Could router be hacked through the incoming internet LAN?

Question

I set up a new router with passwords and mac filters in place but after a few hours I found a "Network Device" with an unknown mac address connecting through LAN. The only LAN that was plugged in was the internet signal line. The venue is a co-work space where many people share the same network resources. Is it possible that their network has been hacked and get into other's router through the internet incoming LAN line?

Thanks

Answer 1

The router you have is a standard consumer home wifi router, so its default configuration should be safe to use, as long as you change the password to manage the router, and do not enable any unsafe practices like remote management etc.

First, be sure that the upstream device you are getting Internet through is connected to the Yellow "Internet" plug on the back of the device. This will ensure that folks upstream from you are outside the network your router is defining.

Home routers use a technology called NAT, that works with your firewall, to allow you to request resources from the Internet, without allowing people on the Internet access to your LAN. Be careful about technologies like Port Forwarding (sometimes called virtual services) and DMZ (De-Militarized Zone), as those instruct NAT to let some unsolicited inbound traffic through.

Be sure to change your routers administrator password, and use a long/strong password to replace it.

Make sure people can't physically access the router. None of these protections (except the password change) will do anything at all if someone can just jack into the LAN.

Other than that, its about as good as you are going to get it. These devices won't stand up to serious scrutiny (nation-state level actors for instance) but will defeat the average adversary.

Answer 2

I set up a new router with passwords and mac filters in place but after a few hours I found a "Network Device" with an unknown mac address connecting through LAN. The only LAN that was plugged in was the internet signal line.

Hopefully your "internet signal line" was plugged into the "Internet" port on your router. This is not part of your LAN. If you connected your Internet-facing cable into a LAN port you did it wrong.

If you have nothing plugged into the LAN ports on your router, it sounds like you have wireless computers using the router.

The way most home routers work, computers on the wireless LAN and wired LAN appear to be coming from the same place (simply, the "LAN"). Your router may use the same terminology to refer to wireless and wired connections.

• Some routers have a feature to allow access to management pages through the Internet. You should look in the settings and disable this.

• The password you use to access your router's settings should be a strong password. More than 8 characters, include upper and lower case characters, and some punctuation marks.

• Make sure your Wifi password is a strong password. More than 8 characters, include upper and lower case characters, and some punctuation marks.

• Make sure your wireless security type is set to WPA2. Do not use WPA or WEP.

• If your router has a guest network capability, disable it if you don't need it. It's possible MAC filtering may not apply to the guest network, but whatever software you are using the monitor is still reporting unknown MAC addresses.

To answer your question - yes, it is possible if you have the router's management page visible on the Internet for someone to attempt to log in and take control of your router, especially if you did not change the password from the default.