2

From the security perspective; how would you advise on setting up a secure computer network at home?

Current state (as-is): Currently, there's only a laptop making Internet (ADSL) connection through a wireless modem provided by an ISP.

To be / target state: Setup a secure network which will be used by a couple of laptops as well as a mini-server accessing Internet. Laptops will be used to connect to the Internet as well as to the mini-server. Mini-server should accept connection over SSH from outside of the home network.

Would appreciate particular advise on what type of gear should be used e.g. router, switch and etc.

Many thanks.

  • I would add iptables rules to the server to restrict the access to local users and the specific remote users – user123456 Oct 30 '16 at 20:05
3

If I were to diagram your network, it sounds like you want everything inside the home to communicate with each other freely, and to be protected by a border firewall. Because your ISP gives you a single IP address to serve the whole house, you'll need the firewall to also perform Network Address Translation (NAT), which virtually all home routers do these days. You need a wireless access point so that your laptops can connect, and you probably want a wired Ethernet cable to connect your mini-server to the router.

This is a simple architecture, and an ordinary home router/firewall should serve you well.

Outside the home, you have wires coming in to an ADSL modem. The ADSL modem is already providing you a wireless access point. From this description, it sounds like the modem is already likely providing all the router/firewall/NAT services you need, and you may not have to buy anything else. That really depends on whether or not you have the admin password and authority to configure your modem, or if your ISP runs it for you.

Assuming you have the authority, all you need to do is learn how to add some "port forwarding" rules to your router, and make a few configuration changes to improve your security.

First, log in to your router. It will help to download the user manual for it, if it wasn't provided by your ISP. If you don't know your router's address, view the network settings on your laptop and look for a "default gateway". It should be a number like 192.168.1.1, 192.168.0.1, or something fairly similar. Open your browser and navigate to http://192.168.1.1 (or whatever your gateway address is). You'll be greeted by the logon page. Type in the admin name and admin password for your router.

You'll probably see a "main setup" page. There are a few things you should look for here. First, you'll want to change the default password. There's no sense in leaving this as a security risk.

Next, you'll need to know the IP address of your mini-server. If you haven't assigned one already, look for the router's DHCP server settings; then look for a way to reserve a specific IP address for your server.

Next, look for a "Port Forwarding" configuration; it could be under a category named something like "Applications and Gaming". It will have a table with at least 4 columns: Internal port, External Port, Protocol, and Internal Address. This is how you will externally SSH into your mini-server from the internet. In both the Internal Port and External Port columns, type the number 22 (the SSH port). For the protocol, select TCP. And for the Internal Address, type the IP address of your mini-server.

I recommend shutting off UPnP support. This will prevent any devices from automatically opening port forwarding holes without your knowledge.

Finally, you'll need to know your home IP address so you can SSH in while you're away from home. Your ISP provides you with an IP address using DHCP, but that's dynamic and can change without warning. Many companies offer "dynamic DNS" services, some offer free or low cost plans that let you piggyback on one of their assigned names so you can create something like alicelebi.dyndns.org. Keeping the address up to date requires software running in your network to update their DNS servers (some home routers have this update feature built-in; again check the manual for your ADSL modem.)

2

When I sketch out your desired network, there are really two obvious options, which depend on how isolated you want the "mini-server" to be from the laptops. There's the easy way:

enter image description here

which has the laptops and the server all linked together with no specific security between them, and a common point that provides connectivity to the Internet (the big, dark cloud looming at the horizon).

In this configuration, all the systems on the local network basically have to trust each other. You can run host-local firewalls (and I recommend that you do, regardless), but if someone is able to compromise the server, they will have largely unfettered access to your LAN. If the server uses a wireless connection, this may also include the ability to put its network card in promiscuous mode to monitor all wireless traffic that the server is able to hear. Depending on your threat model, that might not be good enough.

However, such a setup is doable with just about any home router that does NAT, basic firewalling and port forwarding. Almost any home router on the market will satisfy those criteria. If the ISP-supplied router/modem combination doesn't (it very well might), then get a personal NAT router and switch the ISP-provided one to "bridge" mode, then change all connections to go to the one you just bought instead.

However, there is another alternative, which depending on your needs may work better. Consider this setup instead:

enter image description here

This is slightly more complicated. The server now connects to the ISP-provided router/modem (possibly through a switch) in the same way as another router does. (The "server" here may be a separate router, which in turn connects to the server itself. That would put the firewall duties in a separate box, as opposed to on the server, but either approach can work.) This isolates the server from the laptops. There are a few ways of doing this, depending on whether your ISP is willing to assign you multiple IP addresses or not. If they are, then the easiest is probably to run one incoming cable (uplink) to the ISP-supplied router, then two cables from there (you might need a switch for this), one to the server and another to a simple router of your own. Put the laptops behind the router of your own. This way, traffic from the server will look like traffic from the Internet to the router protecting the laptops, while the laptops can communicate with each other and with the server (assuming you allow such traffic in whatever firewall is protecting the server), and the server can be exposed to the Internet without putting any of the other systems at risk. Physically, that will look similar to this:

enter image description here

The yellow zone router may or may not physically exist; especially if you don't need more than one host in that part of the network, it's perfectly plausible to run that as only a host firewall on the server. In this case, there are three zones: red/gray (untrusted), yellow (partially trusted) and green (fully trusted). Hosts within a zone can communicate relatively freely with each other, but it's easy to configure firewalls specifically to block traffic from less trusted to more trusted parts of the network. If you do this right, they will do so by default.

The upside of the latter approach compared to the simple one at the top of the answer is that it isolates the server. If someone manages to break into the server, they won't have easy access to the other hosts on your LAN, or any of the traffic between the laptops or between a laptop and the Internet. The yellow zone, here, is what is properly known as a network DMZ (demilitarized zone); note that this is substantially different from how many home NAT routers use the term.

For wired networks in particular, by now you can use differently colored cabling to clearly identify which parts of the physical network are trusted and which are not. For wireless, you can use different SSIDs, like HadidAli-Green and HadidAli-Yellow, with different keys; either also ensures that a system doesn't accidentally connect to a part of the network it doesn't belong to.

This isn't dependent on any particular products. You can use any products you like that implement the required functionality which, really, is pretty basic. Virtually any home NAT router will allow you to set up port forwarding, and will block unexpected traffic coming from its "WAN" (Internet) side going to the "LAN" side, while allowing traffic to flow in the opposite direction. About all you are really doing is repurposing the LAN and WAN ports ever so slightly. As long as you don't put one NAT router behind another NAT router, this should have no impact on how the network actually works; running NAT behind NAT is a rather different kettle of fish, and can easily turn a simple configuration into a nightmare.

I think that the only thing I think I'd add to this is to turn off any "ease of use" features such as Universal Plug and Play (UPnP) and WiFi Protected Setup (WPS). Unless you have a specific use case that requires them, in my opinion they have a tendency to open up more security holes than they are worth. Turning them off reduces your attack surface, which in turn makes any attacker's job more difficult.

0

considering the 'dirty cow' exploit recently, and the future linux bugs that are likely to appear, and that router manufacturers probably won't bother to patch, and the fact you are opening incoming ports to the internet, i would recommend setting up a x86 computer to use as a router that can run a full OS, be it arch, debian, centos, whatever you like, so you can set it up to automatically install all new kernel updates, forevermore.

note that to use a x86 computer as a router you will need a dual ethernet - one that connects to your local network, the other to your modem. there is one mini computer available on amazon that i have seen in linux router guides that has dual ethernet, but otherwise you'll need a standard box/tower, though you could go with an mITX size. you then setup a firewall on this router, and configure your routing tables, etc. once you've done this you can then flick a setting on your current router that will disable most of it's features and just run itself as a simple modem, forwarding packets to your x86 computer which is now the router.

as for SSH you want to configure it so that someone cannot login with a password alone - use SSH keys, preferably a password protected key. this is quite a simple thing to learn, and will mean only specific computers that you set up can login to your server over SSH.

  • 2
    please edit this to include proper punctuation - it is very difficult to read – schroeder Oct 30 '16 at 21:07
  • Not all router manufacturers are that bad. I'm sure ASUS will release a patch for the exploit, I know the unofficial wrt-merlin firmware for ASUS routers already has the patch in beta. Finally, 'dirty cow' has been over hyped a little by the media, privilege escalation exploits are quite common across all operation systems and with all of them, you need remote code execution first. – ewanm89 Oct 31 '16 at 22:22
  • well probably, as with android, some manufacturers will be better than others. but lets face it, some manufacturers are careless, and updating a large product line of SoC devices requires alot of work. given the variability of different manufacturers, i wouldn't want to bet a server on a standard router. for similar reasons, i believe that a standard router's update lifespan is many times shorter than an x86 router – infinite-etcetera Nov 1 '16 at 5:09

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.