Wireless hardware with limited range?

Question

I have never used wireless networking at home, but am considering it. Does anyone make wireless hardware designed for single-room connectivity?

Several sources have recommended WPA2, but I'd still rather not be broadcasting outside the walls.

EDIT per AviD: My security concerns are that my broadcasting a greater distance than necessary, it opens my network to potential wardriving and other malevolent actions by people outside my location.

Answer 1

Regardless of what you do at the AP, I believe I can say with a fair amount of certainty that you will at some point find that your wireless data is being broadcast "outside the walls".

First, you must understand that your AP is not the only wireless transmitter on your home network. All of your wireless clients that connect to the AP are also transmitting, and many probably cannot have their power manually adjusted. Some adapters for laptops and desktops may have this option, but probably not all. If you decide to put any game consoles, smartphones, or other such dedicated devices on your wireless network, they too probably lack this capability. A number of these will likely reside adjacent or very near to one of your walls at one point or another, which practically guarantees signal leakage regardless of strength - almost all client devices are, after all, omni-directional transmitters.

Second, if you are attempting to defend against a real wardriver or dedicated threat, the signal output of your network really doesn't matter much to them. What allows them to listen in on your traffic so well is a good quality receiver, which is entirely beyond your control. High-gain, directional antennae are easily bought or home-brewed, and can often be made to pick up weak signals from a block or more away. The only thing that will assuredly keep them from hearing your wireless network is to either not have one at all, or to put it inside a Faraday room.

In the end, using signal attenuation is not going to be so much an inconvenience to the outside threat as it will be to you. A lower signal means that your devices may have trouble talking to or hearing each other from the far ends of your network environment, and they won't be able to compete as well with neighboring signals on or near the same channel. For "single-room connectivity" the former may not be a huge problem, but in many places the latter can become a real issue.

The only way to be absolutely sure you're not broadcasting any substantial data outside your walls is to stick with the wire. If you're really that worried about signal leakage, and you only need to cover one room, the convenience tradeoff is fairly minimal.

If you're really heart-set on going wireless, here's what you can do to provide some actual measures of security for your network.

• Use WPA2 with AES encryption. This is also commonly referred to as WPA2-CCMP or WPA2-RSNA. For a home network, you'll likely be using the "Personal" or "PSK" option for this, which may be called "WPA2-Personal" or "WPA2-PSK". If your network is a bit more advanced, and you know how to build a RADIUS server, you'll likely be looking for "WPA2-Enterprise".
• Use a RADIUS server if you can, for authentication. This is for very advanced users only, though.

• Create strong passwords:

  • 12 characters or more
  • Use all character types (uppercase, lowercase, numeric, non-alphanumeric)
  • Do not use any dictionary words
  • Do not make passwords related or similar to:

    • User IDs
    • Network's SSID
    • Any device hostnames
    • Each other (no two user passwords should be similar, and admin accounts should not have passwords similar to any user accounts)

• If you must use a PSK, make it as strong as you can tolerate. Absolute minimum would be to follow the password guidelines above. My personal preference is a 63-character, randomly-generated code.

• Configure MAC address filtering on your AP. While this is a relatively minor roadblock, it's also a relatively painless one. The only time this becomes a hassle is when you want to join a new device to the network for the first time, or if you do a factory reset of the router after having accumulated a large list of guest devices.
• If it is an option, configure your router's management interface to use HTTPS only.
• If it is an option, disallow access to the router's management interface over wireless connections. This way, only someone who is physically wired into the router can make configuration changes.
• Turn off wireless devices (including your AP) when they are not in use. This will limit the availability of your SSID, authorized MAC address, and sample packets (for offline brute-force attacks) to potential attackers - the only inaudible signal is one that isn't there.
• Use HTTPS wherever it is available. This will add another layer of encryption onto your data transmissions, making your already nearly-impossible-to-crack signal that much more impossible-to-crack.
• Use a VPN service while on wireless. This will add yet another layer of encryption onto your data transmissions, making your already impossible-to-crack signal require God-like powers to break.

---

With the real issue being addressed, here's the answer to your actual question:

If you want to limit the general-access coverage of your wireless network, there are a few options. Of course, these won't thwart a well-equipped wardriver or dedicated attacker, but they are available.

You can turn down the transmitting power on your AP, and on most wireless adapters in laptops or desktops. Your AP will probably have an option for this somewhere in its management interface, but the availability and location of this will vary between devices. I'm not sure what options are available for Macs or *nix systems, but for Windows you may find the option in the Advanced tab of your network adapter's Properties page in Device Manager, if it exists. Again, this is likely not an option on many other types of client devices, and they'll just continue to send much of your really valuable data (usernames, passwords, uploaded documents, etc.) as far as they're designed and/or configured to scream.

If your AP has detachable antennae, try removing them and see how that works. Surprisingly enough, a wireless AP may still emit and receive just enough signal for very near-proximity operation through just its bare connectors. Still, this is likely not an option for your client devices, so they'll just continue to send much of the really valuable data (usernames, passwords, uploaded documents, etc.) as far as they're designed and/or configured to scream.

If your AP has detachable antennae, you may find some useful directional antennae that will help. These can keep the signal pointed in only the direction you want it to go, if that is something that will work well in your environment. However, these also will likely cause the range of your AP to over-shoot the distance you want to cover in that direction. And still, this is likely not an option for your client devices, so they'll just continue to send much of the really valuable data (usernames, passwords, uploaded documents, etc.) in all directions.

If your AP has detachable antennae, and the lowest power setting isn't quiet enough for you, try adding a signal attenuator to it. Still, this is likely not an option for your client devices, so they'll just continue to send much of the really valuable data (usernames, passwords, uploaded documents, etc.) as far as they're designed and/or configured to scream.

---

TL;DR:

Limiting the reach of your wireless network to one room is nearly impossible to actually accomplish, since many wireless devices (especially clients) lack the option to attenuate their signals and most transmit omni-directionally. Further, it is of very little value since hackers commonly have specialized equipment that will easily pick up weak signals. You'll likely do more harm to the usability of your wireless network, than you will do actual good.

Instead, you should focus on using real security measures such as WPA2-AES, strong passwords and PSKs, MAC address filtering, securing your APs management interface, turning off devices not in use, and using VPN. If you're still worried about your signal leakage after that, you should avoid it by using a wired network.

If you're absolutely determined to reduce your wireless network's range, there are still a few options. Most APs, and laptop/desktop wireless adapters give you the ability to turn down their transmit power. Directional antennae, or use of no antennae at all can help limit your AP's coverage area. Signal attenuation hardware for APs and some laptop/desktop network adapters are also available. Still, any equipment on your network that cannot make use of these options will continue to send their transmissions far and wide.

Answer 2

This is a good idea because WEP is very broken and WPA/WPA2 PSK is sort of broken. In Pre-Shared Key (PSK) mode with WPA or WPA2 the shared secret key is generated using the SSID and a "password". The cowpatty attack is a precomputed rainbow table of common passwords and common SSID's. The list of SSID's was obtained by large war driving databases. If you choose a strange SSID then its not going to be on the free 33gb rainbowtable. If your SSID is not in the rainowtable, then the attacker will not have the advantage of precomputation and will have to mount a fresh brute force attack.

Intel was working on a secuirty system to artificially limit the range of WiFi for secuirty reasons. A low-tech version of this is just to lower the transmit power of the AP. Another suggestion is to place the AP in your basement. The most of the signal will go up into the house, and it will be difficult to obtain line of sight from outside.