0

I am looking to setup new internet service with an ISP and would like to purchase my own secure modem and router.

Googling doesn't seem to give me the list of what I'm looking for, are there any router/modem suggestions for someone just looking to preemptively secure his network as much as possible from the get go?

Also, please add or change this list of things that I could use to help with added security:

  • Encrypt with WPA-2 with AES
  • Hide your network name
  • Turn off UPnP (is this easy to do?)
  • Setup a guest network for guests and IOTs
  • Turn off WPS
  • ???
  • 2
    If you really want to go crazy about security, consider disabling WiFi. However, WPA2 is the current standard (WPA3 is coming). Hiding network names is security by obscurity and not a good thing. A more advanced person could easily find your network name. UPnP depends on the modem/router. Most ISP's will lend you a specific router that they can control, monitor and update so you might be out of luck here. – Jeroen Aug 13 at 21:53
  • @Jeroen-ITNerdbox appreciate the info. I'm setting it up for a group of people so wifi is a must. Icic, so hiding it wont prevent someone from finding it but that would also mean someone would have to actively scan for it. I have no idea what UPnP is but will look into it. Also, I know my ISP allows for other modem/routers, just as long as it's compatible – mph85 Aug 13 at 21:57
  • 1
    Hiding the network name doesn't give you any increased security. In fact, it makes everything so much worse. – MechMK1 Aug 14 at 9:11
  • @MechMK1 how so? my thinking is that someone can't hack you unless they find your network and if it's hidden, then someone would have to actively seek it out to do something about it – mph85 Aug 14 at 17:20
  • 1
    @mph85 That's a misconception. It doesn't add any security, and clients who are connected to a hidden network will always broadcast that SSID out, just to see if maybe the hidden network is nearby to connect to. – MechMK1 Aug 14 at 20:52
1
  • Encrypt with WPA-2 with AES: Make sure the router you get has that capability. Most do, since WPA-2 has been around a while.
  • Hide your network name: A setting in the wireless router. Hide "SSID" or similar. Also, most wireless router will have this. Users will have to manually input the SSID however.
  • Turn off UPnP (is this easy to do?): Yes. Another setting in the router. Turn it off. Enabling UPnP is not advised, as you have surmised.
  • Setup a guest network for guests and IOTs: Good idea, make sure wireless router has these capabilities.
  • Turn off WPS: Just make sure WPA-2 is on for each wireless interface. If you select WPA-2/AES as the auth method, that's the only way anyone will be able to connect.
  • ???: If you really are serious about security, put a UTM firewall behind the ISP equipment instead of a router. The SonicWall SOHO 250 Wireless N Base Security VPN Firewall can do what you want plus much more, and is reasonably priced.
1

I'll go through the points you have mentioned, and will add some extra points below as well

WEP? WPA? WPA2?

All of these schemes have flaws, but some more than others. The current best practice is to use WPA2-Enterprise with client certificates for each individual device. This way, even a rogue device will be unable to sniff traffic of other devices.

Of course, the drawback of this is that it adds a lot of complexity to configure, and not all consumer devices support WPA2-Enterprise.

Another good bet is using WPA2-PSK (Pre-Shared Key), which is what is usually referred to as just "WPA2". The security of this system is a bit more limited, and suffers from a fundamental problem of symmetric encryption, namely that all those who know the key can decrypt messages.

Concretely, this means that a compromised device (or an attacker who gained knowledge of the key through other means) can read the network traffic the same way as if it were unencrypted.

This may sound dramatic, but it's something we have to live with. In order to ensure an attacker can't crack your key by sniffing a handshake and bruteforcing it, you have to make sure your key is long and random, such as MN7s>R]nGAdg&m3vMnw:"4gv. Yes, it'll be a pain in the butt to enter it on a Nintendo Switch, but at least you only have to do it once.

As far as AES vs. TKIP go - if your particular access point allows you to configure that - always go for AES. TKIP is flawed and should not be used.

Should you hide the network name?

No, it doesn't add any extra security. It doesn't "hide" your network as it is often portrayed, it only masks the name. The network still broadcasts its existance.

Furthermore, any client that knows the SSID will continuously broadcast the SSID. If you ever looked at a the client list of airodump-ng and wondered why sometimes you can see names of people's home network - this is why.

Finally, it doesn't prevent any attacks. None.

What about UPnP?

Disable it. Most routers have an option to disable it, and if yours doesn't, demand a replacement or install a replacement firmware.

Should I set up a guest network?

Most likely not. The security of most guest networks is terrible. They are designed to be open networks, with a login page shimmed in to "authenticate" people. Since they are open, and those login pages never use HTTPS because of certificate issues, an attacker can simply listen for someone connecting and then use their login data. Or spoof their MAC - in most cases that works too.

You could, theoretically, have a guest network that is secured by WPA2-PSK and have a login page, which makes it somewhat better. In that case, it may be something you can consider.

As far as IoT devices go, look into VLAN options. DD-WRT, for instance, allows you to create VLANs for various clients. Is it perfect? No, but it at least offers an attempt of segregation.

Should I turn off WPS?

Yes. The S in WPS stands for "Excrement", if you see where I am heading it. It is truely terrible and should never be used.

What else?

Setting up your own device behind hardware provided by your ISP is a good idea. Just make sure that you disable the Wi-Fi in the modem/access point/router-thing that your ISP gave you, and set it to Bridged mode.

Setup a guest network for guests and IOTs Turn off WPS ???

  • Appreciate the response, using a vpn plus tor is a good thing too right? – mph85 Aug 15 at 3:34
  • It has nothing to do with your router or access point. My personal opinion is that, unless you have a strong incentive to use it, the downsides are just too severe. – MechMK1 Aug 15 at 8:50
  • you're saying, using a vpn and tor, while having upsides, the cons outweigh the pros? – mph85 Aug 15 at 13:13
  • @mph85 The upsides to a VPN for a normal consumer are minimal. You can circumvent some country restrictions and, in case your ISP cares which domains you visit (they likely don't), they will just see a VPN connection. The downside is that your wonderful 200 Mbps downstream just turned into a 15 Mbps downstream. – MechMK1 Aug 15 at 14:31
0

Set up three networks:

  • regular
  • IoT
  • guest

IoT is notorious for cheap devices with weak to non-existent security. You don't want a guest to be able to access those. Unless you don't mind someone gaining control of your shutters, lighting or even a microphone-equipped device.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.