-1

I’m imagining a system similar to UAC on Windows but implemented at the router level for IP addresses instead. (Or AS numbers, BGP numbers, Port number, etc…)

Naturally this makes router setup slightly more complicated because at least one admin user, or device, will have to be specified and makes usage more of a hassle due to interruptions by the router UAC agent. A sensible whitelist will likely have to come as the default in order for setup to to be easy to use out of the box.

Even so, it seems like a attractive feature for Enterprise customers, security conscious consumers, and even as an optional feature on higher performance routers that already have the necessary performance to implement it. Especially since it needs to be only configured once instead of per device.

Yet, I can’t seem to find any that I can buy right now that offer this kind of security. Which seems odd since it definitely could be a differentiator or a premium feature to charge more for.

Is there something preventing router manufacturer’s from offering this?

Improve this question
4
  • 1
    If I wanted to connect to Google.com would I have to whitelist the connection every time the DNS sends me to a different IP? As it is, on this page alone I can see at least 7 different IP addresses that my web browser tries to connect out to, am I supposed to add every one of them to a whitelist?
    – user
    Commented May 6, 2022 at 13:10
  • @user All IPs that belong to well known companies and services would probably be included in the whitelist out of the box. If Google decided to add new addresses later that could be included in a whitelist update. I imagine the authorization would only be necessary if Google added an address that they forgot to notify everyone about.
    – M. Y. Zuo
    Commented May 6, 2022 at 23:25
  • @user253751 Yes it could be in a separate box, but most routers, especially higher end ones, already come with firewalls and all the necessary computing power. In either case I can't buy an off the shelf solution to accomplish this today.
    – M. Y. Zuo
    Commented May 6, 2022 at 23:27
  • @user253751 Right, so it makes me wonder by no one has slapped on a user friendly UI yet with a notification system, at least as ‘pro’ option. Since the backend is effectively there already in the firmware.
    – M. Y. Zuo
    Commented May 8, 2022 at 0:57

3 Answers 3

Reset to default
1

Why don’t routers request permission when attempting to connect to an unknown address?

Routers don't "connect" to addresses. They just forward packets: it is the client who is initiating the connection and the router will just facilitate that the packets reach the destination given by the client.

Or why they still assume every connection is trustworthy

They don't. In fact, they make no assumptions at all about trust but leave such decisions up to the client which usually has more context to make such decisions.

While there might be some IP addresses that are only used for malicious purposes, most IP addresses are not. For example content delivery networks have zillions of domains on the same IP addresses, some of these might be used for malicious purposes, most not. Thus the more relevant context here would be the domain name, and there are DPI or DNS based approaches which provide filtering on the domain name.

But stupidly asking the user with each new IP address or domain name, if they should proceed, would not scale. First, there are many IP address and domains involved when doing normal browsing - so there would be lots of questions. Then, most users don't have a clue if the target is malicious or not just based on the IP address or domain name. On what information should they decide? They have no useful context.

Improve this answer
13
  • How does leaving the decision up to the client resolve the issue of the router connecting to a malicious address, unless somehow the client’s decisions are automatically propagated to all clients connected to the router or if the router adopts the clients decision itself? In the first case that seems unnecessarily complex, why not just do it once at router? In the second case that would require all the overhead and complexity with just letting the router do it + being tied to one client.
    – M. Y. Zuo
    Commented May 6, 2022 at 23:29
  • 2
    Why presume you can divide IPs into malicious IPs and benign IPs? What about compromised websites that are not malicious but have malicious content hiding on them? What about CDNs that are just caches for everything and similarly can't be categorized as malicious or benign? There's a small handful of IPs that are worth blacklisting. Everything else is a toss up.
    – user10489
    Commented May 7, 2022 at 0:13
  • @M.Y.Zuo As explained in the answer: Routers don't "connect" to anything. Their job is to take what they receive and forward ot to where it has to go. As the answer explains: It's the client making the connection, and thus the burden is on the client to decide who to connect to.
    – user163495
    Commented May 7, 2022 at 13:05
  • @MechMk1 Routers certainly do connect to things. I know of at least one router manufacturer that sends over the air updates.
    – M. Y. Zuo
    Commented May 7, 2022 at 18:45
  • 1
    @M.Y.Zuo: Routers just route traffic - it is in their name. They are not security devices. You probably mix this up with firewalls, which also sit in the path of the traffic (like routers) but make security decisions which packets should pass or not. The terms are kind of blurry though since SoHo routers often contain rudimentary firewall functionality. With real firewalls the security decisions are usually way more complex than simply blocking specific IP addresses. And even firewalls don't simply ask the client like you propose, since the approach is infeasible in practice as I explained.
    – Steffen Ullrich
    Commented May 8, 2022 at 5:14
1

That is because routers are not made for this. Routers are made for routing packets. That is their main function. As said by @Steffen Ullrich, they do not connect to the other site, the PC at your side does that.

It is possible to do some blacklisting of IP addresses on routers. Cisco, for example, has ACLs that allow you to block certain IP addresses in the flow. For example: if the destination of the packet is 11.22.33.44, drop the packet. The capability of these ACLs is limited though; there is a maximum of ACLs depending on the type of router.

If you want to blacklist certain sites, you will need an up-to-date list that is applied to your router, probably on a daily basis. You will need to find a blacklist-provider that provides blacklists that are short enough for your router. And some tooling to do that automatically.

It is not an attractive option for enterprise customers. Enterprises have firewalls and proxies which are more appropriate for filtering access to the Internet.

Improve this answer
1

I’m imagining a system similar to UAC on Windows but implemented at the router level for IP addresses instead. (Or AS numbers, BGP numbers, Port number, etc…)

It wouldn't make us safer, and it would condition users to answer yes to everything, because otherwise stuff doesn't work. Furthermore, sites move around a lot, thanks to CDN's. Heck, they are likely to share networks with untrustworthy sites - due to CDN's.

Do you know if 151.101.0.0/16 is trustworthy? It's a range belonging to a CDN (Fastly).

Such a setup makes sense in some narrow cases, such as IOT networks, where you want your clients to communicate with a very narrow and well defined set of hosts, so it's simple to whitelist the required traffic. For general purpose web browsing, it doesn't make sense due to the workload of keeping it up to date, and the minimal protection offered.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .