Cyber Security/Secure Router or Modem

Revision as of 23:50, 1 November 2016 by Anna (talk | contribs) (Wireless Security)

How to Create a More Secure Network

Note About Instructions

These instructions were written with a Netgear router running DD-WRT which is a customized, and heavily modified firmware for routers and modems. This firmware adds new features and abilities to a gateway that you would usually only have access to on an enterprise level router. If you are not using a router running DD-WRT, the instructions and terminology used below will still apply to your router or modem. However, the location of these entries will be different.

Recommended Router Models

  • A router with DD-WRT installed. You can locate devices that have DD-WRT support on DD-WRT's website

Notes About DD-WRT

  • This software will add many more features to your router, and should only be used by experienced professionals
  • Flashing DD-WRT can potentially brick your router, so make sure to follow any instructions carefully
  • This guide will not cover all DD-WRT features, only those pertinent to securing your network, and security device
  • Menus might be different in your router depending on your version of DD-WRT

Links and Resources


Setup

RouterSetupMenu.png

Basic Setup

Information is omitted in this section due to none of the settings pertaining to CCTV, Dahua products, or anything relevant to securing your network.

IPV6

Information is omitted in this section due to none of the settings pertaining to CCTV, Dahua products, or anything relevant to securing your network.

DDNS

You can set up an additional DDNS address in this section of your gateway to ensure your DDNS stays updated and pointing to the correct WAN IP address. If you are not using this feature, you should leave this feature disabled.

MAC Address Clone

Information is omitted in this section due to none of the settings pertaining to CCTV, Dahua products, or anything relevant to securing your network.

Advanced Routing

Information is omitted in this section due to none of the settings pertaining to CCTV, Dahua products, or anything relevant to securing your network.

VLANS

If you have a gateway with enough processing power, it is highly recommended that you set up a separate VLAN for just the security devices.

Networking

Information is omitted in this section due to none of the settings pertaining to CCTV, Dahua products, or anything relevant to securing your network.

EoIP Tunnel

Information is omitted in this section due to none of the settings pertaining to CCTV, Dahua products, or anything relevant to securing your network.


Wireless

RouterWirelessMenu.png

Basic Settings

If you are not using WiFi, your best bet is to disable this feature to ensure unauthorized visitors cannot gain access to your network via WiFi.

Radius

Information is omitted in this section due to none of the settings pertaining to CCTV, Dahua products, or anything relevant to securing your network.

Wireless Security

The wireless security settings, in decreasing order of preference, should be the pre-shared key versions of the following:


1. WPA2 AES

2. WPA AES (only if all devices support it).

3. WPA TKIP (maximum security commonly supported by older wireless adapters - can be vulnerable)

4. WEP

5. Disabled (no security. Use some other security layer on top, like a VPN)

(Source: DD-WRT Wiki)

MAC Filter

If you choose to leave wireless enabled, setting up MAC filters will ensure only authorized devices are able to access the network.


Services

RouterServicesMenu.png

Services

  • Disable SSHd
  • Disable Telnet

FreeRadius

Information is omitted in this section due to none of the settings pertain to CCTV, Dahua products, or anything relevant to securing your network.

PPPoE Server

Information is omitted in this section due to none of the settings pertain to CCTV, Dahua products, or anything relevant to securing your network.

VPN

VPN: Definition

A VPN or Virtual Private Network, is used to remotely access your network. This feature will basically allow your computer to remotely connect to your LAN as if that computer was physically on that network.

VPN Configuaration

If you are not using this feature, disable all VPN settings, including:

  • IPSec Passthrough
  • PPTP Passthrough
  • L2TP Passthrough

VPNDDWRT.png

USB

Information is omitted in this section due to none of the settings pertain to CCTV, Dahua products, or anything relevant to securing your network.

NAS

Information is omitted in this section due to none of the settings pertain to CCTV, Dahua products, or anything relevant to securing your network.

Hotspot

Information is omitted in this section due to none of the settings pertain to CCTV, Dahua products, or anything relevant to securing your network.

SIP Proxy

Information is omitted in this section due to none of the settings pertain to CCTV, Dahua products, or anything relevant to securing your network.

Adblocking

AdBlockDDWRT.png

Options:

Privoxy: Enable/Disable

Transparent Mode: Enable/Disable

Custom Configuration: Enable/Disable

Recommended Options:

Privoxy: Enable

Transparent Mode: Disable

Custom Configuration: Disable


Security

RouterSecurityMenu.png

Firewall

For the Firewall section of the DD-WRT, you want to enable as many options as possible to ensure your network's firewall is doing it's job.

FirewallDDWRT.png

Firewall Protection

SPI Firewall:Enable Disable

Additional Filters

Filter Proxy

Filter Cookies

Filter Java Applets

Filter ActiveX

Block WAN Requests

Block Anonymous WAN Requests (ping)

Filter Multicast

Filter WAN NAT Redirection

Filter IDENT (Port 113)

Block WAN SNMP access

Impede WAN DoS/Bruteforce

Limit SSH Access

Limit Telnet Access

Limit PPTP Server Access

Limit FTP Server Access

VPN Passthrough

If you are not using the VPN features of your router, you should disable all VPN options.

VPNPassThroughDDWRT.png

Settings: IPSec Passthrough: Enable/Disable

PPTP Passthrough: Enable/Disable

L2TP Passthrough: Enable/Disable

Recommended Settings:

IPSec Passthrough: Disable

PPTP Passthrough: Disable

L2TP Passthrough: Disable


Access Restrictions

RouterAccessRestrictionsMenu.png

WAN Access

Information is omitted in this section due to none of the settings pertain to CCTV, Dahua products, or anything relevant to securing your network.


NAT/QOS

RouterNATQOSMenu.png

Port Forwarding

In this section, you can configure ports to be forwarded to your network devices. This is where you need to go to setup remote access if you are not using P2P. PortForwardingDDWRT.png

Port Forwarding Explanation

In the above example, you will see several port forwarding rules. There are two Dahua NVRs on this network. Each NVR will need two ports (TCP and HTTP) forwarded in order for the system to be remotely accessible. There is an additional port forwarding rule for the first NVR's RTSP port, which is 554. This port needs to be forwarded only if you are using ONVIF or RTSP remotely.

NVR 1

LAN IP: 192.168.1.11

HTTP Port: 80

TCP Port: 38000

RTSP Port: 554

NVR 2

LAN IP: 192.168.1.16

HTTP Port: 90

TCP Port: 37777

PortForwardingDDWRT.png

Port Range Forwarding

Do not use this feature to open ports for your security devices. Use, "Port Forwarding" instead.

Port Triggering

Do not use this feature to open ports for your security devices. Use, "Port Forwarding" instead.

UPnP

UPNP attempts to automatically forward ports needed by a connected UPNP compliant device. This feature should always be disabled. 700px

DMZ

  • DMZ should never be used to open ports on a DVR, NVR, or IP Camera. The only time DMZ should be used is when you want to completely bypass a router or modem's firewall.

DMZDDWRT.png

QoS

Information is omitted in this section due to none of the settings pertain to CCTV, Dahua products, or anything relevant to securing your network.

Note: You can use QoS to give network traffic priority to the video feeds.


Administration

RouterAdministrationMenu.png

Management

  • Set a new user name and password for your DD-WRT. This is a must!
  • Disable Telnet Management
  • Disable SSH Management
  • Disable "Allow Any Remote IP"

Management1DDWRT.png Management2DDWRT.png

Keep Alive

Information is omitted in this section due to none of the settings pertain to CCTV, Dahua products, or anything relevant to securing your network.

Commands

Information is omitted in this section due to none of the settings pertain to CCTV, Dahua products, or anything relevant to securing your network.

WOL

Factory Defaults

Information is omitted in this section due to none of the settings pertain to CCTV, Dahua products, or anything relevant to securing your network.

Firmware Upgrade

Information is omitted in this section due to none of the settings pertain to CCTV, Dahua products, or anything relevant to securing your network.

Backup

Information is omitted in this section due to none of the settings pertain to CCTV, Dahua products, or anything relevant to securing your network.


Status

RouterStatusMenu.png

Router

Information is omitted in this section due to none of the settings pertain to CCTV, Dahua products, or anything relevant to securing your network.

WAN

Information is omitted in this section due to none of the settings pertain to CCTV, Dahua products, or anything relevant to securing your network.

LAN

Information is omitted in this section due to none of the settings pertain to CCTV, Dahua products, or anything relevant to securing your network.

Wireless

Information is omitted in this section due to none of the settings pertain to CCTV, Dahua products, or anything relevant to securing your network.

Bandwidth

Information is omitted in this section due to none of the settings pertain to CCTV, Dahua products, or anything relevant to securing your network.

Sys-Info

Information is omitted in this section due to none of the settings pertain to CCTV, Dahua products, or anything relevant to securing your network.