Securing Wireless Gateway

[Snakebyte1]

Hi...

I have done the following when setting up my wireless gateway:

1. Changed the default SSID and enabled Hide SSID
2. Enabled MAC address filtering and manually entered the MAC of my connecting client(s)
3. Enabled encryption, manually set the passphrase and enabled Shared authentication
4. Enabled the firewall

Is there any other basic security settings I should be making?

Thanks
D.

[stedyone]

Hi there. I have a netgear wireless gateway and by default NO PORTS are open. I had to go in and manually open a couple ports for gaming and torrent stuff. Then I set up the explicit list where you don't allow any connectivity from other devices EXCEPT for those MACs that you place on the list.

I also generally do not bother with any encryption as that always slows down bandwidth. I also don't use passwords as those are a pain in the a$$ for me to periodically be changing. I like the exception list where I only need to add the MAC address for anyone that I do want to connect to the router.

It's been trouble free for about 3 yrs now.

[Po|arbeaR]

Try to use any encryption that is WEP or better if you equipment can handle it. Also use a strong password for your router login, not just admin/password combo. Block Anonymous Internet Requests should be enabled by default if its not then enable it. This stops your router from being pinged from the internet. The rest of your setup sounds strong.


-PB

[Po|arbeaR]

p.s. don't mean to double post but MAC addresses CAN be spoofed rather easily. Don't just depend MAC addresses for security.

-PB

[Supreme2k]

Yes, they can be spoofed, but you would have to know the MAC address to spoof it in order to get into the router first.

[Jim44]

MAC address are sent "in the clear", so one merely has to sniff the traffic to obtain it.

MAC address filtering may help keep your neighbor from using your WiFi connection, inadvertently or otherwise, but it is by no means a "security measure".

[MOVIEGEEK]

5.Use WPA encryption.
6.Install SP3 for XP.

[MJA]

Hi...

I have done the following when setting up my wireless gateway:

1. Changed the default SSID and enabled Hide SSID
2. Enabled MAC address filtering and manually entered the MAC of my connecting client(s)
3. Enabled encryption, manually set the passphrase and enabled Shared authentication
4. Enabled the firewall

Is there any other basic security settings I should be making?

Thanks
D.

in my case my brother in laws wireless pc/consoles both will not connect if the SSID is hidden ,or the MAC filter is on.
do you have any of these issues ?

[Snakebyte1]

Hi..

Thanks everyone for your replies and comments.

I do have WEP enabled and use a strong passwords and passphrases (letters, numbers and other characters in a non-word) . For the encryption I tried to use a 128bit key but my client would simply not connect even though I set it up with 128bit. The 64bit does work.

I'll check for the Block Anonymous Internet Request settings.

I have no problems connecting with SSID hidden and MAC filtering on. But I did have some issues at first, but what I did was start off with a fully open system and then locked it down one item at a time and verified I had connectivity at each step.

D.

[bevills1]

FYI WPA is much more secure than WEP if your router supports WPA.

[Snakebyte1]

I initially tried to use WPA but couldn't get the client to connect so I reverted to WEP. I'll have to re-visit those settings when I get a chance.

D.

[Nelson37]

If you are going to be paranoid to this degree, and you may have reason to, then you forgot one of the most important elements of a digital security system.

Change all passwords on a regular basis, and especially if any employee or PC leaves the building. Most security leaks are internal in nature.

Encryption and port firewalling is about all that is usually needed.

[SLK001]

1. Changed the default SSID and enabled Hide SSID

Not really effective as a security measure. Anytime you connect to your wireless router, your SSID will uncloak. Anyone who is monitoring your AP will now have your SSID.

2. Enabled MAC address filtering and manually entered the MAC of my connecting client(s)

Also, not really effective as a security measure. Once you connect to your wireless router, anyone monitoring your AP will also now have your MAC address. They will then change their MAC address to mimic your MAC address and your system will be soon compromised.

3. Enabled encryption, manually set the passphrase and enabled Shared authentication

As long as you have enabled WPA or WPA2 encryption, this is usually enough - PROVIDED that you have set a secure passphrase. Do NOT use WEP encryption. It can be cracked in less than two minutes - period.

With a poor selection of a WPA/WPA2 passphrase, it can be cracked within hours.

4. Enabled the firewall

This should be enabled anytime you want to connect to the outside world.

[redwudz]

I might add, if your system is in a highly urban area, the odds of your system being compromised are much higher. Where I'm at in the suburbs there are several routers that show on my laptop that are open. No encryption, nothing. Very easy for anyone to log into.

I use WAP2-P AES. I also have my laptop adapter set to 'Connect even if the network is not broadcasting' along with turning off the SSID broadcast at the router and enabling MAC filtering. And the laptop does lose the connection occasionally. I found it did that even without the security measures in place. But a reboot seems to always fix it.

[MOVIEGEEK]

I initially tried to use WPA but couldn't get the client to connect so I reverted to WEP. I'll have to re-visit those settings when I get a chance.

D.

If you're running XP install SP3 or this patch:
http://www.microsoft.com/downloads/details.aspx?FamilyId=662BB74D-E7C1-48D6-95EE-14592...displaylang=en

[greymalkin]

if you're that worried you might as well just get a 100' lan cable and disable your wireless router .