Security Begins at the Home Router

https://insights.sei.cmu.edu/sei_blog/2018/07/security-begins-at-the-home-router.html

by BillPollak • 8 years ago

233 172 8 years ago

insights.sei.cmu.edu

Telling that the summary advice is “change the default password”, even if some of the other ideas are deployed user involvement is near zero if not completely zero. I wonder how impactful it would be to roll out a totally read-only router, or if the necessity of updates and maintenance would generate too much headache for the user

noja• 8 years ago

Print the randomly generated password on a sticker on the router. Problem solved.

frockington• 8 years ago

The only con I can think to that is the initial influx of support questions. I have no idea why this is not the default now, its simple, user friendly, and way more secure

Mister_Snuggles• 8 years ago

This is what my ISP does for their router/cable modem combo. There's a sticker that tells you the SSID, the password for the SSID, the URL for the web interface along with the user ID and password. The passwords are both randomly generated.

They will also put it into bridge mode for you where none of that stuff applies.

thomastjeffery• 8 years ago

The problem with that is that they pick awful sets to generate from.

Instead of a string of random letters and numbers, they should be a string of words.

It's frustrating to visit someone's home, and have to enter (on a phone keyboard, no less) some lengthy gibberish that they never bothered to change.

Operyl2• 8 years ago

AT&T and a few others currently deal with this problem by having a random password assigned for the admin user printed on a sticker on the side of their Modem/Router combo boxes. It seems to work pretty well.

paulie_a• 8 years ago

While I do like the idea, att boxes are very low quality and drop wifi connections constantly. I've always installed a ubuqiti router and AP. Apparently it's impossible to disable the firewall on the att box also. I've actually called att and had the conversation: "can you enable some ports". CSR, which ones? Tcp and udp 1-65,535...

SubiculumCode• 8 years ago

imo, it's none of my isp's business what I have on my network and so use my own network equipment.

ryanianian• 8 years ago

Got a new netgear router the other day and it used this. Default admin and default wpa2 key were randomly-generated at the factory and printed on the back of the router. If/when my parents need a new router I'm going to have them get one of these and never have to guide them through the security gui again.

kyrra2• 8 years ago

(I'm a Googler, opinions are my own).

I think this is one of the awesome things about Google Wifi (aka: OnHub). It's fully managed from a phone app (via "the cloud"), so you get the authentication tied to your gmail account. It's also based on ChromeOs (chromebook OS), and follows a similar auto-update that Chromebooks get. So you are always running the latest firmware.

(There are obviously downsides to Google Wifi, my primary issue being that it doesn't have many of the advanced features that something like UniFi has. But for most people, it works well.).

billions• 8 years ago

While your points are valid, it is a bit disconcerting to have the world's largest data monetizer watch all of a home's traffic. Google's promised benevolence may be temporary

h4b4n3r05• 8 years ago

Can you elucidate just _why_ it is necessary for a router to be managed through the cloud?

dsr_3• 8 years ago

It will be particularly awesome on the day that Google's complaints system decides to close your account without recourse.

Not that that has ever happened, of course.

chungy• 8 years ago

Perhaps it's just because I'm not in the target demographic, but this is exactly the reason that Google Wifi is completely out of consideration if I ever need to buy a new router.

Give me local ssh and WebUI. No cloud, no phone apps.

jdlyga• 8 years ago

If only Google Wifi worked with wired connections, I would've considered buying one. I ended up going the Ubiquity route, and couldn't be happier.

amaccuish• 8 years ago

Sorry but cloud is not an option on routers for me. I've had too many from various manufacturers that completely break if there is no internet.

securityn0w4• 8 years ago

I installed Google WiFi for a friend.

I found aggravating that:

- I need a smart phone and install an app to set up and configure the router.

- I also like the effort of simplifying the router configuration but I found it is lacking an "advanced mode"

- why if the Internet is down, the internal network does not work at all?

Fnoord3• 8 years ago

UniFi products also work from the cloud, if you enable that (it is optional) and you're not tied into the system of one of the largest data gatherers in the world.

Microsoft with Windows 10 uses machine learning to figure out when its most convenient for the user to update (latest Insider build has this function). Either way, Windows has come a long way from 9x randomly crashing and every other piece of software requiring a reboot.

bradenb• 8 years ago

The idea of a completely read-only router is really interesting. I used to buy hardware that would only work with open firmware -- I used to love to constantly update and mess with DD-WRT. But in more recent years I've just started buying high-performing hardware and skipping the customization beyond SSID and passwords. With faster connections, UPNP, and decent default QoS policies I pretty much never have to configure my access points or routers anymore. I'm pretty sure the average consumer has no desire to configure anything.

brandonsometig• 8 years ago

UPNP can be an absolute security nightmare however, it's the sole reason so many IP cameras, NAS drives and IOT devices are internet accessible.

It's your network of course but it would be the first thing I'd turn off.

dev_dull• 8 years ago

I don’t know how it’s possible to be read only. It needs to update things like routes and arp tables. That’s exactly the type of stuff that gets poisoned when attacked.

dsr_3• 8 years ago

I don't fear rebooting my router because it takes less than 30 seconds to do a complete cycle; TCP sessions can withstand that.

It probably helps that it runs Debian stable, too, so security updates are frequent and regular.

stamps• 8 years ago

Care to share some more information about your setup?

I'm a PFsense user currently and am always looking for ways to tinkering with my networks.

StudentStuff• 8 years ago

PFSense was the bane of my existence for a time, I regret ever installing it in the handful of businesses I put it in. When it'd fall over (usually from the 2nd WAN port disappearing after a reboot), I'd have to drive out and swap in another router while debugging it. Minor, custom changes to prevent PFSense from blocking boot due to a USB ethernet interface disappearing? Overwritten on upgrade without warning.

They also have recently made it a PITA to use PFSense with IPTV, as UDP Multicast forwarding has been deprecated w/o warning. Like everything with PFSense, it just disappeared one update without so much as a warning :P

I have a friend who uses Debian as his core router, its not bad. I've gone to OpenWRT since its got the fit and finish, plus it will boot and be debugable no matter what happens.

dsr_3• 8 years ago

The most important thing is to go into your BIOS and boot loaders and turn off any delaying options. The second most important thing is to boot from a SATA SSD.

You should be able to tune it from there to get a reboot under 30 seconds.

auslander6• 8 years ago

Try OPNsense. My choice.

stock_toaster• 8 years ago

Take a look at VyOS (a vyatta fork). Pretty slick.

Ubiquiti did their own fork of vyatta for their edgeos offering, I believe.

the8472• 8 years ago

TCP sessions can withstand that.

But connection tracking tables for NAT may not. Plus the ISP might assign a new IP to your CPE on ppp auth.

madeuptempacct• 8 years ago

I don't see how 'security' is a thing when you have anything connected to wireless. If you get access to a router, you get access to everything.

h4b4n3r05• 8 years ago

Just install OPNSense (or its less modern forebear: PFSense). It works great, has a ton of features (e.g. packet filter from FreeBSD, OpenVPN, etc, etc), and it gets security updates. I run mine in a VM, with the WAN adapter passed through to it to make it unavailable to the host.

auslander6• 8 years ago

Second OPNsense. And there are nice fanless x86 mini PCs, router size on aliexpress

h4b4n3r05• 8 years ago

I don't know why technical people bother with anything else these days, TBH. You don't even need a separate server for it: just use a separate network card in an existing machine. And even if one decides to buy a separate machine, it's still much cheaper than a router with comparable capabilities. And the existing router can often be reused as a dumb access point. It's a no-brainer.

auslander6• 8 years ago

check Partaker B5, for example

whyagaindavid• 8 years ago

Router supplied by my ISP has no upgrade option. Just displays info - no updates found. This is from largest ISP in European - telephonica

ateesdalejr2• 8 years ago

How are default passwords handled by your ISP? Printed on a sticker on the side?

arminiusreturns2• 8 years ago

I mostly blame cable and docsis for this state of things, on top of the router manufacturers. Which is why I am happy to hear of increasing fiber rollouts.

Docsis gives the ISP the ability to control the router, but they are very bad at it and even if they aren't it's often the manufacturers who are the problem. So I always have bought my own cable modems instead of renting from the ISP. The last time I did this I went with a good Motorola, but come to find out arris has bought them out, I did some scans, notice it's vulnerable and needs and update, so I go to the arris website. Can't find the update anywhere. End up calling them and get told, even though I own the equipment, they only release updates to ISPs or "partners" and no I can't have it! Wtf!?

Docsis, even 3, is a shitty spec that needs to die.

So really the best thing you can do and what I suggest to people is to put the cable modem in bridge/passthrough mode after checking all settings, and then hit your own router.

Except most people, as the article states, just go get some crappy linksys (cisco owned), netgear, Asus, belkin, etc, which have their own set of problems. It's better with openwrt/ddwrt/tomato but there is a better way.

My favorite setup is thus:

ISP Router in passthrough

Ubiquiti edgerouter

Ubiquiti APs

nasredin• 8 years ago

Can you download hosts lists, block ads and serve 1*1 pixel image instead of ads with your EdgeRouter?

arminiusreturns2• 8 years ago

Absolutely, it's just a slightly modified vyos. (Edgeos)

armitron• 8 years ago

The way I do things, is to treat the cable modem as already compromised and connect it to a router 100% under my control (running Linux) that will perform additional firewalling and/or act as a wireless AP. I will never let a border device have any sort of direct access into my internal network.

There is no point in spending lots of time & effort trying to secure half-baked half-open devices that are not under my full control. I will do what I can [or what I'm allowed to do by the usually severely restricted configuration modem panel] but I know the game, there, is already lost. Moreover, the ISP can remotely administer the cable modem and flash anything to it.

A second perimeter that is based on infrastructure I fully configure/control/administer is where I still have a chance.

vetinari• 8 years ago

There's a worrying trend (I'm looking especially at you, UPC), where the ISP insists that the CPE device must be in router mode, and not in bridge mode. The UPC's current excuse is, that their devices come preconfigured for DS-Lite and that most customers would be unable to configure their own routers for that.

Together with the fact, that you are getting a single /64, it means that you cannot place another router behind their router.

(And for IPv4 part of the DS-Lite, no, they don't support PCP).

0xfeba2• 8 years ago

I agree with Steven Gibson. The biggest defense we can have on this is autoupdating routers. At a minimum, just restart at some fixed time after an update is downloaded. More fancy would be dynamically calculating a low usage day and time to restart.

But this would also involve the router manufacturer keeping it up-to-date as well.

Which gets me thinking... Does a SOHO (or any) device exist that effectively runs two firmware instances at once to allow minimal downtime as it switches over to new firmware? I imagine larger routers do, or at least, two identical physical routers accomplishes as much.

Yizahi2• 8 years ago

You will probably need more complex hardware to accommodate this and it will be much more complex to implement correctly. For SOHO it is better to simply optimize for quicker boot process. For homes it doesn't even matter, just reboot the thing automatically on schedule during night. My expensive router does this and it is not hard or expensive to implement in all new models, regardless of their price.

j454• 8 years ago

Solid firmwares like OpenWRT run on a lot of routers already.

It should be possible to have some amount of regular updates, if not automatic.

wtallis13• 8 years ago

Does a SOHO (or any) device exist that effectively runs two firmware instances at once to allow minimal downtime as it switches over to new firmware?

There are plenty of routers that have two OS partitions so that a new version can be installed without interrupting the currently-running version, but you still need a full reboot to switch to running the new OS.

inetknght2• 8 years ago

If you start making my router autoupdate and autoreboot like Windows does you will alienate a very large number of customers.

Instead: stop making shit routers.

Yizahi2• 8 years ago

Unlike with Windows I seriously doubt that. Windows reboot is unpredictable and a) can break your work flow and b) can possible corrupt your unsaved data, calculations etc.

Router reboot is simply a network outage for 2-3 minutes and routers that can do auto-update also always support configuration it. E.g. Reboot at 3am in the night, only on Monday and only if there had been new firmware in the last week. I can assure you that it is neither disrupting nor noticeable at all. Router boots neither break work flows nor corrupt your data (in SOHO segment).

0xfeba2• 8 years ago

It could and likely would be configurable. The problem is the people who plug the router in with the default password and forget about it.

This would solve that while leaving it configurable for technical users.

bubblethink3• 8 years ago

.. Does a SOHO (or any) device exist that effectively runs two firmware instances at once to allow minimal downtime as it switches over to new firmware? I imagine larger routers do, or at least, two identical physical routers accomplishes as much.

Quite likely that google-wifi (chromeos) does, or at least is capabale of doing that given good enough hardware. All of google's products have moved to this sort of A/B layout.

firefistace77• 8 years ago

I'll take this opportunity to ask the community, what is a recommend router?

It's going to be me and my roommate only (with friends and family over) and I would like to get something secure and also reliable (and preferably on the cheaper side)

Any suggestions? I believe we have Cox if that is any factor....

ronnier• 8 years ago

I use one is the ASUS ones and like it. But from my understanding is that security wise, all consumer routers are bad. I have nothing to back up that claim with. I keep mine as updated as possible.

HankB992• 8 years ago

I have an Asus router too. (RT-AC68W - W => white) It used to provide my security and as near as I can tell it did a reasonably good job of it. Things that lead me to believe it rates as above average: - Does not enable management on the WAN port by default. - Reasonably frequent updates - Not named as often as some other brands when security problems are publicized. - I think it made me enter a management password when I first set it up, but it's been a while and I can't be certain about that. OTOH I just searched "RT-AC68W security problems" and there seems to be no shortage of problems. :(

Some time ago I decided to get a little more serious about security and put a mini-PC running pfsense between my home LAN and the Internet. Hopefully that is more secure though a similar search wouldn't prove that. Perusing some of the critical vulnerabilities at cvedetails.com seems to show that the only critical vulnerability for either of these is for versions of the software older than what I'm running. And I also see the flashing yellow "!" on the Asus management page that indicates an update is available.

That latter part is really a concern. I don't get a notification for an update unless I go look for it. Logging to either is not something I do every day.

Osmium2• 8 years ago

In particular, recommendations for consumer routers would be welcome. Last time this came up, the line seemed to be "consumer routers are trash, if you want security you have to use an enterprise router." There might be some truth in this, but it isn't helpful. Surely not all consumer routers are equally bad?

zrm2• 8 years ago

So there are two main issues with consumer routers. The first is that the hardware is garbage. This isn't universally true, but it's a strong general rule, and models get released and discontinued all the time so the short list of models that aren't garbage changes every year.

The main security issue is that the vendors stop issuing security updates after they stop selling the router even though people are still using it, and the software that comes on it is usually crap to begin with. The solution to this is to get one you can install OpenWRT or Debian or whatever you prefer on it, do that as soon as you buy it and then it doesn't matter what the vendor does. But note that not all routers are supported by the software you want to use.

Also remember that a router is just a computer with multiple network ports on it. Adding another network port to your old laptop is a time-honored tradition. The hardware will be faster, the drivers are usually better, it has a built-in battery to survive power bumps, etc.

izacus4• 8 years ago

I've found the ASUS RT-AC series to be pretty good (both 56U and 66U can route my gigabit internet connection and provide about 400Mbit worth of wifi). But for a bit more you can get a Ubiquiti router + AP for an even better experience.

auslander6• 8 years ago

consumer routers are trash, if you want security you have to use an enterprise router

These are trash too, full of closed code with backdoors. Buying small x86 mini PC and flashing it with OPNsense will take an hour. You get open source with GUI on FreeBSD, bulletproof.

justaj• 8 years ago

Albeit a bit expensive, Turris Omnia is fully open source down to schematics level. It's also pretty beefy with dual-core ARM CPU at 1.6 GHz and 1 GB DDR3.

Its documentation is however a bit lacking unfortunately.

pimeys• 8 years ago

Been running a home network with over ten devices and a fast internet connection with an Omnia Turris for almost two years now. It gets regular updates automatically, is fast and the UI is nice. Fixing things like bufferbloat was easy with the community instructions.

Oh and it's openwrt under the hood, with lxc containers for things such as grafana.

agentx3r• 8 years ago

Ubiquiti makes great prosumer stuff, if you're willing to pay ~$120 for the 'router', and then another ~$100 for the wireless access point. That's not 'cheap', but it's about on par what you'd pay for a fancy consumer router that looks like a spaceship.

You'll get a great interface, frequent firmware updates with new features and security fixes, and you'll have a good strong signal at your neighbour's house if you're going for a visit.

ipython6• 8 years ago

You can get the EdgeRouter X for ~$50 and that will scale to symmetric gigabit connections, if your needs are simple (ie. you're just doing basic routing & firewalling, not trying to do traffic shaping, etc). Budget AP option then is a UAP-AC-Lite which you can buy off Amazon for ~$80, bringing your total to $130 all said and done.

That's cheaper than most all-in-one routers, and while you won't get the best single-client bandwidth, you will get much better management/configuration options.

mc32• 8 years ago

How do you like the netgate pfSenses in comparison?

wyldfire2• 8 years ago

Can I use Ubiquiti devices with some kind of slave or WDS mode with my ISP's wifi AP/router?

I just want to extend the range without monkeying with the existing router or running cables. Ideally configuring the slaves to use the existing SSID/WPS config if that's possible.

I don't care (much) about the impact to latency or throughput, it seems like there's excess capacity now.

EDIT: downvoters please join the discussion, seems like an innocuous question to me.

vvanders• 8 years ago

Another +1 for Ubiquiti. Had a bunch of high end prosumer stuff, ddwrt/tomato, etc. It really is fantastic stuff at least on part with ddwrt and well matched hardware to boot.

Their cloud management stuff is solid(and free with spare PC!) which is great if you help your family set anything up.

Ars did a great deep-dive a whole back[1], it's a pretty good read.

[1] https://arstechnica.com/information-technology/2018/07/enter...

nextos• 8 years ago

I'm using a Compulab Fitlet 2 (a really nice and cheap fanless Intel machine with multiple Ethernet ports designed for Linux) and NixOS.

It's easy to set up and run multiple services (think XMPP, ssh, IP over DNS...).

mattnewton• 8 years ago

I used to use Apple routers. They were pricey but reliable and very easy to configure, especially from inside the apple ecosystem. Now? I have no idea what I’ll upgrade to when the time comes.

rb808• 8 years ago

I have always used consumer routers and they worked great. I finally got persuaded by the "consumer routers are garbage" attitude and bought an Ubiquiti edgerouter and instantly regretted it. Yes I can now do very complex configurations and control lots of things I couldn't before. But I really dont want to do that and I can't notice the difference in performance so it was a bit of a waste.

My guess the if you get a wireless router, wifi signal strength is most important part, aside from that any mainstream router is probably OK.

wtallis13• 8 years ago

and I can't notice the difference in performance so it was a bit of a waste.

That's because Ubiquiti Edgerouters and APs use the same processors and radios as consumer routers. If there's any truth to the memes about hardware quality, then the differences lie in things like the power supplies. Most of the perceived improvement in stability that Ubiquiti Edgerouters offer comes from having software that is actively maintained and not stuck on decade-old software branches. You can get all the same software benefits (more, really) by running OpenWRT on consumer hardware.

legulere• 8 years ago

AVM Fritz!box

philipri• 8 years ago

I'm actually pretty happy with my Netgear Velop mesh system. I had a Netgear Nighthawk X8, but when I moved it was great for the new house. The Velop mesh has been seamless.

notriddle• 8 years ago

Do Synology routers count as consumer?

ebikelaw2• 8 years ago

I've had my Google OnHub for three years now and it works flawlessly, regularly updating itself without any detectable downtime. It is by far the longest that I've had any wifi access point, and it is the only one I haven't had to personally check and update for security issues.

wmf• 8 years ago

Since this thread is about security: Google WiFi. It has secure boot and it auto-updates (although there seem to be few updates released lately).

auslander6• 8 years ago

Device from Ad company with access to all your traffic? No, thanks.

milcron• 8 years ago

This is quite possibly overkill, but I'm pleased with this setup at home:

    Cost | Purpose        | What
    $109 | Router         | PCEngines apu2c2 http://pcengines.ch/apu2c2.htm
     $10 | Router Case    | http://pcengines.ch/case1d2blku.htm
     $17 | Router Storage | http://pcengines.ch/msata16g.htm
     $30 | Gigabit Switch | https://www.amazon.com/D-Link-Gigabit-Unmanaged-Desktop-DGS-108/dp/B000BCC0LO/
     $80 | Wifi           | Ubiquiti Unifi Lite https://www.amazon.com/Ubiquiti-Unifi-Ap-AC-Lite-UAPACLITEUS/dp/B015PR20GY/

With this setup, the router only does _routing_, so you also need a Wireless Access Point (WAP). Connect it like so: Modem->Router->Switch->WAP.

Install pfSense on the router, configure the Unifi using Ubiquiti's Java app, and you're done. It's about $250 all together which _is_ more expensive than consumer routers, but IMHO it's worth the superior quality. The APU board is well-documented (PCEngines provides schematics!) and the firmware is based on Coreboot. The processor supports AES acceleration for faster encryption (great if you use VPNs!) PfSense is an enterprise-grade router/firewall with scads of graphs and features. And the Unifi has a great antenna with excellent range. Not to mention this setup leaves you with six spare ethernet ports on the switch.

kqr• 8 years ago

I did something slightly different: I was donated various low-power, low-noise PC parts from a friend, one of which was a motherboard with two ethernet ports. Chucked FreeBSD on it, configured one port as WAN and the other LAN, connected LAN to cheap-ish switch and from there also to wifi bridge.

Never had a better setup.

It blows any consumer router I've used out of the water in terms of stability, performance, flexibility, security, and user experience.

Getting emails for potential security issues, custom DNS domain for local network, fail2ban bruteforce prevention, QoS, alerting when WAN goes down, and so on, has all been a breeze to set up.

fghtr• 8 years ago

I would recommend an FSF-certified ThinkPenguin router that respects your freedom:

https://www.fsf.org/resources/hw/endorsement/thinkpenguin

CommanderData2• 8 years ago

I'd like explore making a small ecosystem of open security plugins built on top of OpenWrt.

The goal is to make firewalling and controlling network traffic really easy.

The UI should be so easy a parent could perform difficult tasks such as limiting an iot devices traffic to local net or maybe just one ip using just an app.

Or detecting unusual patterns of traffic from a device or IP addresses.

The apis exist I can't think of many barriers to entry.

neospice• 8 years ago

It seems obvious that this should be developed, but to take it a step further it would be great if consumers could purchase something that gave them access to these plugins without needing to know how to setup OpenWRT. This will be challenging because most ISPs provide the router and firmware for the majority of their customers.

CommanderData2• 8 years ago

I would personally love to see the same, and a way of unifying experiences across all open firmwares such as ddwrt.

Another is to limit a device to communicate to a specific country. Easy enough however a possible performance issue.

wtallis13• 8 years ago

ISPs will have to start requiring the OEMs to offer some form of ongoing software maintenance, rather than just the rare bug fix on a distribution that otherwise dates to when the SoC inside first taped out. I can't imagine the OEMs or the SoC vendors being willing to do that kind of maintenance in-house, but the large ISPs certainly have enough leverage to require upstream support in OpenWRT.

ObsoleteNerd• 8 years ago

Where the ISP forces use of their modem (like mine does), you can still set it up as a gateway and make it a pure modem, using a second router for your local network.

It's what I've done for years and it works fine. I have a Pi-hole off my ISP modem, and the Pi-hole does DHCP, DNS, VPN, and more for our network at the same time as doing it's normal filtering job.

I'd love a better device where my Pi-hole is though, which I can configure easier, set up for my friends and family then they can manage it themselves, etc. There's definitely a market for this at least from me!

corndoge• 8 years ago

I think the problem is that it already is really easy. I feel like it'd be hard to simplify the interface of something like UniFi's AP series and still keep the number of knobs it gives you. And you almost certainly will never simplify it to the point that people will stop making youtube bandicam free edition tutorials on how to port forward your minecraft server.

Fnoord3• 8 years ago

The UniFi range is very easy. The Edge series (such as EdgeMAX) is slightly less easy, but also more powerful.

Easy and secure are not always a good match though. Take UPnP for example. Disabled by default on my ER-L, it can be enabled, but its ultimately insecure. And ultimately, HTTP over SSL could download payloads.

NickBusey2• 8 years ago

It sure sounds like you are describing Turris OS. https://project.turris.cz/en/software

securityn0w4• 8 years ago

Why did not they add the features to OpenWrt trying to make it better? Almost all the forks of OpenWrt die in months. Some lasted only few years. I am afraid that it is a wasted effort.

flukus3• 8 years ago

The biggest barrier to entry I've found with this stuff is the hardware, I can't walk into a store and buy something with OpenWrt pre installed and for various reasons online isn't a a good option. I've looked at various possibilities and the whole scene is a mess similar to phone ROMs where you have to trawl through random forums, pull down random ROMs, trawl through more forums to find out why x doesn't work in $country with $ISP.

It's impenetrable to anyone that doesn't want to invest months into the scene and develop expertise in it. Much like phones we really need a PC equivalent in this space.

wtallis13• 8 years ago

I've looked at various possibilities and the whole scene is a mess similar to phone ROMs where you have to trawl through random forums, pull down random ROMs, trawl through more forums to find out why x doesn't work in $country with $ISP.

That's describing pretty much all the alternative firmware distributions, except OpenWRT, which is actually well-organized and delivers real stable releases. If you're digging through forums to find forks and builds made by some anonymous individual, it's almost certainly because you got fooled into buying hardware that requires closed-source drivers. (Or else you bought something that is just too new and not yet supported by OpenWRT.)

EGreg• 8 years ago

We would like to build a captive portal using OpenWRT, to implement social networks running on a LAN. Anyone who is interested in this kind of stuff and has some experience, please contact me at greg+captive @ at @ qbix.com

Covzire• 8 years ago

For the average consumer / prosumer, The best I've found are Asus routers. I have a 3-4 year old Asus that still gets regular security updates.

If you want to go deeper, get any cheap NUC or system with 2 NICs, install OpenBSD and configure it as a firewall / router.

OldSchoolJohnny2• 8 years ago

I would have said that too based on our RT-AC68U right up until I read this post and thought "time to update that router" and when I did so, for the first time in many updates I was presented with a license agreement allowing ASUS to send basically every bit of data to a 3rd party (Trend Micro) for features I didn't ask for. I should have captured it but the data they described was basically every bit of data you can imagine not wanting to share with a 3rd party. I had to agree to get into the router management portal and at least they had a way to withdraw that agreement (which also turns off those features).

I can't believe ASUS even considered this idea in this era of privacy concerns but I'm definitely going to research that before I buy another router.

713233eb• 8 years ago

Is this the case with Merlin's firmware too or just the OEM FW?

auslander6• 8 years ago

Install OPNsense on small x86 mini PC, problem solved.

walrus012• 8 years ago

The best advice I can offer for people who know what they are doing (eg: HN readers), for their homes and home offices, is to separate the functions of modem, router and wifi.

Have a DOCSIS3 / DOCSIS3.1 modem that is a dumb L2 bridge. TP-Link makes decent ones that are compatible with Comcast. You can find them and their reviews on Amazon.

Use something like a Ubiquiti ER-X (Edgerouter X) for your WAN-to-LAN interface and NAT. The Ubiquiti EdgeOS is developed by a team of people they hired away from vyattta when vyatta was sold to Brocade. It's a fork of Vyatta with a decent UI on top of it, and full SSH access. Which is of course based on Debian.

Have no wifi functions in your router!!!

And then something like a set of ubiquiti UAP-AC-LITE or UAP-AC-PRO access point(s), as needed. You can set up the ubiquiti unifi controller inside of a debian VM in virtualbox. The controller does not need to run persistently , just once to provision the APs, if you're doing basic WPA2-presharedkey authentication for your home. Bring up the VM again in the future on your laptop if you need to make changes.

This is a pretty low budget but highly effective solution ($65 cablemodem + $48 router + $78 wifi AP).

If you prefer Mikrotik to ubnt, there are a lot of small, similarly sized things you could replace the ER-X with that are in the $45 to $80 price range that will perform similarly.

wtallis13• 8 years ago

Have no wifi functions in your router!!!

Separating the ISP-controlled modem from the router is certainly good advice, but I can't see any strong reason to recommend separating the AP from the router. If you know your AP needs to be located far from the router in order to provide decent coverage, then it makes sense. Otherwise, there's no technological or economic justification for putting three exclamation marks on that point. You just make your setup a lot more complicated (a whole extra VM for the admin tools?!)

walrus012• 8 years ago

The Venn diagram overlap of routers that have serious admin features and routers that have wifi built in is not very large. Separating the wifi allows you to replace or change wifi without bringing down services to local hardwired home servers.

dimkr1• 8 years ago

Raising the security bar of routers is indeed a priority of many ISPs, organizations and consumers. But IMHO, securing the router isn't enough, because once you close the huge security and privacy hole created by vulnerable and outdated home routers, IoT devices like IP cameras will take the router's place as the weakest link in terms of a home network's security, so the problem of malware targeting embedded devices with no security software is still there. (Also, if any guest who connects to a WiFi network can guess admin:admin or admin:12345678 and infect IoT devices, NAT is not enough to provide a reasonable level of security in many home networks. In addition, having open-source firmware or reputable open-source components is not enough to assert that a certain device is secure by design, because most home routers run outdated and vulnerable versions of Linux/uClibc/whatever, often with network stack patches and proprietary drivers from the SoC manufacturer's BSP that make it impossible to upgrade to recent, stable versions of everything; this also applies to the router manufacturers that fork OpenWRT and don't pull changes. Moreover, completely separate from the question of how to develop security updates, the problem of testing and deploying them in time on customer premises, without user intervention, still remains and detracts from the ISP's motivation to provide security: it's very expensive). A copy-paste-based software development lifecycle, unsafe C code, the cost of built-in security and the risks & costs of deploying updates in scale are here to stay for the foreseeable future. A more radical solution is needed to protect today's devices against today's and future threats: that's why in https://www.securingsam.com, we're putting a security-as-a-service umbrella on the existing, consumer-grade router which hardens and protects the router and all devices connected to it using DPI, traffic anomaly detection, auto-updated (independently of the router firmware) vulnerability mitigation patches and much much more.

fulafel• 8 years ago

Cynical take on the situation from a consumer POV: Keeping your ISP-provided CPE box but viewing it as the bug-ridden vulnerability christmastree that it is keeps you from lulling yourself into the "secure internal network" fallacy, while maybe keeping the liability on the ISP side.

Security Begins at the Home Router

Related Stories