[gentoo-user] Re: [OT] router woes

[Kai Krakow]

Am Wed, 29 Mar 2017 04:52:08 -0700
schrieb Jorge Almeida <jjalmeida@×××××.com>:

> On Wed, Mar 29, 2017 at 12:45 AM, Neil Bothwick <neil@××××××××××.uk>
> wrote:
> > On Tue, 28 Mar 2017 22:52:25 -0700, Jorge Almeida wrote:
> >
>
> >
> > It's more a privacy issue that security for me. I have a similar
> > setup with a virgin cable router, which I set to what they call
> > modem mode, where only one of the ports works and connects to my
> > router. The one time I ran tech support they were able to see that
> > I was using it this way and even reset the modem for me. I suppose
> > it makes life easier for them and their typical customers, but it
> > was a little unnerving.
> >
> >
> The ISP provided router is officially managed (whatever this means) by
> them. As to privacy, I know a packet is visible once it leaves the
> router via Wan port. What I worry a bit is about the possibility of
> foul play towards the home network. The computers are firewalled via
> iptables, but accept connections from 192.168.... What prevents a
> hacked router of impersonating a local origin?

Block packets originating from the router MAC address and that don't
belong to a known connection. Then deploy a managed switch that can do
MAC address filtering so it allows only the one MAC address on the
router port. This should be safe enough. It would be difficult to get
around such a setup. To be even more safe, use VLAN and exclude all
your computers from the management port.

This, however, doesn't prevent tampering with packets on their way
through the router. You could use VPN and place the tunnel endpoints
only on trusted routers. That way, your ISP only relays VPN traffic,
and ensures the transfer networks below are only used for VPN and your
machines accept nothing else.

-- 
Regards,
Kai

Replies to list-only preferred.