Meta tags:
description=Router Security Home Page;
keywords=Router, security, Michael Horowitz;

Headings (most frequently used words):

top, router, secure, configuration, the, list, and, why, security, short, full, final, steps, some, additional, thoughts, ongoing, care, feeding, defense, hacked, added, march, 2022, picking, conference, presentations, you, are, safe, here,

Text of the page (most frequently used words):
the (363), #router (161), and (95), for (86), you (85), this (78), that (77), not (59), your (56), can (53), network (53), are (50), routers (49), with (42), from (37), have (34), more (33), security (31), use (30), has (29), see (29), there (29), devices (29), but (28), then (28), page (27), some (27), dns (26), should (25), list (25), when (25), one (24), firmware (24), about (21), any (19), password (19), may (19), will (19), address (18), settings (18), device (18), many (18), off (18), also (18), port (18), other (17), click (17), secure (17), access (17), upnp (17), change (16), configuration (16), all (16), networks (16), test (15), they (15), connected (15), using (15), mac (15), only (14), every (14), side (14), top (13), web (13), here (13), home (13), internet (13), website (12), site (12), browser (12), two (12), new (12), used (12), lan (12), ports (12), good (11), was (11), turn (11), open (11), bad (10), does (10), hacked (10), their (10), changes (10), even (10), both (10), best (10), these (10), option (10), remote (10), app (9), peplink (9), what (9), make (9), next (9), wpa2 (9), most (9), administration (9), each (8), out (8), would (8), current (8), issue (8), while (8), added (8), check (8), ssid (8), updates (8), button (8), wpa3 (8), software (8), interface (8), wan (8), disabled (8), default (8), need (7), computer (7), very (7), isp (7), too (7), reset (7), options (7), now (7), connect (7), ups (7), probably (7), get (7), making (7), name (7), mobile (7), wireless (7), old (7), wifi (7), encryption (7), service (7), down (7), long (7), addresses (7), ethernet (7), guest (7), aes (7), ads (6), privacy (6), 2024 (6), been (6), different (6), them (6), topic (6), own (6), know (6), system (6), just (6), way (6), power (6), than (6), offers (6), which (6), modem (6), why (6), disable (6), time (6), 2021 (6), ssids (6), iot (6), possible (6), attacks (6), support (6), don (6), forwarding (6), over (5), last (5), july (5), note (5), show (5), ios (5), called (5), tests (5), hardware (5), maybe (5), malware (5), better (5), usage (5), part (5), asus (5), said (5), either (5), start (5), servers (5), example (5), without (5), google (5), how (5), forget (5), right (5), full (5), work (5), features (5), offer (5), someone (5), lets (5), number (5), supports (5), prevent (5), checklist (5), providers (5), updated (4), gets (4), something (4), 2017 (4), conference (4), available (4), small (4), its (4), point (4), latest (4), let (4), far (4), infected (4), makes (4), backup (4), after (4), anything (4), against (4), malicious (4), boot (4), who (4), cpu (4), might (4), surge (4), perhaps (4), line (4), names (4), few (4), include (4), fine (4), case (4), single (4), vendors (4), years (4), netgear (4), update (4), working (4), ways (4), however (4), broadcast (4), able (4), public (4), like (4), firewall (4), administered (4), 2020 (4), another (4), feature (4), company (4), normally (4), much (4), people (4), always (4), gibson (4), analytics (4), management (4), blocking (4), ipv6 (4), via (4), cloud (4), short (4), live (3), 2026 (3), dot (3), com (3), inside (3), guys (3), apple (3), versions (3), includes (3), activity (3), contacted (3), were (3), sites (3), screen (3), clean (3), set (3), safe (3), ones (3), articles (3), again (3), first (3), box (3), consumer (3), picking (3), interesting (3), running (3), install (3), itself (3), never (3), worst (3), manufacturer (3), suggestions (3), factory (3), sense (3), yet (3), high (3), bandwidth (3), directly (3), large (3), hard (3), look (3), march (3), 2022 (3), minimum (3), common (3), above (3), pick (3), consider (3), periodically (3), introduction (3), currently (3), want (3), easily (3), characters (3), aware (3), read (3), dhcp (3), idea (3), because (3), obvious (3), wrong (3), 2023 (3), news (3), routing (3), being (3), chance (3), self (3), ongoing (3), defense (3), september (3), three (3), vertical (3), dots (3), corner (3), pointing (3), known (3), phone (3), gray (3), enabled (3), blue (3), link (3), works (3), before (3), ever (3), delete (3), done (3), really (3), turning (3), things (3), around (3), easy (3), where (3), additional (3), below (3), extending (3), range (3), blogged (3), useful (3), vpn (3), state (3), file (3), 2019 (3), printers (3), create (3), direct (3), printer (3), applies (3), found (3), april (3), isolated (3), main (3), vlans (3), guy (3), block (3), random (3), query (3), ping (3), steve (3), shieldsup (3), login (3), anti (3), trend (3), micro (3), bugs (3), passwords (3), flavor (3), spy (3), configured (3), chose (3), vlan (3), techies (3), tkip (3), setting (2), cookies (2), trackers (2), simply (2), run (2), blacklight (2), 2015 (2), michael (2), horowitz (2), created (2), january (2), bar (2), free (2), appear (2), routersecurity (2), 303 (2), report (2), websites (2), section (2), anywhere (2), jan (2), shot (2), none (2), links (2), spoke (2), talk (2), youtube (2), video (2), pdf (2), nov (2), securing (2), presentation (2), hope (2), net (2), presentations (2), least (2), step (2), recommend (2), model (2), already (2), older (2), come (2), installed (2), copy (2), type (2), infection (2), clear (2), download (2), seen (2), expect (2), operating (2), notify (2), actually (2), email (2), restore (2), pcwrt (2), infections (2), survive (2), luck (2), indicate (2), rather (2), display (2), lose (2), quite (2), less (2), big (2), hopefully (2), keeps (2), connection (2), protection (2), shopping (2), interactive (2), bit (2), december (2), lcd (2), usb (2), attack (2), insure (2), assign (2), ipad (2), laptop (2), iphone (2), scan (2), favorite (2), those (2), active (2), information (2), recently (2), surf (2), soho (2), say (2), hacks (2), opinion (2), february (2), nsa (2), completely (2), thus (2), fbi (2), details (2), schedule (2), eol (2), away (2), still (2), status (2), replace (2), care (2), feeding (2), left (2), arrow (2), windows (2), previously (2), circle (2), seeing (2), remove (2), red (2), record (2), exposes (2), anyone (2), expose (2), review (2), pages (2), focus (2), overview (2), august (2), hiding (2), mostly (2), instead (2), popular (2), enterprise (2), often (2), mis (2), mesh (2), focused (2), combination (2), cheap (2), great (2), write (2), assorted (2), thoughts (2), through (2), changing (2), performance (2), detection (2), prevention (2), dos (2), types (2), tab (2), rules (2), reason (2), physically (2), try (2), needs (2), vulnerable (2), backed (2), export (2), final (2), steps (2), neighbors (2), signal (2), barrier (2), proof (2), advice (2), private (2), going (2), alone (2), bytes (2), identify (2), made (2), filtering (2), perfect (2), since (2), whenever (2), typically (2), allowed (2), bookkeeping (2), pain (2), tells (2), understand (2), flaw (2), especially (2), local (2), assuming (2), getting (2), thing (2), nmap (2), outside (2), 535 (2), tcp (2), require (2), shodan (2), doing (2), sure (2), reply (2), hand (2), find (2), remotely (2), whether (2), proceed (2), attention (2), telnet (2), services (2), instant (2), exposure (2), orange (2), watching (2), virus (2), others (2), such (2), limiting (2), think (2), userid (2), protecting (2), frames (2), requires (2), version (2), communication (2), doh (2), specified (2), https (2), into (2), protocol (2), choice (2), provider (2), entire (2), longer (2), take (2), verify (2), non (2), dangerous (2), likely (2), vendor (2), groups (2), agency (2), mistake (2), enough (2), segmentation (2), protected (2), ensure (2), technically (2), knowing (2), disabling (2), online (2), exposed (2), huge (2), wps (2), risk (2), belongs (2), word (2), dictionary (2), implement (2), forwarded (2), third (2), scripts (2), search (2), defensive (2), computing (2), inspector, markup, copyright, feedback, __at__, michaelhorowitz, changelog, viewed, 631, 705, times, 1084, day, 272, days, 4pm, says, viewing, frame, got, domain, org, audit, shows, domains, hilton, contacts, contrast, call, shots, cookieserve, believe, safety, affiliate, opinions, maintain, stink, noted, bold, watch, slides, 1st, reilly, grew, audio, appeared, toms, guide, article, 2014, brief, avoid, cheapest, 300, moved, brings, question, installing, same, shines, area, copies, restriction, modifies, modify, dozens, automated, exception, defend, suspect, wait, minute, botnet, attributable, knows, reports, little, cryptomining, neither, history, pattern, impossible, tell, electricity, damaged, electrical, protector, afford, extra, expense, comes, protectors, costs, waste, money, obviously, battery, alive, fails, provide, boost, low, trim, place, sells, 210, specs, 120v, 720w, avr, tower, outlets, tripp, lite, smartpro, 1300va, logging, facilities, logs, discussed, habit, checking, changed, gotten, complicated, browsers, attached, susans, bobs, georges, begins, households, string, print, moment, apps, fyi, rule, reboot, indication, disconnect, forcing, cold, coin, sides, learned, hacking, chinese, fix, temporary, rebooting, policy, weekly, reboots, smartphones, computers, officially, publicized, end, life, quietly, walk, regardless, official, register, newsletter, announces, bug, fixes, sent, owners, onhub, discontinued, coupon, discount, month, updating, macos, chromeos, v129, chrome, under, column, android, pixel, saved, manage, complete, edit, turned, enter, passcode, limited, must, prompted, whew, generally, keep, automatic, except, places, visited, future, instructions, reviewed, october, black, sheep, dedicated, air, offered, personal, term, exactly, exclusively, turris, omnia, synology, 2025, omada, eero, potentially, client, pretty, pass, school, techie, oriented, ton, obscure, once, baseline, enabling, denial, syn, flood, protects, draytek, intrusion, resets, pinhole, touch, defaults, business, restrict, viable, leaves, back, import, taking, pictures, screens, pepwave, eat, vegetables, target, weaken, leaks, transmission, roadblocks, foolproof, nonetheless, overcome, session, logoff, shut, browsing, mode, extensions, plug, ins, creating, tend, poor, suggestion, ryan, woodings, founder, metageek, courtesy, stand, manufactured, valid, could, looks, linksys, wrote, blog, rejected, larger, specifically, enable, 5ghz, lower, radio, strength, entry, technical, skills, tripped, adapters, fit, supplied, second, unique, identifier, assigned, limit, depending, exclude, banned, involved, maintaining, lists, neck, aspect, recommendation, technology, unaware, intimate, understanding, unencrypted, depends, unsophisticated, attackers, learn, creates, world, speaking, explain, answer, sort, 8183, explained, somewhat, operational, smoking, gun, sept, mentioned, partial, solution, thorough, tested, looking, udp, generates, censys, nine, queries, queried, detected, qualifications, warnings, paragraphs, limits, responsible, terminology, kick, tires, pay, special, ssh, frequently, abused, stealth, finally, spying, released, likewise, partnership, issues, companies, partnering, send, certain, errors, occur, configure, outgoing, sharing, outbound, connections, replaced, hnap, physical, bookmark, ease, lock, dozen, locking, signing, critical, piece, paper, tape, face, insecure, encrypted, newer, methods, requests, responses, server, built, cloudflare, quad9, opendns, custom, url, nextdns, familiar, starts, choose, paid, porn, tracker, subnet, helps, allow, static, reduces, surface, among, snmp, nat, pmp, application, layer, gateways, alg, aka, gui, standard, source, beginning, office, smartphone, connecting, lte, cellphone, trusting, employee, preferred, based, admin, incontrol2, locally, merely, appetizer, isolating, course, causing, grief, matter, national, issued, concept, equally, segmented, between, primary, communicating, practices, isolation, friend, visitors, usually, punch, holes, enables, owner, safer, break, cut, tech, calls, half, story, worry, miserably, akin, surgeon, amputating, leg, fortunately, checks, existence, his, yellow, grc, june, 2018, had, 000, exposing, oct, 2016, hacker, streaming, pewdiepie, videos, chromecast, intended, standards, procedure, manual, goes, offices, exchanged, necessary, yours, couple, ago, themselves, fend, brute, force, guess, sufficient, german, government, recommends, opt, improve, perfectly, reference, psk, refers, multiple, users, logon, words, 7coldapples, hardest, basic, plan, behind, rest, amongst, comprehensive, everything, year, disclosed, feb, capabilities, recommended, opened, door, poke, unchartered, territory, lotsa, guests, choosing, yourself, appears, relatively, tweaks, greatly, increase, adware, party, fact, doesn, kind, uses, duckduckgo, load, discusses, conceptually, describes, communicate, points, dull, boring, important, happen, sad, buy, ignore, affecting, millions, caught, started, following, closely, eventually, realized, needed, upgrade, speed, flaws, devote, recent, nothing, mutually, agreed, norms, manrs, sections, focuses, interested, faster, stats, resources, index,

Text of the page (random words):
st routers this will be an ongoing manual check however some are able to update themselves be aware of the risk if something goes wrong you may lose internet access best to do it at a time when your isp has offices that are open so the box can be exchanged if necessary for more see the firmware updates page many routers no longer get firmware software updates if the last update for yours was a couple years ago it is time for a new router turn off wps turn off upnp upnp is a protocol that lets devices on a lan punch holes in the firewall of the router this exposes these devices to the internet at large where if they are vulnerable they can be hacked technically upnp enables port forwarding without the router owner even knowing what port forwarding is you are safer with upnp disabled to see if your router is doing any port forwarding you can login to the router no forwarding of ports is the safe secure state that said there is a chance that disabling upnp will break some network communication used by a device on your network most likely an iot device this is why it is enabled by default on all consumer routers to cut down on tech support calls but this is only half the story we also need to worry about upnp on the wan internet side of the router upnp was intended to only work on the lan side of a router but some routers are so miserably mis configured that they expose upnp on the wan internet side too this is a huge mistake akin to a surgeon amputating the wrong leg fortunately there is an online test from steve gibson that checks the public side of a router for the existence of upnp exposed to the internet on the first page of his shieldsup service click on the gray proceed button on the next page click on the yellow orange button for grc s instant upnp exposure test as of june 2018 gibson had found 54 000 routers exposing upnp for more read about hacks via upnp hacker streaming pewdiepie videos on exposed chromecast devices jan 2019 and for techies do you know where your upnp is oct 2016 guest networks ssids are your best friend use them not only for visitors but also for iot devices guest networks should be password protected guest networks are usually but not always isolated from the main network review all the configuration options your router offers for the guest network to ensure they are isolated the security checklist page has a list of options you might find network isolation segmentation guest networks are merely an appetizer using vlans for isolating groups of devices on the network is the main course the idea is to prevent a single hacked device from causing grief for other devices on your network how many groups vlans to create is a matter of opinion in february 2023 the us national security agency issued best practices for securing your home network which said at a minimum your wireless network should be segmented between your primary wi fi guest wi fi and iot network this segmentation keeps less secure devices from directly communicating with your more secure devices their focus on wireless was a mistake the vlan concept applies equally to ethernet connected devices they also don t go far enough as they don t address the issue of whether devices in a vlan can see each other see the vlan page for more much more in the beginning routers were administered via a web interface and a computer in your home office now many routers offer remote administration via a cloud service and a smartphone app management via a mobile app can be especially dangerous as it is likely to work from anywhere test this when away from home or by connecting your mobile device to the 4g lte network of your cellphone provider if an app on your phone can get into the router remotely when not connected to a wi fi network from the router then you are trusting every employee of the router vendor not to spy on you disable this if you can this is a big issue to me so much so that i might replace a router if remote cloud app access can not be disabled my preferred router vendor peplink has a cloud based admin system called incontrol2 however it can be easily disabled and the router can be completely administered locally if the router has a web interface turn off remote administration aka remote management remote gui or web access from wan it is normally off by default but take the time to verify this if you need remote administration there are a number of ways to make it more secure such as using https on a non standard port and limiting the source ip address the security checklist page has more on this turning off features you are not using reduces your attack surface among the features that should probably be disabled are snmp nat pmp ipv6 telnet access to the router and application layer gateways alg a longer list is on the turn off page change the lan side ip address of the router even better change the entire lan side subnet see the page on ip addresses for more this helps prevent many router attacks and while you are at it set up dhcp to allow for some static ip addresses chose a dns provider dns is a security issue but not for the router itself instead it applies to the devices that connect to the router if you are not familiar with dns the test your dns servers page starts with an introduction by default your router and your devices will use a dns service from your isp this is the worst possible choice there are many dns providers to choose from both free and paid i have some suggestions on the dns providers page dns providers offer assorted services privacy malware blocking porn blocking ad blocking and or tracker blocking chose a dns protocol while all routers support the old insecure flavor of dns some routers also support the new encrypted version old dns does not use encryption making it very easy for an isp to spy on your activity both of the two newer methods of communication doh and dot use encryption and thus prevent the isp from seeing dns requests and responses old dns is specified with ip v4 addresses normally two of them new dns is typically specified with a server name all of the dns providers on the dns providers page support both doh and dot on peplink routers running firmware 8 2 secure dns is configured on the network tab wan dns over https built into the router is support for cloudflare quad9 google dns and opendns the custom url option can be used for nextdns if a wi fi network is using wpa2 and the router offers an option for protecting management frames turn it on wpa3 requires this option to always be enabled so a wi fi network using wpa3 will probably not have an option for protecting management frames write down the critical information on a piece of paper and tape it to the router face down include the wi fi network names ssids and passwords the router userid password and the ip address of the router for routers with a web interface lock down access to the router from the lan side the security checklist page offers a dozen possible options see the local administration topic such as changing the port number s and limiting access by ip or mac address for routers that use a mobile app for administration think about locking down access to the mobile app this may require signing out turn off wireless networks when not in use some routers let you schedule this others have a physical wi fi on off button others have a mobile app in the worst case you have to login in to the router web interface to disable the wi fi in that case a browser bookmark can ease the pain test if your router supports hnap if so it should be replaced your modem is a computer too your router may be able to block access to the modem from all devices on the lan i blogged about this see part 1 and part 2 if your router supports outgoing firewall rules block the ports used by windows file sharing you may also want to prevent any network printers from making any outbound connections this way if a printer gets hacked it can t phone home if the router can send email when certain errors occur configure this feature try to prevent your router from spying on you if you own a netgear router be aware that they added analytics with firmware updates released in april 2017 if you don t want netgear watching your network you need to login to the router and disable these analytics for more on this see the bugs page for july 2017 likewise asus and other routers include anti malware software that may also be watching you for more on asus and their partnership with trend micro see the bugs page from may 2017 and look for privacy issues with trend micro software in asus routers trend micro software is in other routers too and other anti virus companies are also partnering with router vendors the test your router page has many ways to kick the tires on your router one thing to look for is open ports at steve gibson s shieldsup site click the gray proceed button start with the common ports test and pay special attention to the ssh 22 and telnet 23 ports as these services are frequently abused by bad guys the only good status for any port is stealth assuming remote administration is disabled next do the all service ports test and finally do the instant upnp exposure test orange button maybe turn off ping reply maybe on the one hand it lets a bad guy find your public ip address on the other hand when things go bad being able to remotely ping a router that i am responsible for has been useful in that it tells me that both the router and the internet connection is working different routers use different terminology for this steve gibson s shieldsup service tests whether ping reply is active or not test your router with my shodan query my router page it generates a shodan query a censys io query and nine other queries of your public ip address if your router has been doing bad things hopefully one of the queried sites will have detected it be sure to read the qualifications and more warnings paragraphs to understand the limits of these tests the router tests mentioned above are only a partial solution for the most thorough test connect the wan port of a router to be tested inside router to a lan port on another router outside router then from a computer connected to the outside router scan the wan side of the inside router using nmap looking for open ports this lets you test all 65 535 tcp ports and all 65 535 udp ports there should be no open ports remote administration will require an open port but it should normally be disabled speaking of nmap it is also useful to run it on the lan side of the router there should be one port open for local administration assuming the router has a web interface the hard part will be getting the router manufacturer to explain any other open ports one reason i like peplink is that getting an answer to this sort of thing is easy when someone found port 8183 open on the lan side the company explained why in 2019 i blogged about a netgear router that was still somewhat operational for upnp even when upnp was disabled the smoking gun was two open lan side ports added sept 8 2020 mac address filtering a mac address is a unique identifier assigned to every network interface a router typically has three one for the wan internet port one for lan side ethernet and another for wi fi a laptop computer will have one mac address for wi fi and if it has an ethernet port a different mac address for ethernet this option can be used to limit the devices that can connect to a wi fi network or maybe all wi fi networks depending on the router you can either set up an include list of allowed mac addresses or an exclude list of banned ones the bookkeeping involved in maintaining these lists can be a pain in the neck perhaps the most interesting aspect of this is how much it tells you about someone making a recommendation people who do not understand the technology recommend using it unaware of a flaw people with an intimate understanding of how it works say not to use it because of the flaw mac addresses are always broadcast unencrypted so a bad guy can see the allowed ones and copy them should you use it it depends while the security is far from perfect it should block unsophisticated attackers even if they know the wi fi password and if you only have a small number of wi fi devices then the bookkeeping is not that bad but it can be hard to learn the mac address of a wi fi device especially an iot device or one using an operating system that creates random private mac addresses the world changes added april 26 2021 someone who works from home should have an their own network that is isolated from all the other devices in their home i wrote about this in a september 2020 blog a second router can make working from home much more secure because this network will have a very small number of connected devices there are router options that normally rejected for a larger network now make sense specifically disable dhcp enable mac address filtering do not broadcast the ssid use only 5ghz wi fi and lower the wi fi radio signal strength none of these features is a perfect barrier to entry but since no one does this bad guys without good technical skills should be tripped up and use ethernet whenever possible many printers support ethernet and usb ethernet adapters are cheap this makes the most sense when using two routers or a main router that supports vlans these options are not a good fit when there is only one consumer isp supplied router many routers let you change the wan mac address if you can do so this only applies when you have a stand alone router it should not be done on a combination modem router device a mac address is 6 bytes long the first 3 bytes identify the company that made the hardware making a router from company a appear to be manufactured by company b may offer some defense against a malicious isp valid mac addresses can be found here it would be great if we could change the wifi mac address s but i have not seen that option on any router this is what the feature looks like on a router made by asus tp link linksys and peplink added april 16 2021 your router may not be the only device creating a wireless network many hp printers and probably other vendors too but i tend to see this from hp create their own wi fi network using a feature called wi fi direct that lets wireless devices connect to the printer directly without going through the router the security of wi fi direct is poor so you should either connect a printer to your network or use wi fi direct do not use both suggestion courtesy of ryan woodings the founder of metageek added march 19 2020 routers that have a web interface are best administered with a clean web browser session that is start up a browser work with the router then logoff the router and shut down the browser need proof that this is good advice here is one example from nov 2020 and another example from may 2022 better yet use private browsing mode when working with the router even better use a browser that has no ...