I know a little bit about network security but it's only about enough to know there's a lot I don't know. My requirement is to add a 2nd wifi to my current setup (1 wifi emitted by a 1-physical-wifi-radio OpenWRT router; and a bunch of computers connected to the wifi) and to prevent users of the 2nd wifi from accessing my router config page and any services running on any of my own devices (e.g., non-Internet-visible file shares and servers).

My current security measures are iptables rules that prevent 2nd-wifi-user access to my original network based on source IPs or source interfaces. My fear is that these may not be sufficient.

(option 1: ip-based filtering)
iptables -I FORWARD -s $GUEST_SUBNET -d $HOME_SUBNET -j REJECT

(option 2: interface-based filtering)
iptables -I FORWARD -i $GUEST_INTERFACE -d $HOME_SUBNET -j REJECT

I don't know much about spoofing but it seems to me that if a 2nd-wifi-user "doctored" his requests to the router configuration page (that sits within $HOME_SUBNET) as being from a source IP within $HOME_SUBNET, he could access and interact with the configuration page since he'd be able to sniff all of the traffic to the fake source IP address and construct sensible responses. Right?

  1. If I'm wrong, and my iptables rules are in fact sufficient, could someone please explain why a spoof is not possible given my rules and reasoning.

  2. Otherwise, does the encryption on my home wifi play a role in this? For instance, if my home wifi was WEP/WPA2/802.1x-encrypted, then would the response to the fake $HOME_SUBNET source IP be encrypted as well and thus be unreadable to my guests (thereby effectively securing my home network from my guests)? This seems sensible...

Thanks!

PS: this question follows from a recent question of mine and the responses I received for it.

EDIT: Just to be clear, my home wifi and guest wifi are emitted by the same router.

up vote 1 down vote accepted

This is not possible. The configuration interface of a router is running HTTP, which uses TCP at layer 4. For TCP connection to be succesful to start talking HTTP at layer 7, you would need to have the following handshake:

enter image description here

The problem with IP spoofing in regards to TCP is that this is not possible. With just IP filtering you will be able to send the first SYN past the firewall, but your router will respond to the person having the actual IP with SYN-ACK, meaning you will never be able to send ACK. This means there is no handshake possible and thus you will not be able to talk HTTP to your router.

  • thanks for the answer! i'm aware of TCP handshakes but wouldn't it be possible for the guest to sniff the SYN-ACK and thus be able to send a proper ACK? – rmanna Jan 18 '14 at 8:52
  • How would you sniff the syn-ack packet? – Lucas Kauffman Jan 18 '14 at 9:13
  • I mean you are supposed to be on a different wireless network for which you do not have the password. I suppose that those two networks are interconnected using a physical cable. Why would your router A expose a SYN-ACK packet to router B if the destinary IP is on router A? – Lucas Kauffman Jan 18 '14 at 9:18
  • What I don't understand is why you are even routing between your two routers. Just don't route. – Lucas Kauffman Jan 18 '14 at 9:19
  • both wifis are emitted by the same router (i guess that might not have been clear, i'll edit my question). that means 2nd-wifi clients can sniff traffic for the 1st wifi right? – rmanna Jan 18 '14 at 9:27

Your Answer

 

By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.

Not the answer you're looking for? Browse other questions tagged or ask your own question.