Sys AdminSecuring...

Securing your Wireless LAN

Saturday, August 7, 2004 by digitalpeer, updated Wednesday, August 18, 2010

If you've just purchased an 802.11x router and you've plugged it in and it works- you are not done. You've just exposed your computers and network to anybody that drives by or might be in the next building. There are a couple things you can do to minimize security risk and even go so far as to eliminate it. I'll let you decide. Many of these precautions can be corrected simply by logging into your router configuration interface by pointing your browser to the IP address of your access point.

No Default Passwords

I shouldn't even have to mention this, but I will. DON'T LEAVE DEFAULT PASSWORDS SET. When you buy a wireless router it has a default password. Everybody knows the password and can do some pretty nasty stuff if they have complete control of your router.

Disable SSID Broadcast

The first thing you want to do is disable broadcast of your SSID. While this won't stop a real wardriver, it will thwart people from mistakely realising you have a network up and having curiosity kill the cat.

Disable Remote Configuration

Disable remote configuration. This means that the router won't listen on an external interface to be configured. If you require this it's not so bad if you trust your router, but if you don't need it then turn it off!

Use WPA2

This is the wireless encryption protocol standard that encrypts anything you send over the air. There are quite a few (easy) cracks your neighborhood script wanna-be-hacker can use to break lesser encryption like WEP. Again, it will help thwart them to go somewhere else unless they know you have something they want. Sometimes it's more fun to get your name and address this way instead of looking at your mailbox. Anyway, use the highest setting. If you only have anything under 128bit encryption buy new hardware.

SSH Tunneling

Besides using the above solutions, you can create an SSH tunnel over your wireless connection (see Stunnel - Universal SSL Wrapper). If your wireless encryption just so happens to be cracked, they'll be met with a far more secure layer of encryption. You can do this for traffic on a port by port basis. I won't go into details on how to set it up here, because it's not all that of a trivial process. This won't encrypt all traffic but it will get those protocols you really care about.

NSA Type Security Measures

Build a shield around your location comprised of 1 foot thick lead walls followed by a 3 foot think concrete wall for extra precaution. Don't forget the bottom and top.