Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Security Begins at the Home Router

insights.sei.cmu.edu

Post reply on HN
Print view View original

71–80 of 177 posts

Re: Security Begins at the Home Router

#71

Post by wtallis »

rb808 wrote: post #64
firefistace77 wrote: post #36

I'll take this opportunity to ask the community, what is a recommend router? It's going to be me and my roommate only (with friends and family over) and I would like to get something secure and also reliable (and preferably on the cheaper side) Any suggestions? I believe we have Cox if that is any factor....

I have always used consumer routers and they worked great. I finally got persuaded by the "consumer routers are garbage" attitude and bought an Ubiquiti edgerouter and instantly regretted it. Yes I can now do very complex configurations and control lots of things I couldn't before. But I really dont want to do that and I can't notice the difference in performance so it was a bit of a waste. My guess the if you get a…

> and I can't notice the difference in performance so it was a bit of a waste.

That's because Ubiquiti Edgerouters and APs use the same processors and radios as consumer routers. If there's any truth to the memes about hardware quality, then the differences lie in things like the power supplies. Most of the perceived improvement in stability that Ubiquiti Edgerouters offer comes from having software that is actively maintained and not stuck on decade-old software branches. You can get all the same software benefits (more, really) by running OpenWRT on consumer hardware.

Re: Security Begins at the Home Router

#72

Post by wtallis »

0xfeba wrote: post #35

I agree with Steven Gibson. The biggest defense we can have on this is autoupdating routers. At a minimum, just restart at some fixed time after an update is downloaded. More fancy would be dynamically calculating a low usage day and time to restart. But this would also involve the router manufacturer keeping it up-to-date as well. Which gets me thinking... Does a SOHO (or any) device exist that effectively runs two…

> Does a SOHO (or any) device exist that effectively runs two firmware instances at once to allow minimal downtime as it switches over to new firmware?

There are plenty of routers that have two OS partitions so that a new version can be installed without interrupting the currently-running version, but you still need a full reboot to switch to running the new OS.

Re: Security Begins at the Home Router

#73

Post by wyldfire »

izacus wrote: post #69
wyldfire wrote: post #68

Earlier quoted context omitted.

Can I use Ubiquiti devices with some kind of slave or WDS mode with my ISP's wifi AP/router? I just want to extend the range without monkeying with the existing router or running cables. Ideally configuring the slaves to use the existing SSID/WPS config if that's possible. I don't care (much) about the impact to latency or throughput, it seems like there's excess capacity now. EDIT: downvoters please join the discuss…

You really want to get rid of any kind of ISP provided router and Wifi as soon as possible.

I've been very particular about using my own router and/or wifi in the past, installing one of openwrt/dd-wrt/tomato and tweaking to my heart's content. I would create a DMZ for one or more servers, do the dynamic DHCP, the whole bit.

But now, the ISP provides a single device that is where they terminate the DOCSIS connection and originate the Wifi router. And casual investigation leads me to believe that I "can't" replace this device. I don't want/need a DMZ or my own public servers. Also, I have less patience for tracking down my own breakage these days. The ISP's device works and performs spectacularly. I know of no public vulnerabilities for the provided router.

So IMO no I don't "really want to get rid of any kind of ISP provided router and Wifi".

Re: Security Begins at the Home Router

#74

Post by Osmium »

izacus wrote: post #70
Osmium wrote: post #46

Earlier quoted context omitted.

In particular, recommendations for consumer routers would be welcome. Last time this came up, the line seemed to be "consumer routers are trash, if you want security you have to use an enterprise router." There might be some truth in this, but it isn't helpful. Surely not all consumer routers are equally bad?

I've found the ASUS RT-AC series to be pretty good (both 56U and 66U can route my gigabit internet connection and provide about 400Mbit worth of wifi). But for a bit more you can get a Ubiquiti router + AP for an even better experience.

Are Ubiquiti decent? It looks like they have a consumer line (AmpliFi).

Cost is not a primary concern, within reason. Wanting a consumer focused router is more about wanting to minimize set-up time and maintainence. Frankly, I’m not sure I have the time or trust myself to set up OpenWRT correctly/make sure it’s updating regularly/I’m installing the correct version etc.

Re: Security Begins at the Home Router

#75

Post by wtallis »

ipython wrote: post #55
agentx3r wrote: post #52

Earlier quoted context omitted.

Ubiquiti makes great prosumer stuff, if you're willing to pay ~$120 for the 'router', and then another ~$100 for the wireless access point. That's not 'cheap', but it's about on par what you'd pay for a fancy consumer router that looks like a spaceship. You'll get a great interface, frequent firmware updates with new features and security fixes, and you'll have a good strong signal at your neighbour's house if you're…

You can get the EdgeRouter X for ~$50 and that will scale to symmetric gigabit connections, if your needs are simple (ie. you're just doing basic routing & firewalling, not trying to do traffic shaping, etc). Budget AP option then is a UAP-AC-Lite which you can buy off Amazon for ~$80, bringing your total to $130 all said and done. That's cheaper than most all-in-one routers, and while you won't get the best single-c…

> That's cheaper than most all-in-one routers,

It really isn't. There are plenty of consumer router+AP combos in the $75-90 range that offer equal or better performance to the ER-X + UAP-AC-Lite combination.

Re: Security Begins at the Home Router

#76

Post by Willamin »

wyldfire wrote: post #73
izacus wrote: post #69

Earlier quoted context omitted.

You really want to get rid of any kind of ISP provided router and Wifi as soon as possible.

I've been very particular about using my own router and/or wifi in the past, installing one of openwrt/dd-wrt/tomato and tweaking to my heart's content. I would create a DMZ for one or more servers, do the dynamic DHCP, the whole bit. But now, the ISP provides a single device that is where they terminate the DOCSIS connection and originate the Wifi router. And casual investigation leads me to believe that I "can't" r…

You can purchase a modem as a separate device that you could then use with any router. It could save you some money depending on whether or not your ISP charges you for renting their hardware.

Re: Security Begins at the Home Router

#77

Post by legulere »

firefistace77 wrote: post #36

I'll take this opportunity to ask the community, what is a recommend router? It's going to be me and my roommate only (with friends and family over) and I would like to get something secure and also reliable (and preferably on the cheaper side) Any suggestions? I believe we have Cox if that is any factor....

AVM Fritz!box

Re: Security Begins at the Home Router

#78

Post by wtallis »

Osmium wrote: post #74
izacus wrote: post #70

Earlier quoted context omitted.

I've found the ASUS RT-AC series to be pretty good (both 56U and 66U can route my gigabit internet connection and provide about 400Mbit worth of wifi). But for a bit more you can get a Ubiquiti router + AP for an even better experience.

Are Ubiquiti decent? It looks like they have a consumer line (AmpliFi). Cost is not a primary concern, within reason. Wanting a consumer focused router is more about wanting to minimize set-up time and maintainence. Frankly, I’m not sure I have the time or trust myself to set up OpenWRT correctly/make sure it’s updating regularly/I’m installing the correct version etc.

> Frankly, I’m not sure I have the time or trust myself to set up OpenWRT correctly/make sure it’s updating regularly/I’m installing the correct version etc.

As long as you're not going out of your way to install a nightly build of OpenWRT and you just stick with the stable releases, it's no more difficult than installing new firmware from the manufacturer and configuring it. The web interface for configuring OpenWRT is comparable to what most consumer routers provide, except that OpenWRT's UI is shared across all hardware platforms instead of being laden with vendor-specific branding and snake oil features.

Re: Security Begins at the Home Router

#79

Post by copperx »

ipython wrote: post #55
agentx3r wrote: post #52

Earlier quoted context omitted.

Ubiquiti makes great prosumer stuff, if you're willing to pay ~$120 for the 'router', and then another ~$100 for the wireless access point. That's not 'cheap', but it's about on par what you'd pay for a fancy consumer router that looks like a spaceship. You'll get a great interface, frequent firmware updates with new features and security fixes, and you'll have a good strong signal at your neighbour's house if you're…

You can get the EdgeRouter X for ~$50 and that will scale to symmetric gigabit connections, if your needs are simple (ie. you're just doing basic routing & firewalling, not trying to do traffic shaping, etc). Budget AP option then is a UAP-AC-Lite which you can buy off Amazon for ~$80, bringing your total to $130 all said and done. That's cheaper than most all-in-one routers, and while you won't get the best single-c…

I'm ashamed by this Networking 101 question, but what prevents you from connecting the UAP-AC-Lite directly to the ISP's device? (Assuming you don't want a physical ethernet connection at all). Is it for DHCP and assigning IPs to the clients?

Re: Security Begins at the Home Router

#80

Post by copperx »

wtallis wrote: post #75
ipython wrote: post #55

Earlier quoted context omitted.

You can get the EdgeRouter X for ~$50 and that will scale to symmetric gigabit connections, if your needs are simple (ie. you're just doing basic routing & firewalling, not trying to do traffic shaping, etc). Budget AP option then is a UAP-AC-Lite which you can buy off Amazon for ~$80, bringing your total to $130 all said and done. That's cheaper than most all-in-one routers, and while you won't get the best single-c…

> That's cheaper than most all-in-one routers, It really isn't. There are plenty of consumer router+AP combos in the $75-90 range that offer equal or better performance to the ER-X + UAP-AC-Lite combination.

Such as ...?
Post reply on HN