Cyber Security/Secure Router or Modem
Contents
How to Create a More Secure Network
Recommended Router Models
- A router with DD-WRT installed. You can locate devices that have DD-WRT support on DD-WRT's website
Notes About DD-WRT
- This software will add many more features to your router, and should only be used by experienced professionals
- Flashing DD-WRT can potentially brick your router, so make sure to follow any instructions carefully
- This guide will not cover all DD-WRT features, only those pertinent to securing your network, and security device
- Menu's might be different in your router depending on your version of DD-WRT
Links and Resources
- DD-WRT Glossary
- DD-WRT FTP
- PuTTY
- MVPs Blacklist
- Ad Blocking DNS
- DD-WRT Ad-Blocking
- Privoxy Setup
- More Info
Setup
Basic Setup
IPV6
DDNS
MAC Address Clone
Advanced Routing
VLANS
Networking
EoIP Tunnel
Wireless
Basic Settings
Radius
Wireless Security
The wireless security settings, in decreasing order of preference, should be the pre-shared key versions of the following: 1. WPA2 + AES
2. WPA + AES (only if all devices support it).
3. WPA + TKIP (maximum security commonly supported by older wireless adapters - can be cracked as well)
4. WEP (easily cracked in 5 minutes)
5. Disabled (no security. Use some other security layer on top, like a VPN)
-Source DD-WRT Wiki
MAC Filter
WL0-Advanced
WL0-WDS
WL1-Advanced
WL1-WDS
Services
Services
FreeRadius
PPPoE Server
VPN
VPN: Definition
A VPN or Virtual Private Network, is used to remotely access your network. This feature will basically allow your computer to remotely connect to your LAN as if that computer was physically on that network.
VPN Configuaration
If you are not using this feature, disable all VPN settings, including:
- IPSec Passthrough
- PPTP Passthrough
- L2TP Passthrough
USB
NAS
Hotspot
SIP Proxy
Adblocking
- Privoxy Basic Configuration
- Link to Setup Ad Blocking on DD-WRT
- Additional Method to Setup Ad Blocking on DD-WRT
- Second Additional Method to Setup Ad Blocking on DD-WRT
|
|
Security
Firewall
For the Firewall section of the DD-WRT, you want to enable as many options as possible to ensure your network's firewall is doing it's job.
Firewall Protection
SPI Firewall:Enable Disable
Additional Filters
Filter Proxy
Filter Cookies
Filter Java Applets
Filter ActiveX
Block WAN Requests
Block Anonymous WAN Requests (ping)
Filter Multicast
Filter WAN NAT Redirection
Filter IDENT (Port 113)
Block WAN SNMP access
Impede WAN DoS/Bruteforce
Limit SSH Access
Limit Telnet Access
Limit PPTP Server Access
Limit FTP Server Access
VPN Passthrough
If you are not using the VPN features of your router, you should disable all VPN options.
Settings: IPSec Passthrough: Enable/Disable
PPTP Passthrough: Enable/Disable
L2TP Passthrough: Enable/Disable
Recommended Settings:
IPSec Passthrough: Disable
PPTP Passthrough: Disable
L2TP Passthrough: Disable
Access Restrictions
WAN Access
NAT/QOS
Port Forwarding
In this section, you can configure ports to be forwarded to your network devices. This is where you need to go to setup remote access if you are not using P2P.
Port Forwarding Example Explanation
In the above example, you will see several port forwarding rules. There are two Dahua NVRs on this network. Each NVR will need two ports (TCP and HTTP) forwarded in order for the system to be remotely accessible.
|
|
Port Range Forwarding
Do not use this feature to open ports for your security devices. Use, "Port Forwarding" instead.
Port Triggering
UPnP
UPNP attempts to automatically forward ports needed by a connected UPNP compliant device. This feature should always be disabled. 700px
DMZ
- DMZ should never be used to open ports on a DVR, NVR, or IP Camera. The only time DMZ should be used is when you want to completely bypass a router or modem's firewall.
QoS
Administration
Management
- Set a new user name and password for your DD-WRT. This is a must!
- Disable Telnet Management
- Disable SSH Management
- Disable "Allow Any Remote IP"
Keep Alive
Commands
WOL
Factory Defaults
Information is omitted in this section due to none of the settings pertain to CCTV, Dahua products, or anything relevant to securing your network.
Firmware Upgrade
Information is omitted in this section due to none of the settings pertain to CCTV, Dahua products, or anything relevant to securing your network.
Backup
Information is omitted in this section due to none of the settings pertain to CCTV, Dahua products, or anything relevant to securing your network.
Status
Router
Information is omitted in this section due to none of the settings pertain to CCTV, Dahua products, or anything relevant to securing your network.
WAN
Information is omitted in this section due to none of the settings pertain to CCTV, Dahua products, or anything relevant to securing your network.
LAN
Information is omitted in this section due to none of the settings pertain to CCTV, Dahua products, or anything relevant to securing your network.
Wireless
Information is omitted in this section due to none of the settings pertain to CCTV, Dahua products, or anything relevant to securing your network.
Bandwidth
Information is omitted in this section due to none of the settings pertain to CCTV, Dahua products, or anything relevant to securing your network.
Sys-Info
Information is omitted in this section due to none of the settings pertain to CCTV, Dahua products, or anything relevant to securing your network.