Linksys setup

Hey guys, just got my cable internet connection back, but this time with a Linksys wireless router, any tips, knowledge, anything that can help me secure it?

When using wireless anything, always use encryption. I don't know how to do it in Windows, but it should be in the connection properties dialog box or something. You don't need NSA grade encryption, but at least enough to ward off the casual wardriver. (WiFi hacker.)

Linksys supports WEP. I'd go ahead and configure that at a minimum. Also, a good idea would be to use a personal firewall in addition to the Linksys device. Black Ice and Zone Alarm are both supported by the vendor.

--TH13

and MAC filter the wireless connections..... Everything you can do to make it harder is good...

Set the AP to not broadcast your SSID as well........(90% sure that linksys APs support that option.)


*EDIT Come on people, why would a "Senior" Member Neg this? It was to the point and relevent to the topic. What is with AO sometimes...

... and don't forget to check their support page for firmware updates.

And change the default password to access the router's config.

l00p

Linksys does support the ability to not broadcast the SSID, and thats a definite in something to do. WEP is a definite as well.

I personally do not feel its necessary to have a personal firewall on a machine that is already behind a NAT router, but to each there own. THe only reason I would use a firewall type program when I am behind NAT, is for detecing virii or trojans that you get through mail from getting out to the internet.

wep is easily broken with any kind of *nix box i would tell you to firewall any boxes you put behind this router also i would say that you should proboly set up a trusted mac address list this will keep anybody who is not seriously interested out and deter most wardrivers due to the time it takes to change mac adresses, then break wep then go through the firewall..........not really worth it

Here are the things that I do to secure my linksys router:

1) Use WEP

2) Change the default SSID

3) Turn off SSID broadcasting

4) Change the IP address of your router. By default it is 192.168.1.1. If you change it to something like 192.168.1.50, an attacker may not be able to guess your gateway address.

4) Do not use DHCP. Instead manually enter the proper DNS/Gateway/IP Information on all of your systems. This will prevent someone from connecting to your system and automatically getting an IP address.

5) Use the advanced security features to only allow the IPs that you have given to your machines access to get out of the router. What this will do is prevent a hacker from being able to sniff your SSID and then randomly assign a valid IP. They will get access to your network, but they will not be able to access the internet from your router. You will need to make the IPs of your systems very similiar, like 192.168.1.150, 192.168.1.151. You can then easily deny access to all IPs lower than 150 and higher than 151. Get it?

6) If you are using Win2k or XP, use the IP security policies to restrict access to all 192.168.x.x IP's except for those that you have given to other systems on your network, and 192.168.1.1(or the IP of your router). What this will do, is even if somebody gets onto your network, your machines will not accept any packets from their IP. Also, given that 192.186.x.x IP's are unroutable, no internet IPs will be in the 192.168 range.

7) If you are really paranoid. You can configure IPsec to always encrypt data travelling between systems on your home network. This would provide a higher level of encryption than WEP.

edit- I totally forgot to mention MAC filtering. You would want to make sure that you use the MAC address filtering functionality of your WAP.

Mnchur: Yes WEP is easily broken...... but the rider on that is they have to capture between 30 and 50 million packets first...... On a busy company netwirk that wouldn't take more than a few hours..... Bit on a home network they guy is going to have to be pretty determined 'cos he'll be coming back for weeks in order to capture enough packets..... There are easier targets out there......

yes that is true that you have to have alot of packets to break wep but it would not be any hassle for say a computer savy next door neighbor to leave his comp on all the time to get the required packets...even worse what if your neighbor little bastard son was to try and show his friends how 37337 he was by breaking into your computer and planting a trojan or something script kiddish like that?

... then if you have your MAC address filter on no issues. Ok, he took the time to break the WEP encryption on the neighbor's computer (looser.) Now the router won't assign him an address because his MAC address isn't registered.

Assuming you're intended snooper has a WAN card, he/she probably also has a wireless router. Do some counter-ops. Snach his/her packets, and see if your IP address is appearing anywhere in their network traffic. This is always a two-way street. If so, walk next door and put a stop to the nonsense.

but stop there. Let's all play nice.

l00p

Infinite: MAC address filtering simply makes it harder not impossible. MAC address filtering can be "beaten" in two ways:-

1. Capture the packets with Airsnort to determine the valid MAC addresses. Wait till the valid addresses are offline and spoof the MAC address of your card.... Your on.

2. As above but there are programs out there that will send 802.11b disconnects out to a given station. So we send these instructions to the "going to be spoofed" machine. WHile it is going through it's disconnect/rescan/reconnect routine you send your spoofed packets out and get your replies. Your on......

They will both work..... As usual though hacking a WAP is a product of the amount of time you are willing to spend compared tot he benefit you will reap. For a home user the basics will be enough to keep the wardrivers and casual "crackers" out of the picture.