Securing a Wireless network...

[tvradict]

I have a Home network which has in the past given me lots of problems.

I have now had it running smoothly for a good couple of month, maybe more, and so now I need to secure the Wireless side of the network. I was reminded today when my mate popped over with his laptop and his network card asked if he wanted to 'connect to Wireless Network TVRADICT'

One problem. I have no idea how. Well, thats not strictly true. I know it starts with the Router, but where do I go? What do I do?

So, an Idiots Guide to Securing a Wireless Network if you please

TIA
Stuart.

[antonyj]

Well I aint no expert, but first off all choose a better ssid.
Disable your SSID broadcasting.
Set up your Mac address filtering.
Minimise the amount of clients able to connect, also set the amount of available IP's to minimum.
Then you can also set up the security encription.

[vee]

It took me months of trying, giving up, trying until I eventually sorted mine.
I created the steps below to remind me if I ver have to reset mine.
I am not a techie in any way so this might be a bit longwinded with unnecessary steps but it seems to work.

1. Reset router
2. on your computer, enable wireless and 'view available wireless networks'
3. Select G604-T or whatever the Dlink one it finds. it will be unsucure so you can connect to it.
4. Open IE and go to http://192.168.1.1
5. Login using admin/admin (for DLink router)
6. Go to connections tab and select Connection 1. put in the username for your ISP, mine is [e-mail]
7. Click Apply
8.Go to Tools tab, select User Management. Change password to whatever your want.
9. Click Apply
10. Go to Setup tab, select Wireless Settings
11. Select WEP, Change SSID to whatever your want to call your network
12. Check Enable Wireless Access Point and chnge type to Open
13. Input a 10 character code using a combination of letters A-H and Numbers (note this down)
14. Click Apply
15. Go to Tools tab, select System Commands then Save all. Then Click Back and Restart AP
16. On your computer, view wirless networks and select 'change advanded settings'
17. Click on Wireless Networks tab and under Preffered networks click Add
18. Key in your network SSID (as you input in step 11) and also the Network key (also from step 11)
19. Save and close. Disable the wireless adapter on your laptop and then enable again. it should automatically connect to your network, which is now secure.

ps - this is for WEP secutiry as my work laptop doesn't seem to support WPA.
Hope it useful.

pps - its for a DLink router but I assume the same things apply to other makes

>> Edited by vee on Monday 17th April 19:25

[GreenV8S]

Go for WPA if the router supports it - WEP is more or less a waste of time.

[vee]

The steps above also work for WPA.
Does anyone know how I can get my work lappie to support WPA - its an IBM T40.
Is it as simple as downloading some new drivers ?
I had a brief look on IBMs websie but couldn;t see anything.

[bigdods]

Ive never managed to get the encryption working between my Cisco and Netgear mix - but I have disabled SSID broadcast and locked down the mac addresses . As a home user I think this is more than sufficient - Im sure a really dedicated hacker could easily break in but as :

1. Im not a government agency or a bank so not much of interest going on here to make it worth the effort. As a backup all the PCs have a software firewall anyway

2. If I do a netstumbler scan from my house I can see 3 (sometimes up to 5) unencrypted, unsecured access points and a quick scan using my IPAQ from here to my kids school 1 mile away showed at least 20 more - so if they want to get free access plenty of easier targets.

[tvrforever]

oh and download NetStumbler (google search) and use it to show the many unsecure networks that will be near you!

[mattley]

antonyj said:

Well I aint no expert,

That's evident.

antonyj said:

Disable your SSID broadcasting.

NO!! Don't do this. Consumer devices use it to prevent network conflicts, Commercial networks too, hackers don't need it.

antonyj said:

Set up your Mac address filtering. Minimise the amount of clients able to connect, also set the amount of available IP's to minimum.

This is as good as it gets. Mac address filtering is all that matters.

antonyj said:

Then you can also set up the security encription.

Not worth it. WEP and WPA were cracked way open a while back, MAC address is as good as you're gonna get.

[GreenV8S]

mattley said:

Not worth it. WEP and WPA were cracked way open a while back, MAC address is as good as you're gonna get.

You won't ever make it impossible for somebody to break in, my philosophy is to put as many obstacles in their way as you can. WAP may not be perfect, but it's worth having. (MAC address filtering isn't perfect either, MAC addresses can be spoofed too.)

[antonyj]

mattley said:

antonyj said: Well I aint no expert, That's evident. antonyj said: Disable your SSID broadcasting. NO!! Don't do this. Consumer devices use it to prevent network conflicts, Commercial networks too, hackers don't need it. antonyj said: Set up your Mac address filtering. Minimise the amount of clients able to connect, also set the amount of available IP's to minimum. This is as good as it gets. Mac address filtering is all that matters. antonyj said: Then you can also set up the security encription. Not worth it. WEP and WPA were cracked way open a while back, MAC address is as good as you're gonna get.

So you're obviously an expert........

Ok you've pulled apart my suggestions, (as basic as they maybe) , where is your help for the post originator?
Its easy to pull others apart............

But at least I was trying to help and not make others look silly.

>> Edited by antonyj on Monday 17th April 22:15

[vee]

antonyj said:

where is your help for the post originator?

I think he is suggesting MAC address filtering ?

[aldi]

Also, consider turning the box off when you're not using it. Lets see someone hack into it then

[Jinx]

mattley said:

Not worth it. WEP and WPA were cracked way open a while back, MAC address is as good as you're gonna get.

Fine as long as you don't have mates who come round to use the wireless connection on an adhoc basis and you can't be bothered to lock down the MAC for every new toy they bring along. Easier to use a WEP key?

[jamieboy]

It has to be a trade off between your network being 'secure enough' and still being usable. None of the things mentioned on here are fool-proof (except for the option of switching it off!) - yes, WEP and WPA are crackable, but MAC address spoofing isn't impossible either.

I run WPA on mine, because for me that's the best compromise between security and ease of use.

[ErnestM]

Best wireless security I have found = SonicPoint managed access point. All wireless users have to sign in via a vpn client in order to complete a wifisec tunnel into the LAN. 3DES encryption with MD5 or SHA1 authentication. That being said - it is an expensive proposal because of proprietary gear.

Does your wireless AP offer the ability to use WPA RADIUS authentication? Of course then you have to set up and manage a radius server, etc.

Wireless is not as safe as wired. Mac address filtering is good, but with the right gear, a hacker can change a MAC. Of course, since you are not a bank, they probably will not so the consumer level stuff is adequate...

ErnestM

Edited to add: Vee, I have no experience with Dlink routers, but doesn't setting the system to OPEN negate any security?

>> Edited by ErnestM on Tuesday 18th April 12:11

[deckster]

Best way to make a wireless network secure? Turn it off and use cable, it's the only way to be sure.

Why secure your network anyway? Give the neighbours a free ride, whatever. Just make sure that you've got your machines secure, firewalled up, password protected etc. etc. and let 'em go.

[TheExcession]

deckster said:

Why secure your network anyway? Give the neighbours a free ride, whatever. Just make sure that you've got your machines secure, firewalled up, password protected etc. etc. and let 'em go.

Indeedy and while you're at it install a copy of Ethereal and sniff all their mail and porn site passwords, it works both ways......

[bogie]

unless you live in a block flats inhabited by computer hackers then I wouldnt worry too much ! ...

Theres a lot of paranoia fuelled by the internet surrounding this stuff...unless you are a spy for MI6 etc then all you really have to protect yourself against is the neighbours (if you have any) getting free broadband

any of the above previously mentioned methods will be fine and is all good advice - I recommend just enabling WPA...MAC filtering as well if you dont have many visitors/adding of new devices ...disabling SSID broadcast is pointless these days and just makes it more inconvenient for yourself to use.

I used to design large scale wireless networks for a living and indeed there are certain companies where I wouldnt even recommend one at all...however, generally they can be made so secure that it becomes too much of a pain/too much time to hack them ...so then the companies have to go back and start dealing with increased physical security etc

[roadsweeper]

vee said:

antonyj said: where is your help for the post originator? I think he is suggesting MAC address filtering ?

MAC address filtering is not secure because MAC addresses can be spoofed. However, it is another layer of useful security.

WEP is fine for most people, though it can be cracked in a few minutes by an expert. You just have to ask, given where you live and what you use the network for, how likely is it someone is going to try?

WPA in it's various flavours is much more secure than WEP and should be utilised if available.

If you're really hardcore, use specialist network traffic encryption software such as PGP's product.

[tvrforever]

mattley said:

antonyj said: Disable your SSID broadcasting. NO!! Don't do this. Consumer devices use it to prevent network conflicts, Commercial networks too, hackers don't need it.

Thanks for reminding me of this - was the reason my Netgear MP101 had stopped registering on my wireless LAN - all fixed now...