3

Today most of the home WIFI/Routers are vulnerable from a security perspective, with various backdoors, UPnP issuses and more.

What should I look for when I as a home user want to get a secure solution at decent price?

Do I need to look for enterprise products or should I go for any hardware supporting OpenWrt?

|improve this question|||||
  • 1
    Enterprise routers are no less vulnerable than commercial routers. If you're looking for security, look for a router that updates its firmware on a regular basis. I prefer OpenWRT, because I'm of the opinion that the more eyes that can go over the source code the better it is for security. – RoraΖ Sep 4 '14 at 11:28
  • 4
    A few easy security tips that work even for home routers: 1. avoid WEP like the plague (I believe all routers you purchase nowadays support WPA2) 2. turn WPS off. – IQAndreas Sep 4 '14 at 11:37
  • Another of my concerns is that ISPs usually have admin access and can push updates. Given that the security that most DSL routers is not great, it's a matter of time before an attacker finds a way to infect routers and inject their own malware. – HocusPocus Sep 4 '14 at 13:07
1

How about PFsense on a PCEngines Alix or APU router? Wifi won't be more secure, as it's the protocol, but pfsense can monitor your network I believe. This is on my list as well, just haven't found the time to do this.

http://www.pcengines.ch/order1.php?c=2

|improve this answer|||||
1

  1. Look for routers that provide the level of control that you require for your environment (how detailed can you get when defining firewall rules, etc.)

  2. Look for routers that are updated frequently. Apple routers update frequently, as does WRT firmware options.

You buy a router for defined security (#1) and you want to prevent backdoors and vulns (#2)

|improve this answer|||||
0

Generally most people don't care for the hard- and software they use. They don't update it and sometimes even try to justify this practice with a wrong interpretation of "if it ain't broke, don't fix it". For such people, its good to have ISPs that patch and monitor the routers. Of course, their motivation varies, and is often near zero, but for most end-users its equals zero. Unlike end-users, ISPs can get bad reputation by the press if they don't patch.

If your technical skills and motivation exceed the average end-users, you can flash your own firmware onto the router. Routers have a general-purpose CPU built in: if you program it to be only managed by you, its only managed by you. With OpenWRT, you can take your security into your own hands.

|improve this answer|||||
0

The first thing to do is make sure that you don't use or get a router provided by the ISP you are getting service through. Many of them have locked configuration options (I have seen xfinity, u-verse, quest, and roadrunner wireless routers come with preconfigured WEP security options and some of those couldn't be changed).

If you're looking at a new router the things I look for are:

Once I have the router I go through these steps:

  • Whether or not you have OpenWRT on your device make sure to:
    • Change the Admin password and username (if possible)
    • Turn off web interfaces
    • Turn off WPS
    • Turn off web UPnP (and if you don't use it in your local network turn it off too)
  • Finally using WPA2 if possible and if not possible use WPA in AES. TKIP does have attacks against it.
|improve this answer|||||

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.