Internal LAN questions...

Hello , pretty soon In my house i was considering setting up a WLAN.. But there are some security issues i am concerned about with the wireless router.. The internal policies use NAT i know that and i have done some research on this subject.. But how possible would it be for someone to drive by and get a signal off of my router and have internet access ? Maybe i have this confused with a WAP.. Please excuse me if i have confused the two because I am just entering the wireless realm.. And another question , would i have to setup a dhcp server on one host to assign internal ip's to my network ? Someone clear my head about the things i would have to do for a successful WLAN...

Wap and Wlan are two different things, allow though it is very possible to drive by and get access!

I suppose a good start would be to use encryption and disallow un-encrypted connections.

If you have few computers a STATIC ip address can easily be assigned and you can bypass the use of DHCP. This should also allow you to setup ip level firewalling so you can drop ip address you havn't assigned.

I hope you find this of some use

To secure your wireless..........turn OFF broadcast SSID.
(if you are NOT broadcasting.........they can't find you)

Change the SSID to something other than the factory default.
Enable 64 bit encryption and assign a difficult password

We have multiple sites with Wireless.........None of them have any problems with war drivers.

If you disable Broadcasting the SSID, it's still sent in the frames of other wireless devices on the network. An attacker could use a packet-sniffer and capture those frames, thus reading your SSID that wasn't broadcasted.

Instead of 64-bit, if you have the equipment to handle 128-bit then use that, if not then 64-bit will do.

Everything everyone else suggested will help you as well.

Take a look at this article for some more suggestions.

Securing WLANs

hope i helped.

laters.

Just set about securing my wireless network yesterday after finding out that the OSS drivers for the D-Link 520+ cards (for *nix) did not offer any WEP in Ad-Hoc mode - our initial setup.

So I splashed out on a D-Link 900+ Access Point for the remote end ... very easy to set up (browser interface) and now the network has 128bit WEP and also offers MAC filtering as another level of security.

Not perfect but far, far better than what it was.

You can also look into IPSec but unfortunately over the distance of our link, the overheads on this would punish the connection a little too much.

what about allowing only certain MAC addr to connect to the AP.

I read the article tekno linked to and there is no mention of the MAC addr restricting. I did that for someone wireless network together with some of the other things in the article. Will this restricting of the mAC addr help.

From the article ....

Quote:

---

You can configure the firewall to enable access from legitimate users based on MAC addresses, which makes it difficult (but not impossible) for a hacker to mimic. In fact, you can also incorporate MAC address filtering using most enterprise-grade wireless LAN access points.

---

MAC address spoofing is possible I believe .. but it just adds another string to the security bow over and above WEP as I see it .... at the end of the day if someone is determined enough to get in they will (given their level of expertise) ... as my network is only a home wireless LAN I feel my setup will keep out the casual war-driver from stealing the bandwidth .....

Its a bit like home security .... leave a door unlocked and the opportunist crook will walk in .... confronted with a locked door and an alarm, there is a good chance the opportunist will move onto an easier target.

There are a few authentication /securing your wireless environment.

One of the them is called MAC filtering, where only the MAC address that is specified on your WLAN access point will be allowed to connect to your WLAN.
Below are a few extras.
2) Do not broadcast SSID
3) USe WEP encryption
4) Use AAA server

However to be really, honest, all this security features can be bypassed by an security guru. WLAN technology is at is infancy stage, therefore, security is also quite weak. For instance even if you use MAC restriction, is someone can sniff your packets, there can assign a softmac address to their machine and access your WLAN

Quote:

---

Originally posted here by ericc
........ However to be really, honest, all this security features can be bypassed by an security guru. WLAN technology is at is infancy stage, therefore, security is also quite weak. For instance even if you use MAC restriction, is someone can sniff your packets, there can assign a softmac address to their machine and access your WLAN

---

very true.

and like Phat_Penguin said....if they want to get in, they will, but at least if you secure your WLAN properly, those casual war-drivers will move on to an easier target.

People actually drive around trying to eat into your wireless networks for bandwith around peoples houses and such? Or is it just coperations?

Drive around .... hang the expense .... check out this group of wireless enthusiasts in my State .... these guys didn't drive around they flew !!!!

War Storming Oz Style

My wireless connection was born out of necessity ... I couldn't get a high speed connection due to telecommunication restrictions etc etc .... so I have wireless'd to my sisters house in the next suburb and we share the DSL connection. We have been running it for about 4 months now and even though we were unknowingly exposed to the world we didn't have any problems, just lucky I guess ... not many people in the area knew what that upside down satellite dish on my roof was for :)

I did freak a bit when I found out we were not even WEP'd .... so thats where the AP came into play as I said above - went from an Ad-Hoc arrangment to a Managed network.

Wireless networking is fun - its a challenge and part of learning something new.

Like others have said, you cannot secure a WLAN against a knowledgable wardriver, however, you can raise the hassle factor so that a casual one will slip past.

The first 3 MANDATORY steps are:

Turn off SSID broadcasting.
Change default SSID.
Enable MAC filtering.

However, these will not stop someone with even a modicum of WLAN experience from attaching to your AP. Still, even if they do attach, your real concern should be the security of your data. That's where WEP is supposed to come in. Enable it, by all means, but also be aware that even 128 bit encryp is breakable. But with all 4 of these measures what you have going for you is that the hassle factor is such that most (95%) of the wardrivers will pass on by and go find an easier target.

A final comment, if your router supports logging, have it email you that file regularly. This is no guarantee either, but it can usually tip you off to attempts.

Todd