How to protect your lan with a home wireless router?

Question

I have a wireless router at home, and I've configured it to not be acessible from outside my LAN.

Is this enough to give me protection against external attacks in my LAN? How do I monitor opened/forwarded ports to avoid security issues in a home environment?

Answer 1

The short answer to your first question is "no". So long as the router is switched on it is a source of potential problems, whether from misconfiguration or some inherent vulnerability in the router itself.

In practical terms however, so long as you have locked it down properly your router is very secure and provides excellent protection for your network.

Here are a few things you might consider implementing (if you haven't already):

• Disable UPNP. It's a convenience you probably aren't using anyway. If you know you're using it (and it is very handy), just keep in mind that it silently opens the firewall on-demand for any malicious program inside your network.
• Restrict access to the Admin interface to a local, wired connection. Use a strong password.
• Where you have forwarded a port, remember that the router now provides no protection whatsoever and your security depends upon the software listening on that port. Keep it up-to-date, use strong passwords, access control etc.
• If you only need access from, say your office, restrict the port-forward to just packets from the appropriate IP address.
• For wireless, use a strong password and WPA or better encryption. MAC address filtering can make things a bit harder for an attacker too.
• Keep your router firmware up-to-date.

As to the second question, home routers provide little in the way of logging or anything that will give you visibility of the activity on your network. Wireshark or Backtrack can help you out here but for best results put something like Astaro or pfSense between the router and the rest of your network.

To see what your network looks like to the outside world, use ShieldsUP.