How much secure is LAN. If the LAN is connected to the internet through router. Will the hacker able to cross router and get to the LAN?
Printable View
How much secure is LAN. If the LAN is connected to the internet through router. Will the hacker able to cross router and get to the LAN?
Yes, he will since is the objetive of a router. Routers arent defensive devices; instead they are there to assure that the correct traffic will flow from node to node.
But the "router" that you are talking about is a simple router or has more features?
that all depends on what type of router we are talking about here. if you are running a cisco and actually understand how to configure it, then yes, you will be pretty secure. if you are talking a basic linksys router, then there really is not too much protection going on right out of the box. alot of those routers do not have a firewall exactly, but are just running nat (network address translation). while this will keep most of your unwanted or malicious packets from reaching the amchines on your lan, it is not a full-prooof method of protection. it is usually better to spend the extra buck and buy the router with built in firewall capabilities. you can then configure it as tight as you want to. beware of some routers and their dmz. make sure to not let any address in there that you want protected because those will be wide open.
Hey Hey,
You asked a very open question... that leaves a lot to be answered. However you recieved two responses, while trying to help, one was nothing other than a link... and the other wasn't necessarily correct information.
What type of router are you asking about? A home router (dlink, linksys... ) or a real router (cisco, nortel... ). Many home routers come with simple built in firewalls, others require a port to be forwarded because they use NAT. While NAT isn't an end all to security, it does provide you with some inbound security. The attacker knows your IP Address (however he is only seeing the router). The only way the Linksys Router will forward an incoming request to an internal computer is if you have port forwarding enabled, otherwise the request needs to have originated on your network. Example: You sent an http request for www.antionline.com, you get back the response because the router knows which internal PC made the request. Alternatively, if someone infects you with the netbus server and attempts to connect to your IP, even though the port is listening on your PC, they will never access the server. The router doesn't know which NAT'ed PC to send the request on to. However, if you go into the router and configure portforwarding to forward the port associated with the netbus server to your PC... then the client will connect and have control. If you have one of those routers and you aren't forwarding any ports, than the simple answer is no... a hacker (cracker?) cannot cross the router and get to the LAN... simply because the router doesn't provide those capabilities. However, if you setup a DMZ, or forward many ports, you are in a completely different ball game.
Now when you get into high end routers... real routers as I like to call them (cisco.. nortel... etc).... You have a basic firewall.. their new IPS (See phishphreeks thread for more info), and of course ACLs. These provide security to your PCs behind the router. However the same basic rules apply. If you have a DMZ or many forwarded ports, then yes those are accessible on the net.
With both types of routers you can open up an interface on the wan port (be it telnet or http).. if someone were to gain access to these, then they could forward their own ports, put the PCs of their choice in the DMZ, do as they please.
You would have to provide more information on your setup, or a setup you have in mind, before you could be given a more definate answer.
Peace,
HT
[Edit]
Looks like I was beat to the punch.... no more phone calls while typing replies.
[/Edit]
like VanEck said, it all depends. If you have a firewall router and a good ruleset, then your LAN will be fairly well protected. However, this doesn't mean that you should just forego software firewalls, AV's and trojan scanners though. Every added layer of protection helps in the long run.
If you just use a simple router, the router (like VanEck said) will block incoming packets from any source that you did not initially establish a connection with(NAT). This is great protection, unless of course, you establish a connection with a site that has malicious embedded code or a download that contains a virus/trojan. Since you established that connection, the router will allow those malcious packets back into your LAN. Kind of like inviting your psychotic neighbor over for dinner.
If you have a firewall router, now you have an extra layer of packet filtering/inspection. With a good ruleset, the firewalled router will allow packets from a connection you established(NAT) and that passes your pre-defined rulesets. Kind of like inviting your psychotic neighbor over for dinner escorted by the police.
Now add a software firewall to the mix on each computer within the LAN (coupled with a firewall router). Now, even if a malicious packet manages to skip past your pre-defined ruleset on your firewalled router, you still have yet another layer of protection that the software firewall offers, packet filtering/stateful inspection and an additional set of pre-defined rules. Kind of like inviting your psychotic neighbor over for dinner, escorted by the police, several pitbulls, and a small infantry division.
Anyways, I'm rambling on and on. I know it's a fairly simplistic breakdown but, I hope this helps answer your question on some level.
You can also check out
http://computer.howstuffworks.com/router1.htm
**note - looks like I was also beat to the punch HTRegz, by several car lengths..:D, oh well. that's what I get for taking 10 minutes to type a post.
Thanks for the information. I am using zoom 5560 . It says it comes with both firewall and NAT but It doesn't seems to be good router i think. As son as I enable NAT from the router software internet connection is down, I then disabled NAT to connect the net.
Beside this I have p2p network setup of few computers to hub( behind the router) since router has only 1 port. Beside this I have zonealarm in each computer, Where I have put all my computers IP in trusted zone. Even the router IP (should I exclude the router IP).
After all this I am wondering If I need anti virus , I am not very fond of warez and i have stopped using kazaa.
What do you reckon?
I like the netopia r910. a few steps above a linksys. A snap to set up tho, and Im very happy with its performance. (linksys would lock up when I got enough traffic to my webservers) A pretty good firewall/Router package.
Allways install a good AV. A virus can come in many disguises including an email from a friend.Quote:
Originally posted here by rajunpl
After all this I am wondering If I need anti virus , I am not very fond of warez and i have stopped using kazaa.
I connect to the internet via my linksys wireless router with 128 bit encryption, set list of trusted MAC addresses, and before information passes from the router to my computer I have Kerio Personal firewall. If I turn the firewall off and went to grc.com and had the port scan done, I still show a lot of ports stealthed. Therefore I count my router as a firewall. Also I like the option of port forwarding to non-existing IPs so that port can never be compromised or connected to (I think its 113).
Edit: I believe you should always run an antivirus, I have gotten a few in the past from Kazaa Lite and other websites, but since then I have changed my security policies for myself.
I don't recommend kerio firewall. It is not clever firewall. I was using kerio with win XP and 'boom' lot's of spyware when i scan thru adaware and virus too.
So my question was (should I include my router IP in trusted zone?)
rajunpl, Kerio is a very good firewall if its configured correctly. But the free version isn't going to protect you from spyware, adware, or viruses (The full version will a little, if you enable web filtering). You just need to have your security settings in your browser set correctly, and be careful what you download and install. Just a tip.