[HN Gopher] Securely Chaining WiFi Routers (2022)
___________________________________________________________________
Securely Chaining WiFi Routers (2022)
Author : transpute
Score : 40 points
Date : 2023-11-24 10:05 UTC (1 days ago)
(HTM) web link (www.supernetworks.org)
(TXT) w3m dump (www.supernetworks.org)
| sebiol wrote:
| Seems like an advert for their Product SPR: Secure Programmable
| Routers. I don't know their system, so don't see the rest of my
| comment as a critique.
|
| If your systems supports VLAN tagging per SSID there is an option
| to make the single Router setup more secure. This will most
| likely only apply to companies and home labs. For example at my
| company we have Zyxel gear were we can tag WLAN connections with
| a VLAN based on the SSID.
|
| Beware, simplified description ahead. We have a Guest SSID. All
| connections from this SSID get tagged with a dedicated VLAN on
| the Access Points. The traffic is then routed to our Firewall and
| from there to the internet. All switches in between use the VLAN
| to prevent Guest connections from reaching any other devices on
| the LAN.
| transpute wrote:
| _> Seems like an advert_
|
| The decision diagram and conclusion below, applies to any pair
| of OSS or vendor routers in the "guest" and "secure" roles.
| Guest Router First, Secure Router Second Option #1
| is the recommended and accepted best practice. The guest
| network connects directly to the internet, and the secure
| router plugs into the guest Router.
|
| _> we have Zyxel gear were we can tag WLAN connections with a
| VLAN based on the SSID_
|
| Open-source SPR can place each wireless client device in its
| own VLAN, with a unique WPA3 passphrase for every client.
|
| This allows granular, per-device rules for routing and
| filtering, instead of dumping all devices into one-VLAN-per-
| SSID.
| stonepresto wrote:
| This also reads like an advert...
|
| I still don't see a usecase for a unique PSK per guest, and
| even that can be achieved with most guest portal
| implementations.
|
| What SPR seems to lack is backing and therefore trust.
| Pushing a product aggressively on HN is not the way to build
| that trust.
| transpute wrote:
| An "advert" for a BSD-licensed open-source codebase?
| Pointers to a comparable OSS networking project,
| implemented in memory-safe golang or rust, would be
| appreciated. There is https://router7.org, but for a narrow
| use case.
| amluto wrote:
| I think it's useful for headless devices -- signing up,
| say, a thermostat using a guest portal is ridiculous.
|
| WPS sort of tried to cover this use case, but WPS is a
| disaster.
| heyoni wrote:
| How is wps a disaster?
| amluto wrote:
| Lack of usable support from a lot of access points and
| management systems. Do _any_ of the major multi-AP
| systems support it? UniFi has no support. I don't think
| any of the Ruckus products support it.
|
| (Also, "push the button" is a bit of an awkward concept
| with multiple APs.)
|
| edit: it's also a disaster due to a proliferation of
| crappy client devices that more or less require it.
| heyoni wrote:
| I see. I'm using a normal router in bridge mode as an
| extender and that's been working well enough and comes
| with WPS built in so for instance, I can turn it on there
| if the printer is closer but of course it would be nice
| to turn it on in one place and have all the extenders
| have it on as well.
| transpute wrote:
| golang-based SPR is open-source and can run on RPi:
| https://github.com/spr-networks/super
|
| _> An unspoofable device identity is established with a MAC
| address and Per-Device Passphrase for WiFi (or a VPN Public Key
| for Remote Devices). From there, each device gets its own /30
| subnet to exist on. Hardening and strict firewall rules block
| network spoofing and impersonation, and routing rules redefine
| connectivity between devices and to the internet._
| rilut wrote:
| I am a bit confused, is the Option #1 and Option #2 in the text
| and diagram swapped by mistake?
| Canada wrote:
| This seems pointless. Just assume your wifi is insecure.
| callalex wrote:
| Should probably throw away the computer and stick to
| subsistence farming, just to be sure. Avoid talking to other
| people as well, as they may not have your best interests at
| heart.
| PhilipRoman wrote:
| I mean wifi really doesn't have a good track record for
| security. It's best defense is probably the short range,
| making searching for weak targets somewhat difficult. And I'm
| not even going to talk about spoofing, deauth attacks, etc.
| Only the newest versions have actually secure crypto, but
| lots of routers don't even support them (for some reason
| these secure features are branded as "enterprise"). This is
| very different from the type of security we've come to expect
| from high level protocols like SSL, SSH, etc.
| jjjjmoney wrote:
| While there is some merit in having a secure LAN, I see where
| you're coming from.
|
| I assume anything leaving the LAN is insecure, and why I prefer
| secure protocols. However, this is often impractical for many
| devices and projects on the LAN side.
| amluto wrote:
| I really wish developers of OSS systems like this would design
| them, from the ground up, for multiple access points. None of the
| required changes are rocket science, but IMO all of the features
| should be pleasant to use with more than one AP, and the network
| architecture should support it. OpenWRT, for example, handles
| fast roaming in a way that is IMO quite miserable to configure.
|
| (It would be _really_ nice if the actual 802.11 standards
| specified a way for an AP to delegate management to a separate
| device so that any vendor's AP could join such a network. Oh
| well.)
| Terretta wrote:
| Double NAT? Don't try this at home.
|
| https://kb.netgear.com/30186/What-is-double-NAT-and-why-is-i...
|
| You can't put guest router in bridge mode since then guest/IoT
| devices can't get IPs. You'd have to put "secure" router in
| bridge or AP-only mode.
|
| By that time, just get something that does all this for you
| without any hassle or configuration to learn, like Eero.
|
| Unless you _want_ to be a WiFi geek, just get Eero and let it do
| WiFi right for your whole household.
| josephcsible wrote:
| I've used double NAT before without any of the problems
| mentioned in that link.
| fulafel wrote:
| Also breaks your IPv6.
| y-c-o-m-b wrote:
| Hmmm I have an ASUS router connected to my CenturyLink
| modem/router combo because it gets better range and allows me
| to have better access controls/monitoring. I guess I'm using
| double NAT. I don't have those issues, but there's been times
| where after a month or so the internet performance drops
| considerably and I end up rebooting everything to get it back
| to normal.
___________________________________________________________________
(page generated 2023-11-25 23:02 UTC)