Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

I have a wireless router at home, and I've configured it to not be acessible from outside my LAN.

Is this enough to give me protection against external attacks in my LAN? How do I monitor opened/forwarded ports to avoid security issues in a home environment?

share|improve this question
    
Do you mean attacks originating from inside your network? –  bitslave Nov 30 '10 at 13:11
    
@bitslave: no, external. I've change my question a little bit. –  Somebody still uses you MS-DOS Nov 30 '10 at 16:51
add comment

2 Answers

up vote 3 down vote accepted

The short answer to your first question is "no". So long as the router is switched on it is a source of potential problems, whether from misconfiguration or some inherent vulnerability in the router itself.

In practical terms however, so long as you have locked it down properly your router is very secure and provides excellent protection for your network.

Here are a few things you might consider implementing (if you haven't already):

  • Disable UPNP. It's a convenience you probably aren't using anyway. If you know you're using it (and it is very handy), just keep in mind that it silently opens the firewall on-demand for any malicious program inside your network.
  • Restrict access to the Admin interface to a local, wired connection. Use a strong password.
  • Where you have forwarded a port, remember that the router now provides no protection whatsoever and your security depends upon the software listening on that port. Keep it up-to-date, use strong passwords, access control etc.
  • If you only need access from, say your office, restrict the port-forward to just packets from the appropriate IP address.
  • For wireless, use a strong password and WPA or better encryption. MAC address filtering can make things a bit harder for an attacker too.
  • Keep your router firmware up-to-date.

As to the second question, home routers provide little in the way of logging or anything that will give you visibility of the activity on your network. Wireshark or Backtrack can help you out here but for best results put something like Astaro or pfSense between the router and the rest of your network.

To see what your network looks like to the outside world, use ShieldsUP.

share|improve this answer
    
I like UPNP, I enable it when I install new software that needs ports open, then after the software has configured the ports, I disable it in the router, the ports remain configured but UPNP is off. I suggest WPA2 with a strong key. –  Moab Dec 1 '10 at 2:15
add comment

Try this :)

http://www.hackerwatch.org/probe

Using your public ip (even if dynamic)

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.