Question about routers...

[Rockrz]

I have a guy I help out sometimes with his business computers and he just discovered that his wifi is wide open... no password... anybody can logon

I need to find a router that can be setup in such a way to where guests can logon using a password that is for guests only... which is separate from the main password protecting the router.

And, the need to be able to login to their router and change the guest only password any time they need to.

What brand / model router would be recommended for this?
I'm assuming it would be one that has good software management...

Any ideas would be appreciated

[rkawakami]

From your description I think I know what you're asking but let's be entirely clear here...

By "guest" account/password I assume you mean that you would like to have the wireless router's communications encrypted using a standard protocol like WPA or WPA2 but NOT one which is normally used by the owner. If so, then I think this is something that does what's needed:

http://www.linksys.com/us/support-artic ... Num=140727

edit: Just found this which says NOT to use Linksys Guest feature: http://www.howtogeek.com/219808/warning ... 9t-secure/ They offer an opinion that D-Link, Netgear, and ASUS routers are okay.

[Rockrz]

He wants his computers to have one password that he won't be changing all the time... and the gust network to have a different password and he wants the ability to easily go in and change the guest password anytime as needed.

[rkawakami]

It appears that the Linksys routers present a "login" page when first connected to the wireless router via the -guest SSID. The user then enters a password to gain internet access. This does NOT encrypt their transmissions therefore they would be exposed to snooping.

[Rockrz]

Yeah, I figured his PCs that will be connected continuously should be encrypted and have a strong password while the guest connection wouldn't need to be encrypted and can have a simple password.

It's in a business where he wants customers to have wifi access in the waiting area but it needs to be kept separate from his business network.

[rkawakami]

If he doesn't care about his customer's wireless data being exposed, then the simple login page (with an easily changeable password) that Linksys offers will work. He can simply post the password somewhere in the waiting area and the people wouldn't have to know how to drill down in their device settings for specifying encryption details for the wireless access. All they need to supply is the SSID and then launch a browser.

On the other hand, there are routers available that do offer the same WPA/WPA2 encryption on their guest networks. It just requires a little more work on his customer's end in configuring the connection.

[Saucey]

Couldn't you just have a secure WiFi router and then connect an open WiFi router thru ethernet to it?
Or maybe separate them with a switch?

[Rockrz]

Wouldn't want to have anything "Open"

I figured I would try and set him up with a primary connection that has a nice long password, and then a guest connection with a simple password and set it up where he can easily change the simple password.

[Saucey]

Hmmmm I know a few WiFi routers that have dual bands, the 2.4GHz can be for his workplace while the 5GHz can be for guests, plus the latter signal is actually weaker so it can deter people hanging out in the parking lot.

http://www.tp-link.com/Resources/docume ... _guide.pdf

I think that's my model I use, settings look similar, but I am not really much of a network guy so I wouldn't know if it would work.

[hhhd1]

5ghz is not good for guests, many devices do not support 5ghz.

[Rockrz]

2.4GHz can be for his workplace while the 5GHz can be for guests, plus the latter signal is actually weaker so it can deter people hanging out in the parking lot

A 5GHz signal is weaker that a 2.4GHz signal?

[ajkula66]

A 5GHz signal is weaker that a 2.4GHz signal?

Yes.

[Rockrz]

Seems like you could opt for both primary and guest to be 2.4GHz signals

[RealBlackStuff]

Alternatively, put a decent password in your main router, which should send a wifi-signal.
Then get a wifi-extender for the visitor's area, which gets a simpler password, such as Netgear WN300RP
No need to buy a new router.

[twistero]

Many consumer wireless router have the ability to create a separate guest network. I know I've seen router models having such capability with stock firmware, but I don't have specific model numbers, because any router coming into my possession will have their stock firmware replaced instantly. A Google search should give you plenty of models to choose from.

[ansible212]

Asus routers, such as the RT-AC68U, support six guest networks (!), three on the 2.4GHz band, and three on 5GHz, supporting WPA2 encryption (or none) and with either no limit or a time limit on access. Guest networks can also have access to the local network resources and can support MAC filtering.

[Rockrz]

any router coming into my possession will have their stock firmware replaced instantly

What does updating firmware do for you?

[RealBlackStuff]

Closing the backdoor that the NSA had them put in...

On my ASUS router I run Shibby's TomatoUSB firmware instead.

[Rockrz]

OK, so this is a 3rd party firmware update... something that does not come from the manufacturer?

Doesn't seem like it makes too much difference since your internet service provider will be willing to share their logs with them.

What do you do about that, use a VPN?

[twistero]

What does updating firmware do for you?

I would install either OpenWRT, DD-WRT or Tomato depending on which one supports the hardware. In the past when I used those devices as my primary router, the package system of OpenWRT is great for all kinds of interesting software like vpn servers, UPS monitors, proxy servers, etc. Now I have a separate router and only use these as access points, and even in this role the 3rd-party firmware options provide much more flexibility in multiple SSIDs, VLAN, frequency bands / DFS / radar detection, transmit power and so on.


Also, with a good stock / 3rd-party firmware, you can indeed have a primary and a guest network on the same frequency bands, and also separate the two networks so that devices on the guest network cannot access resources on the primary network.

[Rockrz]

Wow! This brings up stuff I had never really thought about.

So my better half can stream movies without the occasional buffering (not often, but she says it happens sometimes), for myself I'm considering getting the NetGear Nighthawk AC1900 Dual Band Wi-Fi Gigabit Router...

What 3rd party firmware is recommended for this one that closes open doors that shouldn't be open?

Also, I see router descriptions saying they can run external storage? Why would you need to add external storage to a router? If this setting up an extra hard drive for other computers on the network to access?

[twistero]

A quick search indicates that the NETGEAR Nighthawk AC1900 (R7000) is supported by DD-WRT. http://dd-wrt.com/wiki/index.php/DD-WRT_on_R7000

On the other hand, the stock firmware of R7000 seems to be feature-rich, performs better on certain fronts (NAT) than DD-WRT because of proprietary drivers, and most importantly, is regularly updated. Usually, staying up to date is the most critical aspect of security, since vulnerabilities are constantly being discovered and fixed, and staying on older versions means you have known vulnerabilities that people can easily exploit.

(This is one of the reasons I dislike DD-WRT. The recommended DD-WRT version for any given model of wireless router is often several years old, and they make a point in stating "latest is not greatest" because newer versions often contain bugs that make the router unstable. When your wireless router is also your firewall, sitting on two-year-old firmware is basically equivalent of leaving your doors unlocked.)

So I would say try the latest stock firmware first if you go for the R7000. It might be sufficient for you. If you do decide to try 3rd-party firmware, do plenty of research. You can brick your router if you're not careful.

Either way, if you stay on top of firmware updates, use WPA2 with a long passphrase (read up on Diceware), set a long password for your router's configuration page, turn off WPS because that's horribly insecure, then your network is safer than the vast majority out there.



And yes, you can plug a USB drive into the router and have its contents shared on the network. You can probably also share a printer this way. These features are quite common in stock firmwares now; it was only a couple years ago when you need either the very top end product or a 3rd-party firmware for them.

[Rockrz]

Great info, thanks!

One question tho... doe the NETGEAR Nighthawk AC1900 still have the backdoor for NSA?

If so, how can one disable that using the firmware that comes with this unit from Netgear?

[twistero]

One question tho... doe the NETGEAR Nighthawk AC1900 still have the backdoor for NSA?

If so, how can one disable that using the firmware that comes with this unit from Netgear?

What is "the backdoor from NSA"? The NSA may have many backdoors in many things, many of them still unknown to the general public. We do have evidence that the NSA would intercept Cisco router shipments and install a hardware backdoor device in them, but those are serious enterprise / ISP level hardware. I have not seen evidence that the NSA have inserted backdoors in consumer wireless routers, although I haven't looked very hard.

Do your own research and trust your own judgment.

[Rockrz]

Someone in one of the previous posts in this thread mentioned that one of the benefits of using third party firmware is that is closes a back door that I assume he is claiming all manufacturer's firmware has in place to allow snooping.

To which I replied it may be a moot point if someone's ISP is sharing info anyway.

So, best I can tell the NETGEAR Nighthawk AC1900 is a good unit for me personally to upgrade to and thanks for the advice to use WPA2 with a long passphrase, and to turn off WPS

That's the coolest thing about posting on boards where knowledgeable people hang out... I learn some important new stuff and that's one of the things I like best about tinkering with computers and technology in general is the endless amount of learning involved which of course if good for the brain!

[Rockrz]

Hi guys... another question back on the subject of helping this guy out.

He has his current router and ISP modem outside! I told him that was not a good idea as heat and moisture is not good for electronics like this.

So, I'll need to run his cable that goes to the ISP modem thru the wall where they have a filing cabinet inside where the router and ISP modem can sit on top... and the ethernet cable also need to run inside (I'll drill a hole for each and run each line thru a plastic plug that can be sealed with goop)

So, mu question is this... I'm probably going to bee an extension for the ethernet cable so is there an adapter where you can join two ethernet cables together and not harm the quality of the connection too much?

If so, where can I get something like this?

And for him... he does not want anything really expensive so I'm looking at the Netgear AC1200 Smart Wi-Fi Router. With this one, will I be able to set up a guest network with a simple password so his customers can use wifi while in the waiting room?

I figured his primary connection will have a strong password with encryption, but for customers a simple password is all that is needed and encryption wouldn't be a priority on the guest network.

If there is a better router in the $100 range, let me know...

[rkawakami]

re: joining ethernet cables

What you are looking for is generally called an ethernet (or RJ45) coupler. If you Google that, you'll see you can get them most anywhere network cabling is sold.

[Rockrz]

Do these slow down the connection?

Just curious...

[rkawakami]

I suppose it would have some impact on the connection. I think the ethernet cabling standard when attaching a connector (RJ45) to the end of a cable says that you shouldn't have more than 1/2" of untwisted wire. This is more to minimize crosstalk on the data lines which if significant, can cause packets to be re-sent and therefore slowing the throughput.

In practice, I'd say you won't notice any speed degradation. If, over time, the connection on either end of the coupler gets bad, then you'll probably see some slow accesses. As with all "extra" connections in a circuit, it's simply another point of failure that can happen. If you think this coupler might be a problem, would it be possible to replace the existing cable with a longer one?

[Rockrz]

It's just for business use, so as long as it's decent they'll be good with it.

The current ethernet cable is outside in a garage area, so probably what I'll do when connecting that to the new cable that will be run inside is to use heat shrink tubing to make sure the ethernet coupler and the cables connecting to it are completely sealed so hopefully no moisture can get in.

Would it hurt anything to use a little dielectric grease to help prevent any corrosion?