https://www.supernetworks.org/pages/blog/secure%20router%20chaining Skip to main content Secure Programmable RouterSecure Programmable Router SPRDocumentationAPISetup GuideBlog SPR GitHub Search All posts * Transparent Socket Forwarding with SPR and MITMProxy * Loading up nexmon on a RPI4 with SPR * Attack Surface Reduction Research (Part 1) * One Weird Trick to fix your CTF Payloads * How to use the SPR 1-click install on DigitalOcean * SPR Now Available on the iOS App Store * Barely AP is Almost an Access Point * March 2023's Turtles Challenge * January 2023's Turtles Challenge * Run Virtual SPR on a Google Cloud Free Tier Instance * Run Virtual SPR on a AWS Micro Tier Instance * Run Virtual SPR on a DigitalOcean Droplet * SPR in the cloud * Securely Chaining Routers * SPR Supports WPA3 with Multiple Passwords * Gigabit WiFi with SPR & The 4x4 MT7915 * Running SPR on a Mini PC with WiFi 6 * Supernetworks just Released a React User Interface * Announcing The SPR Project Securely Chaining Routers September 3, 2022 * 4 min read Alex Radocea Building a Home WiFi Network Putting together a home network has several subtly annoying security tradeoffs. Users want * Ease of Use & Connectivity Maximized by keeping devices maximally connected with a simple passphrase * Privacy and Security Maximized by keeping devices minimally connected. And ideally offline If the goal is a bit of both, how to do segmentation correctly quickly becomes a bit of a puzzle What's the Best Way to Chain Your Routers? The "Secure Router" can be considered the Work From Home access point, and the "Guest Router" can be considered the Guest, Personal, or IOT access point. [chaining_choices-f543aa893de8eefeda219c3d1e6619fe] The Worst Choice Option #3 is to connect the internet to the secure router, and then plug the guest router into the secure router. Guests and untrustworthy devices can connect to the guest router. This might make sense intuitively for some. You put the Secure Router close to the internet since that's where all the internet traffic will go out from, and if the Guest Router is compromised, it can't intercept traffic. However, since the Guest Router is a Peer on the Secure Router network's LAN, every "Guest" station and the router will be able to reach the secure router and devices on the secure network LAN. Unless either the Guest Router can block requests to the Secure LAN with its firewall, or the Secure Router can isolate the port for the Guest Router for only internet access, this is not an accepted best practice. Split ESSIDs Option #2 is to share a router for both SSIDs, with one ESSID and password for the Secure LAN and one for the Guest LAN. The expectation is that devices can not send packets across the two LANs. The great tradeoff with this is that if a user wants to control their IOT devices they have to switch to the guest network. And if device isolation is enabled on the guest network, devices won't be able to communicate at all. So as security improves, usability decreases. The guest isolation may also be insufficient. The shared passphrase implies MITM capabilities, and passive traffic decryption capabilities with WPA2 or active decryption capabilities with WPA3. Some routers place both ESSIDs on the SAME LAN. Usually this allows the secure devices to reach the guest devices. Usability has been increased, but this often leads to subtle flaws that allow the guest devices to bypass their isolation entirely. Another upside to this approach is that bandwidth can be shared for the ESSIDs, reducing wasted WiFi spectrum. Overall, this is an accepted best practice, but it comes down to the details where very quickly users are trading off security for usability. The Best of the Three: Guest Router First, Secure Router Second Option #1 is the recommended and accepted best practice. The guest network connects directly to the internet, and the secure router plugs into the guest Router. This approach yields a favorable combination of security and usability. Devices on the secure LAN can access devices on the Guest LAN, which is great for controlling IOT devices. And devices on the Guest LAN have no way to initiate communication to devices on the Secure LAN, blocked by the Guest Router firewall. The main downsides: The guest router could have ISP credentials, and could MITM internet traffic if compromised by an untrusted device Multi PSK & VLANs Today's most featureful home routers offer support for one passphrase per device. This solves many of the MITM and decryption issues for guest isolation. The devices can be placed into VLANs with unique WiFi passphrases, GTKs, and secure firewall rules creating truly strong isolation. These mechanisms provide powerful mechanisms for designing a home network securely. This is the approach SPR follows, and we've spearheaded Multi-PSK with WPA3. SPR provides maximum isolation capabilities by placing each station into its own LAN. Users can then easily create groups of interconnected devices. [tinynets-1cc6f9d81a93c8b078f78fc0f5ad2f21] SPR Supports Plugging into An Existing Router Securely We recommend running SPR by plugging it into an existing router. To support securely doing this, by default -- the firewall will block access to private network addresses over the upstream interface. This prevents devices connected to SPR from accessing devices on the LAN of the current router. To allow a device access to private network addresses upstream, users can apply the lan_upstream tag to the device. [add_wifi_device_lan_upstream-145072582030d7952626322f2bd1575b] And then manage the tag in the Devices view [manage_lan_upstream_tag-88b8dd183fce79f2313324b0725db7a8] Tags: * SPR * Routers * Networking 101 Newer Post SPR in the cloud Older Post SPR Supports WPA3 with Multiple Passwords * Building a Home WiFi Network * What's the Best Way to Chain Your Routers? + Multi PSK & VLANs + SPR Supports Plugging into An Existing Router Securely SPR Links * SPR Homepage * Documentation Community * Discord * Twitter * Blog * GitHub Copyright (c) 2023 Supernetworks, Inc. Built with Docusaurus.