Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

I've heard a lot about securing a network from the inside-out, assuming that people will have access no matter what. Obviously some simple measures can be put in place to deter casual passers-by, but if someone really wants in, can they be stopped?

Assuming no, what can be done (with hardware or software) to protect the system from abuse once someone has access to the router? Can I protect my Windows machine, for example, from someone while still being able to access the internet and my shared files?

share|improve this question
add comment

3 Answers

up vote 2 down vote accepted

This is a really big topic with a tremendous number of levels. The easiest / simplest solution is to use a VPN or SSL tunnel to encrypt traffic going over wifi (regardless of wep/wpa). The easiest way I can think of to do that is to use the free putty terminal client to set up an SSH tunnel/proxy to some system connected to the internet via a land-line (e.g. a linux machine connected to your router via ethernet).

Beyond that there are many other things you can / should do, such as using vlans or DMZs to keep a boundary between your LAN and your Wireless-LAN, and other common sense security measures such as ensuring all your systems are protected by user accounts with strong passwords, etc.

share|improve this answer
add comment

You have to assume if someone wants in enough, they will get in - not just to wireless networks. So taking that as read, what is different about wireless networks?

They broadcast, so you must encrypt everything. Currently WPA2 is considered up to the job, but so was WPA and before that WEP. Attacks move on, and each 'good enough' solution is broken eventually. For a home solution WPA with TKIP could well be fine, but for a more sensitive environment, you may want to use a VPN on top of the WLAN - the same way you would if extending a LAN across the Internet; it gives you encryption between the endpoints.

The other issue you will find is on availability - a wireless network can be jammed very easily, so a DOS is a real possibility; it can even happen by accident if something nearby generates RF signal in the right band. So if you want a robust solution, wireless may not be up to the job.

share|improve this answer
add comment

This is why you need to practice Defense in Depth security. Secure the access point(s) as best you can. Secure the inter-connecting components (bridges and routers) if you have them. Lock down PCs with firewalls, update software, educate yourself and other people using your home network. Use secure protocols. Use encryption, even between systems on your internal network. Secure your software as best you can, for example use Firefox extensions such as NoScript (many, if not most browser exploits are actually javascript exploits, and almost all 'drive-by' downloads are).

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.