Timeline for Why don’t routers request permission when attempting to connect to an unknown address? (Or why do they still assume every connection is trustworthy?)
Current License: CC BY-SA 4.0
15 events
| when toggle format | what | by | license | comment | |
|---|---|---|---|---|---|
| Jun 9, 2022 at 13:35 | comment | added | M. Y. Zuo | Nevermind, apparently chatrooms are auto-deleted now after 1 month. Thankfully someone was kind enough to reopen it temporarily so that I could save it. | |
| Jun 9, 2022 at 13:06 | comment | added | M. Y. Zuo | @SteffenUllrich It seems like the chatroom with our extensive conversation has disappeared. How do we get it back? | |
| May 8, 2022 at 18:37 | comment | added | Steffen Ullrich | Let us continue this discussion in chat. | |
| May 8, 2022 at 18:05 | comment | added | M. Y. Zuo | @SteffenUllrich The bit flip example is one of many ways a router could behave unexpectedly. Unless a direct link is established between client(s) and upstream devices how could any upstream devices, including firewalls, know if they truly received 100% correct information? And vice versa. Unless you mean installing a firewall on both sides, or do some sort of dynamic checksumming, handshakes, etc., between firewall and router? (Comment edited ) | |
| May 8, 2022 at 15:06 | comment | added | Steffen Ullrich | @M.Y.Zuo: I think you are mixing up things here. A firewall is not a thing which protects a router against bit flips. ECC memory, packet checksum etc do this instead. And a firewall appliance is similar to a router in path of the network traffic, in fact firewall appliances usually contain router functionality (but are not restricted to router functionality). | |
| May 8, 2022 at 13:27 | comment | added | M. Y. Zuo | @SteffenUllrich I’m not quite sure I understand how a firewall protects a router from doing erroneous or malformed routing, such as a bit flip in memory causing a client’s packets to be sent to the wrong address? The client never directly communicates with the upstream firewall(s) independent of the router, so if data is corrupted along the way how would such firewall(s) ‘know’ what should be correct? | |
| May 8, 2022 at 5:14 | comment | added | Steffen Ullrich | @M.Y.Zuo: Routers just route traffic - it is in their name. They are not security devices. You probably mix this up with firewalls, which also sit in the path of the traffic (like routers) but make security decisions which packets should pass or not. The terms are kind of blurry though since SoHo routers often contain rudimentary firewall functionality. With real firewalls the security decisions are usually way more complex than simply blocking specific IP addresses. And even firewalls don't simply ask the client like you propose, since the approach is infeasible in practice as I explained. | |
| May 8, 2022 at 1:03 | comment | added | M. Y. Zuo | Routers should protect itself and everything downstream of it, from upstream devices, intranet, internet, etc,, and perhaps vice versa too (modem, etc.) for enterprise setups. At least that’s from what I understand of the ‘ideal’ network topology. In that sense since it’s possible for router firmware itself to be corrupted, or for malicious actors to spoof the router manufacturer’s identity, it certainly could be useful to have access control even for router initiated connections. | |
| May 7, 2022 at 19:05 | comment | added | Steffen Ullrich | @M.Y.Zuo: I think you have to differ between actions initiated by some client/device on the network which is passed through by the router, and actions initiated by the router. The context of your question seems to be about the first, i.e. protecting devices/clients by not allowing access to certain IP addresses. If your question is about connections initiated by the router - these should be in full control of the router manufacturer because only its software is running on the router. Giving user control over these connections which are essential for the router would not make much sense. | |
| May 7, 2022 at 18:45 | comment | added | M. Y. Zuo | @MechMk1 Routers certainly do connect to things. I know of at least one router manufacturer that sends over the air updates. | |
| May 7, 2022 at 13:05 | comment | added | user163495 | @M.Y.Zuo As explained in the answer: Routers don't "connect" to anything. Their job is to take what they receive and forward ot to where it has to go. As the answer explains: It's the client making the connection, and thus the burden is on the client to decide who to connect to. | |
| May 7, 2022 at 3:45 | history | edited | Steffen Ullrich | CC BY-SA 4.0 |
added 307 characters in body
|
| May 7, 2022 at 0:13 | comment | added | user10489 | Why presume you can divide IPs into malicious IPs and benign IPs? What about compromised websites that are not malicious but have malicious content hiding on them? What about CDNs that are just caches for everything and similarly can't be categorized as malicious or benign? There's a small handful of IPs that are worth blacklisting. Everything else is a toss up. | |
| May 6, 2022 at 23:29 | comment | added | M. Y. Zuo | How does leaving the decision up to the client resolve the issue of the router connecting to a malicious address, unless somehow the client’s decisions are automatically propagated to all clients connected to the router or if the router adopts the clients decision itself? In the first case that seems unnecessarily complex, why not just do it once at router? In the second case that would require all the overhead and complexity with just letting the router do it + being tied to one client. | |
| May 6, 2022 at 13:36 | history | answered | Steffen Ullrich | CC BY-SA 4.0 |