Michael Horowitz
Home => A second router for working from home
[Formatted for Printing] From the personal web site of  Michael Horowitz

A second router can make working from home much more secure

Created: September 25, 2020 | Updated: Oct. 3, 2020

Router Security is my thing. It's a boring subject, often ignored, and when it does get attention, the focus is often wrong. Specifically, the focus is often on isolating IoT devices because their security is so bad. This is a great thing to do, but as more people work from home, the focus of network security should be on carving out a secure enclave for the income-producing devices (computers, tablets, printers, NAS devices, etc).

The official buzzword for this is network segmentation. In English, this means logically grouping the devices in your home and isolating the groups from each other. Perhaps the most common example of network segmentation is having IoT devices use a Guest Wi-Fi network while all the other devices use the main network.

Techies recommend segmenting networks because there are a huge number of attacks that can occur from one device in a home to another device.

The best way to group/segment devices in a network is with a router feature called VLANs (Virual Local Area Network), but most routers do not support VLANs. Instead, this blog is about a simpler approach, one that is available to anyone - a second router. As I make clear on my RouterSecurity.org site, I am no fan of consumer routers. But as a secondary router, they should be good enough and are far better than doing nothing.

ISOLATING

You can make an isolated group of devices by simply plugging one router into another. Any router can be plugged into any other router. I will refer to the existing router or combination box (both a modem and a router) as the outer router and the new router as the inner one. Using an Ethernet cable, connect the WAN/Internet port of the inner router to any LAN port of the outer router. In most cases, that should be all that is required.

Devices that connect to the inner router will be walled off from the other devices in the home by the firewall in the inner router.

The one thing that can go wrong is if both routers use the same numbering scheme (a.k.a. subnet). Every computer on a network has a unique number, called an IP address, that is written at four numbers separated by periods (192.168.1.5 for example). Normally all the computers in a home will start with the same first three numbers (such as 192.168.1) and the last number will vary. If both the inner and outer routers use the same numbering scheme by default, this will have to be changed on the inner router. For example, if the outer router is using 192.168.1.something, then the inner router can use 192.168.2.something or 192.168.3.something.

WHICH ROUTER

Although any consumer router should be fine as the inner router, a more secure option is the $200 Pepwave Surf SOHO. However, setup and configuration of the Surf SOHO, like that of any professional grade router, is too much for non technical people to handle. Its maximum download speed of 120Mbps may also not be sufficient for some uses.

As for choosing a router, there are many criteria. For a Work-From-Home router, I suggest focusing on two features.

The first is whether the firmware (router operating system) it is still being updated by the vendor. You can research this at the tech support section of the hardware manufacturer's website. Search for the specific router model you are considering, and check when the last software/firmware update was. If it is more than a year ago (yes, this is arbitrary), don't buy that router. Note that some router models have different hardware versions.

The other aspect to focus on is whether the router is spying on you. Specifically, whether you must have an account with the hardware manufacturer to use the router. In the old days, every router was a free agent. Now, things have shifted and many (most?) routers require you to check-in with the mother ship. In Star Trek terms, they have been assimilated into the collective of their hardware manufacturer.

The potential for being spied on ("telemetry" is the polite word) by the router vendor is something only I consider. The potential privacy invasion of having a vendor account has never been cited as a gotcha in any review of any router, ever. But, to me, it is. We never know what data the router is phoning home with.

Netgear used to allow free agent routers, but at some point a couple years ago, they silently added telemetry to their routers. If you look for it, you can turn it off. Asus routers include anti-virus software which is, itself, a privacy invasion. I am not sure how functional an Asus router is if you do not agree to let the anti-virus software do its thing. Ubiquiti would never spy on their customers, until they did. Their consumer router is the $300 Dream Machine and you should be allowed to block it from phoning home.

On the upside, my experience with the Amplifi HD line of mesh routers (also from Ubiquiti) is that they can be used without establishing an account, as long as you are willing to give up remote access to the router. Being a mesh system, the Amplifi HD is usually sold as a set of three devices, but you can buy just the cube-shaped router. It has 4 Ethernet LAN ports and, as a bonus, tells you the time of day. Another nice feature of the Amplifi HD router is that you can rollback the firmware to the previous version should a new version cause a problem (this is not true of the AmpliFi Alien models).

An excellent choice could be pcWRT. I say "could be" because I have not used a pcWRT router. However, it is very much focused on security and costs only $129. More here.

Some brands to avoid: D-Link, Netgear, Tenda and Synology.

Many employees working from home are required to use a VPN installed on the company-provided computer. If not, the employee may want to look for a Work-From-Home router that can run VPN client software and connect to a commercial VPN provider (ProtonVPN, ExpressVPN, Mullvad, iVPN, etc). The VPN will hide all traffic from other devices in the home and from the ISP.

Some routers include VPN server software but this is for accessing a home network when away from home and not relevant at all to working from home.

CONFIGURING THE WORK-FROM-HOME ROUTER

Any router can be made more secure by adjusting assorted configuration options. The biggest items are perhaps WPS and UPnP, both of which should be immediately disabled. As for a Wi-Fi password, make it at least 20 characters long. The home page of my Router Security website has a short list of the most important security enhancing tweaks and much longer list for motivated techies to follow.

But, a router that is used solely to segment off a small number of work-from-home business devices, lends itself to some configurations that do not make sense elsewhere.

For example, MAC address filtering. This feature blocks devices from accessing the router even if they know the Wi-Fi password. Sophisticated attackers can bypass it, but not every attacker is sophisticated. When a router is used by dozens of devices, the bookkeeping involved in maintaining a list of MAC addresses, just does not pay - but it does make sense on a router used by a small number of devices.

Disabling DHCP falls into the same category. It only makes sense when the number of devices using the router is small. It too, is not a perfect defense, but again, every attacker is not a top techie.

Not broadcasting the Wi-Fi network name is, yet again, not perfect security, and something that only makes sense for a small number of devices.

If the person working at home is near their dedicated/inner router, then limit Wi-Fi to the 5GHz frequency band, because the signal does not bleed as much to the outside world. Some routers let you adjust the transmitting strength of the router. If so, make it as low as possible while still providing a strong signal in the area where it is needed.

To recap: the network name is hidden, the signal does not travel far, the password is very long, and, even if an attacker gets on the network, they need to clone a valid MAC address and bring their own IP address. Pretty secure.

Even with all that, Ethernet is more secure than Wi-Fi. Someone who uses an iPad and/or iPhone for work, might consider plugging it into the router via Ethernet. Adapters for this do exist.

- - - - - - -

Update: October 3, 2020: Although the point here is about security, let me add this Wi-Fi performance tip: the Wi-Fi network(s) on the inner/secure/second router should run on different channels than the networks used by the outer router. If possible, the inner router should only use one Wi-FI frequency band, again, to avoid interfering with the outer router.

If both routers use the 2.4GHz band, then each should be configured with a different fixed channel, either 1 or 6 or 11. Many routers default to picking a channel automatically, but from what I have seen, they do a poor job. Thus, to avoid interference, it is best to manually pick a channel for each router. More here. If both routers use the 5GHz band, then the channels should be different and fixed, and, in addition, the channel width should be relatively narrow (again to avoid interference). Narrow channels on the 5GHz band are 20MHz and 40MHz wide. Wider channels are 80 and 160MHz. Many, but not all, routers let you configure the channel width.

 

 

 @defensivecomput TOP Home => A second router for working from home   
 michael--at--michaelhorowitz.com   Last Updated: October 12, 2020 7PM UTC  
  License Plate
Copyright 2001-2020
Copyright 2001-2020  
Printed at:   October 26, 2020 1:44am   ET
Viewed 977 times since September 25, 2020 (32/day over 30 days)