This site focuses on the security of routers. Period. If you are interested in faster WiFi, look elsewhere. The site covers configuration changes to make a router more secure, and, picking a router that is more secure out of the box.
Why devote an entire site to router security?
I used to be like you. That is, I would buy a router, it would work fine and I would ignore it for years. However, after some huge router flaws,
affecting millions of routers, caught my attention, I started following
the topic more closely. As a Defensive Computing guy, I eventually realized that I needed to upgrade my
own router security and get more up to speed on the topic. After all, if a router gets infected with malware, or re-configured in a malicious way, most people would
never know. There is no anti-virus software for routers.
I am not alone in pointing out the sad state of router software/firmware.
Router security may be a dull and boring topic, but it's important. For proof, see what can happen if your router gets hacked.
Non-techies can start at the Introduction to Routers page, which discusses what a router is conceptually, then describes
the hardware and the many ways to communicate with a router.
This site has NO ADS. If you see ads, either your browser, computer or router is infected with adware.
I spoke on Securing a Home Router at the
HOPE conference in July 2014. This website grew out of that presentation. It's a work in progress.
A PDF of the presentation is available
at box.net (last updated Oct. 4, 2014). Audio is available
at x.hope.net (thanks to 2600). An article about the talk appeared in Toms Guide.
I spoke again about Router Security, at the O'Reilly Security Conference on
Nov. 1st, 2017. The talk was very different from the first one. See a PDF of the slides.
Picking a Router
The first step towards a secure router is choosing a router.
Many people use the device given them by their Internet Service Provider (ISP) which I think is a bad idea for a
number of reasons.
The next decision is buying a consumer router or a business class device. Don't buy a consumer router. To bolster this
opinion, see the page on router bugs. It is not an exhaustive list of bugs, but illustrates how the poor state of software on consumer routers.
Which router do I recommend? The Pepwave Surf SOHO router from Peplink. My only
relationship with Peplink is that of a customer.
How secure can a router get? Only as secure as its included features allow. For a list of router security features see my Security Checklist. The most expert person in the world can only make a router as secure as the included features allow.
Buying a used router from a stranger (think eBay) can be dangerous, as the firmware may have been maliciously modified. To protect against that, download new firmware using a different router. If possible, switch the firmware entirely, that is, if it came with stock firmware, try switching to DD-WRT, OpenWRT or anything else. Asus owners can switch from Asus firmware to that offered by Merlin.
Secure Router Configuration - Start With This
- Change the password used to access the router. Anything but the default should be OK, but don't use a word in the dictionary.
- Wi-Fi encryption should be WPA2 with AES and your Wi-Fi password should be at least 14 characters long
- Turn off UPnP and NAT-PMP to protect both yourself and the rest of the Internet.
- Be smart about choosing an SSID (network name)
- Use a password protected Guest Network whenever possible, not just for guests but for IoT devices too.
- Turn off WPS
- Remote Administration is probably off, but verify that it is disabled
- Test Your Router for open ports using some online testers
- Periodically check for new firmware
- Eat your vegetables
Secure Router Configuration - the FULL list
- If the router is new, see my suggestions for setting up a new router. Basic plan: make the most obvious few changes with the router off-line, go online behind another router to get the latest firmware, then make the rest of the changes.
- Change the password used to access the router (this is not a WiFi password). Never use the default router password. Don't use a word in the dictionary. See my router password advice.
- If the router lets you change the userid used to logon to the router, change it
- Selecting a unpopular range of IP Addresses helps prevent many router attacks. And, while you are at it, set up
- If any of your Wi-Fi networks (a router can create more than one) use a default SSID (network name) then change it. Do not pick a name that makes it obvious that the network belongs to you. More...
- There is more to encryption than just choosing WPA2. To begin with use AES, not TKIP. Also, Wi-Fi passwords need to be long enough to stall brute force attacks, my best guess is that 14 characters should be sufficient. And, you really should not use a password anyone has ever used before, ever.
- The Ubiquiti AmpliFi mesh router defaults to using the same password for Wi-Fi and administering the router system. Regardless of the router being used, don't do this; each function should have its own password.
- Change the DNS servers that your router gives out to attached devices. ISP assigned DNS servers are usually the worst option. Change it for these reasons: to use a company that specializes in DNS, to get some extra security via DNS, to have never changing IP addresses, to have an easy to remember IP address. Perhaps the easiest IP address to remember for a DNS server is 126.96.36.199 from Quad 9. Its backup is 188.8.131.52. I also like OpenDNS at 184.108.40.206 and 220.127.116.11. Some companies offer child friendly DNS servers. I am working on a DNS Server page.
- Turn off WPS
- Turning off features you are not using reduces the attack surface. Among features that should probably be disabled are Remote Administration (aka Remote Management, Remote GUI or Web Access from WAN), SNMP, UPnP, NAT-PMP, Telnet, etc. Especially turn off UPnP.
- Speaking of UPnP, insure that Port Forwarding is disabled
- If you need Remote Administration, there are a number of ways to make it more secure. See the Security Checklist page for more.
- Many routers offer Remote Administration via a cloud service rather than the old fashioned way which required directly logging in to the router. If possible turn this off. With it active, you are trusting every employee of the router vendor.
- Guest networks are your best friend. Use them not only for visitors but also for IoT devices. They should be password protected. Guest networks are usually, but not always, isolated from the main network. Review all the configuration options your router offers for the Guest network to insure they are isolated. The Security Checklist page has a list of options you might find.
- Network Isolation/segmentation: Guest networks are merely the appetizer, using VLANs for network isolation is the actual meal. See the VLAN page for more.
- For routers with a web interface, lock down access to the router from the LAN side. The Security Checklist page offers a dozen possible options (see the Local Administration topic). For routers that use a mobile app for administration, think about locking down access to the mobile app. This may require signing out.
- Write down the critical information on a piece of paper and tape it to the router, face down. Include the Wi-Fi network names (SSIDs) and passwords, the router userid/password and the IP address of the router.
- Turn off Ping reply. Sadly, different routers use different terminology for this. To test it, have someone ping your public IP address from outside your network.
- Turn off wireless networks when not in use. Some routers let you schedule this, others have a physical Wi-Fi on/off button, others have a mobile app. In the worst case, you have to login in to the router web interface to disable the Wi-Fi. In that case, a browser bookmark can ease the pain.
- Test if your router supports HNAP. If so, it should be replaced.
- Your modem is a computer too. Your router may be able to block access to the modem from all devices on the LAN. I blogged about this. See part 1 and part 2.
- If your router supports outgoing firewall rules, block the ports used by Windows file sharing. You may also want to prevent any network printers from making any outbound connections. This way if a printer gets hacked, it can't phone home.
- If the router can send email when certain errors occur, configure this feature.
- Try to prevent your router from spying on you. If you own a Netgear router, be aware that they added "analytics" with firmware updates released in April 2017. If you don't want Netgear watching your network, you need to login to the router and disable these analytics. For more on this, see the Bugs page for July 2017. Likewise, Asus and other routers include anti-malware software that may also be watching you. For more on Asus and their partnership with Trend Micro see the Bugs page from May 2017 and look for "Privacy issues with Trend Micro software in Asus routers" Trend Micro software is in other routers too and other anti-virus companies are also partnering with router vendors.
- The Test Your Router page has many ways to kick the tires on your router. One thing to look for is open ports. At Steve Gibson's ShieldsUP! site (click the gray Proceed button), start with the Common Ports test and pay special attention to the SSH (22) and Telnet (23) ports as these services are frequently abused by bad guys. The only good status for any port is Stealth (assuming remote administration is disabled). Next, do the All Service Ports test and finally, do the Instant UPnP Exposure Test (orange button).
- Test your router with my Shodan Query My Router page. It generates a Shodan query for your public IP address (added Feb. 21, 2018)
- The router tests mentioned above are only a partial solution. For the most thorough test, connect the WAN port of a router to be tested (inside router) to a LAN port on another router (outside router). Then, from a computer connected to the outside router, scan of the WAN side of the inside router using NMAP looking for open ports. This lets you test all 65,535 TCP ports and all 65,535 UDP ports.
- Eat your vegetables and exercise too
- When you are all done making configuration changes to a router, it is a good idea to back up the current settings. This way, should you ever have to reset the router, you can easily import/restore the last backed up state. Many routers can export the current settings to a file. However, the mesh routers that I have used can not. With my favorite router, the Pepwave Surf SOHO, settings are backed up with System ->
Configuration and click the Download button.
- Old school, techie-oriented routers have a ton of features. After making the changes above, its probably best to live with the router a while before changing some of the more obscure settings. Once you have a performance baseline, then consider enabling features like the detection and prevention of Denial of Service (DoS) attacks or SYN Flooding attacks. If you do not use a VPN then you might turn off VPN pass-through options. On the other hand, maybe turn on logging and start reviewing the logs.
The best possible over-the-air encryption is offered by WPA2 Enterprise. While all routers support WPA2 encryption, what this really is, is WPA2 Pre-Shared Key (WPA2 PSK). In English, this means there is one password for each SSID. A router using WPA2 PSK that creates three SSIDs will have one password for each SSID. WPA2 Enterprise gives each Wi-Fi user their own userid/password. Support for WPA2 Enterprise is typically found only on business class routers, none of the consumer-focused Mesh Router systems support it. The software used to maintain the list of userids/passwords for each SSID is called RADIUS. In a large organization a router running WPA2 Enterprise might be configured to talk to a RADIUS server on the LAN side that is maintained by the organization. I have used a LAN-resident Synology NAS as a RADIUS server for a Peplink router. The Synology routers are (I think) unique in that they can run a RADIUS server on the router itself. Then too, you can outsource the care and feeding of a RADIUS server.
One reason you might have to re-install the current configuration settings is if someone resets the router. All routers that I have seen come with a pinhole reset. Someone malicious, who can physically touch the router, may simply reset the router to factory defaults as a way to get around the security. To offer the best Wi-Fi performance a router needs to be out in the open which leaves it vulnerable to being reset. A business may try to physically restrict access to the router, but at home, this is probably not viable.
Finally, some thoughts on Apple routers and Google Wifi and OnHub routers and mesh routers in general.
ONGOING CARE and FEEDING and DEFENSE
- If the router does not self-update, then check for new firmware every month or two. Also, register it with the hardware manufacturer on the chance that they notify you of firmware updates. Netgear, for example, has a security newsletter that announces bug fixes. Even if the router does self-update, check every now and then that the self-updating system is actually working. More...
- Every router can display a list of attached devices. Check this every now and then to be sure that you know what every device is. Better routers will let you assign names to each device (Susans iPad, Bobs laptop, Georges iPhone). Check that you are seeing all devices, not just those that are active at the moment or just those using DHCP. Some mobile apps for routers show you information about devices that have recently been on your network, even if they are not currently using it. If you have more than one SSID (you should) a good router will show you which SSID each wireless device is connected to. The Surf SOHO does this.
- A common attack against routers is to change the DNS servers. You need to know what the DNS servers should be (discussed above). Many websites report the currently used DNS servers. For example, www.perfect-privacy.com/dns-leaktest. Pick one or two and get in the habit of checking that your DNS servers have not changed. Consider making one of these sites your web browser home page to insure that you check it periodically. Yes, it is possible for a computer to be manually configured with DNS servers of its own and ignore the ones in the router. This would be a good thing to do on a laptop that you travel with and use on public Wi-Fi networks. It can insure you use known, trusted DNS servers. On the other hand, Peplink routers can force all attached devices to use the DNS servers in the router, even when the clients are configured to use other DSN servers. So, its complicated.
- If the router has any logging facilities, check the logs every now and then.
For other Router Security opinions, I maintain a list of articles. Many stink, the good ones are noted in bold.