• We’re currently investigating an issue related to the forum theme and styling that is impacting page layout and visual formatting. The problem has been identified, and we are actively working on a resolution. There is no impact to user data or functionality, this is strictly a front-end display issue. We’ll post an update once the fix has been deployed. Thanks for your patience while we get this sorted.

OT - I secured my LAN, here is how

M

MoFunk

Diamond Member
(This does pertain to my seti crunchers and my queue) 😉
Just wanted to share a little what I did to help secure my LAN with wireless.

I have been concerned with security ever since I brought my IPAQ with wireless home! I took a walk around my block and found at least 15 access points, most of those WIDE open! I was even able to log into some of the routers with the default password. I felt somewhat secure knowing that I have my wireless router locked down with WEP. Well I started reading about that and found that WEP can be broken with the right tools. So I decided on a cat5 run to the living room to get that PC off the wireless. But I still wanted wireless access for my laptop and PDA, as well as for my friends that come over with their laptops and such. So here is what I did.

I built a smoothwall system from an old 200mhz PC I had. If you do not know about it you can read up on it here http://smoothwall.org/ In this system I have 3 network cards. One is ?RED? and this is where my DSL line goes. There is a ?GREEN? and the other is ?ORANGE?. So here is how it works. ?Red? is the ?war zone? so you can get to that from ?orange? or ?green? but that is it. If you hack into the smoothwall, you can?t see beyond that. The ?Orange? is for web servers. It has no DHCP or DNS and because it is accessible to the outside world, you can?t get to ?green? from the ?orange? So the ?green? is my LAN. So the ?green? is VERY safe from the outside world. Nice thing is I can freely access ?orange? from ?green? but not the other way unless I open DMZ pinholes and why would I want to do that.

But what of my wireless? I can?t have that on ?green?, which would counteract what I am doing, so I put my netgear wireless router on the orange network. The netgear hands out IP and DNS info for the wireless and allows internet access. The best part is that in order for the wireless to work I need to run a wire from the ?orange? NIC to a switch or hub, and from the switch or hub I run a wire to the web server and then use the uplink to the internet port of the router. The reason I say this is the best part is because unless I run another wire from the hub to a port on the router, the wireless can?t see my web server at all. Not by name, IP or DYNDNS info! I had to run a wire to configure the router, but once I was done I unplugged it.

So with all of this I am felling pretty darn confident that my LAN is safe. I do not have anything important on the web server so even if someone does hack in they wont find anything. Plus I have a software firewall on that as well so nothing gets out without my permission.

So if you are like me and wanted to be as secure as you possibly can at home, look into a smoothwall system, or something similar, you won?t regret it!

I have a diagram of all this here. http://thewoodfamily.us/lan/lan.htm


 
Woah, new version of Visio (cool graphics) That's pretty similar to what I ended up doing when I brought home a Linksys WAP/Router box. Only difference is that I went for Astaro instead of Smoothwall (which had been protecting my network for a good two years by then.) I'll have to crack open visio and map out my network too now that you have inspired me. =)

Edit: Quick and dirty network map.

There are a total of four subnets on that map, one for the area where the workstation is, another for the area right before it, another for the dmz where the mail server is, and another for the WAP. I would have had the WAP on a 2nd DMZ coming straight off the linux box, but unfortunately the free license for astaro only allows 3 network interfaces. That, and the machine only has three PCI slots. One thing I found about astaro that I had wished Smoothwall had was more complex routing/traffic redirection. For example, since my ISP blocks port 25, theres really no point in me allowing any apps to go outbound to other servers for outgoing email. So i set up Astaro to take all port 25 traffic and send it to the mail server in the DMZ. Works well for things like motherboard monitor which don't make it easy to connect on alternative ports for sending out email notifications.
 
One thing most people don't realize about wireless is that a laptop that has wireless capability can be "captured" and function as an access point. So if you don't have a wireless LAN, but have your wireless capable laptop connected to a WIRED LAN, you still have a security hole.

The interesting thing about that is if the laptop is logged on to the network, and they get in through the "card" access point, they are totally in to your network.

To plug that hole, it's best if you remove the wireless card from the laptop, as just disabling it may not actually shutdown the card (ie it still get's power).
 
Originally posted by: RaySun2Be
One thing most people don't realize about wireless is that a laptop that has wireless capability can be "captured" and function as an access point. So if you don't have a wireless LAN, but have your wireless capable laptop connected to a WIRED LAN, you still have a security hole.

To plug that hole, it's best if you remove the wireless card from the laptop, as just disabling it may not actually shutdown the card.
Click to expand...


Thanks Dennis, I never knew that! Hmmm I have a friend that has a wireless enabled laptop that he hard wires in his lan. His is internal so I guess he would have to disable the wireless nic and enable it when he comes to my house.
 
Originally posted by: vss1980
Whatever happened to this supposed successor to WEP which was supposed to be a lot more secure...??
Click to expand...

Well it is supposed to be out, but my router does not support it.
rolleye.gif
At this point, it will take a LOT of convincing to get me to go back to wireless.
 
Out of curiosity, won't WEP + MAC address filtering + firewall do the job for almost all cases? I use that plus a second software firewall on each PC and I'm not worried. I'm sure it can be broken but not without prolonged effort by someone trying to break it... and I'm sure I'd notice a dude parked in front of my house for hours on end 😛
 
Originally posted by: RaynorWolfcastle
Out of curiosity, won't WEP + MAC address filtering + firewall do the job for almost all cases? I use that plus a second software firewall on each PC and I'm not worried. I'm sure it can be broken but not without prolonged effort by someone trying to break it... and I'm sure I'd notice a dude parked in front of my house for hours on end 😛
Click to expand...

Yes, this is true, but not for me. When I am at my neighbors house, I can get my signal. So that means that his sons little computer buddy friends can sit there all day! I have a friend that was trying to set her wireless up and we could never get it to work because her router and her neighbors router would cause conflicts. So we moves the router to the other side of the house and got the same issue with the other neighbor. So basically all I am doing is eliminating wireless for anything on my "protected" LAN, and allowing wireless for internet only. Just from what I have been reading and the few tools I have seen first hand, WEP + Mac filtering does not cut it for me. But that's just me.
 
Originally posted by: Crazee
This is what we use at work to secure wireless linky
Click to expand...

That is a nice looking piece of hardware. If my company ever starts going a little wireless I will look more into that. Thanks for the link.
 
what do you all think of the method of wep+disabling ssid broadcast, so noone knows the network exists? are there tools people can use to find the network still?
thats how I have mine set up right now, but I'm not too worried because I'm in a rural area, and I've tested the limits of my wireless network and I get a very poor signal in my driveway and the nearest houses are 4 times the distance away... and those people know jack schitt about computers
 
hmm I even tried to get netstumbler to detect my network and it didn't see it...
maybe some option I didn't select in netstumbler...
oh well, aint noone gonna be lookin for networks out here anyways
 
what do you all think of the method of wep+disabling ssid broadcast, so noone knows the network exists? are there tools people can use to find the network still?
Click to expand...

It helps, but there are tools like netstumbler that can still find the network. And as far as WEP, the low entryption option can be cracked in 2 hours (sometimes they don't even capture the network traffic to a HD and do it offline, they crack it real time), and the 128 bit encryption takes up to 24 hours.

MAC filtering helps, but if they hijack the wireless NIC card in a lappy hard wired to a LAN, guess what? They have a valid MAC address to use. A software firewall on the lappy DOES help block that kind of attack.

heh, and one of the nice "features" of XP helps hackers out by automatically detecting and setting up wireless access points for you.
rolleye.gif


Not to mention how vulnerable most access points are to "man in the middle" attacks, because by design/standards, management commands are not authenticated. So a hacker can actually force an AP to reset and ignore authentications.
That's why it's important for corporations especially to not just put in place all the things they can to block access, but also to monitor the network for rogue access points, or access points that have been reconfigured.

At One of the security seminars I've go to, they had a team that discussed how they went to a major airport terminal, sat there, and within an hour were able to get into at least 5 major corporation's networks by hijacking nearby laptops, forcing re-authentication, capturing logons or passwords (or using the connections with saved ids/passwords), and other fairly easy techniques. And they demonstrated those techniques in the class.

A lot of the sniffer/hacker/hijacking tools that used to require you to know Linux have now been ported to Windows, and are easy to use, so any script kiddie can be dangerous.

Wireless is great, but not very secure.

 
Originally posted by: zeruty
what do you all think of the method of wep+disabling ssid broadcast, so noone knows the network exists? are there tools people can use to find the network still?
thats how I have mine set up right now, but I'm not too worried because I'm in a rural area, and I've tested the limits of my wireless network and I get a very poor signal in my driveway and the nearest houses are 4 times the distance away... and those people know jack schitt about computers
Click to expand...


That is how mine is too. I can get a signal from the back yard. But I can't walk around on the street.... I think it would be really tuff for someone to get a connection from me. I just unplug mine from the network when I'm not using it. And If I want to listen to MP3's out side or in the garage I plug it back in. I set it up to only accept a Mac address from my laptop only. Don't really know that much about wireless but wouldn't they need to clone the MAC then somehow bust into the server hosting all my MP3's???? Wouldn't that be hard since it's windows 2003 server that only lets people in with accounts and passwords? Yeah it's doable but when I only leave the wireless router plugged in when I am home and on days that I am actually working outside ... about maybe 30-60 days out of a year I really think it would be hard... Besides I'd figure it out really fast when the lights started blinking on the routers and I was not down/loading anything.

I've heard of smoothwalll is that shareware? Or do you have to pay for it? I just downloaded it. Tho, I don't have a old machine laying around to become the router. What do you do with your old router? Seems like a lot of work ???

Sometimes I really think Computer Security is over rated... I wish there was a product that you could just plug in an IP and could test your entire home network for problems. But, I guess that is a hackers job and it would take all the fun out of it. Maybe we can start up a new business and pay a bunch of hackers to try to hack into your network.

I ran software firewalls Norton and Zone alarm on two crunchers that were hooked up to the network. I had them on for over half a year and never had one problem... I think I would have better luck trying to find an alien then having a hacker come snooping around my network.
 
Originally posted by: ericlp


I've heard of smoothwalll is that shareware? Or do you have to pay for it? I just downloaded it. Tho, I don't have a old machine laying around to become the router. What do you do with your old router? Seems like a lot of work ???
Click to expand...

IIRC it's linux. It's free. I think you can pay for extra features though (not positive).

Sometimes I really think Computer Security is over rated... I wish there was a product that you could just plug in an IP and could test your entire home network for problems. But, I guess that is a hackers job and it would take all the fun out of it. Maybe we can start up a new business and pay a bunch of hackers to try to hack into your network.
Click to expand...

Most security companies do hire hackers. Nessus, saint, and satan are all vulnerability scanners.

Wireless is tough, but not impossible. Most OSes come with IPSEC clients. There are a number of free and payware SSH clients out there. OpenBSD can be setup as a wireless access point, firewall, proxy, IPSEC server, and do authentication/authorization through SSH. NASA is even using it for their wireless gateways (deadly.org article with a link to NASA whitepaper).
 
You must log in or register to reply here.

TRENDING THREADS

Back
Top