to make firewalling and controlling network traffic really easy. The UI should be so easy a parent could perform difficult tasks such as limiting an iot devices traffic to local net or maybe just one ip using just an app. Or detecting unusual patterns of traffic from a device or IP addresses. The apis exist I can't…

I think the problem is that it already is really easy. I feel like it'd be hard to simplify the interface of something like UniFi's AP series and still keep the number of knobs it gives you. And you almost certainly will never simplify it to the point that people will stop making youtube bandicam free edition tutorials on how to port forward your minecraft server.

The UniFi range is very easy. The Edge series (such as EdgeMAX) is slightly less easy, but also more powerful.

Easy and secure are not always a good match though. Take UPnP for example. Disabled by default on my ER-L, it can be enabled, but its ultimately insecure. And ultimately, HTTP over SSL could download payloads.

Re: Security Begins at the Home Router

#160

Post by Fnoord » Tue, Jul 31, 2018, 10:49 AM UTC

kyrra wrote: post #6

AustinBGibbons wrote: post #2

Telling that the summary advice is “change the default password”, even if some of the other ideas are deployed user involvement is near zero if not completely zero. I wonder how impactful it would be to roll out a totally read-only router, or if the necessity of updates and maintenance would generate too much headache for the user

(I'm a Googler, opinions are my own). I think this is one of the awesome things about Google Wifi (aka: OnHub). It's fully managed from a phone app (via "the cloud"), so you get the authentication tied to your gmail account. It's also based on ChromeOs (chromebook OS), and follows a similar auto-update that Chromebooks get. So you are always running the latest firmware. (There are obviously downsides to Google Wifi,…

UniFi products also work from the cloud, if you enable that (it is optional) and you're not tied into the system of one of the largest data gatherers in the world.

Microsoft with Windows 10 uses machine learning to figure out when its most convenient for the user to update (latest Insider build has this function). Either way, Windows has come a long way from 9x randomly crashing and every other piece of software requiring a reboot.