Asus Merlin guest wifi security bug

[Enrico85]

Hi guys, thanks for the great work.
I found a security bug in the wireless management of guest networks.

creating a guest network with disabled intranet, only traffic to the main subnet is blocked but not to the other subnets present (vpn server).

my network is:

home 1:
ont fiber 192.168.1.X
Asus RT-AC86U 192.168.2.X (main subnet) + 192.168.3.X (openvpn server) [firmware 384.17]

home 2:
ont fiber 192.168.5.X
Asus RT-AC86U 192.168.0.X (main subnet) + 192.168.4.X (openvpn server) [firmware 384.17]

routers create a site to site vpn network

on home 1 RT-AC86U (192.168.2.X) I activated a guest network with disabled intranet.
wireless guest clients fail to reach subnet 192.168.2.X but successfully reach other subnets (192.168.0.X, 192.168.3.X, 192.168.4.X)

for this reason I had to close the guest network and I had to use another device to create a wireless guest network. do you have any advice for this problem?

thanks

 

[Jack Yaz]

Hi guys, thanks for the great work.
I found a security bug in the wireless management of guest networks.

creating a guest network with disabled intranet, only traffic to the main subnet is blocked but not to the other subnets present (vpn server).

my network is:

home 1:
ont fiber 192.168.1.X
Asus RT-AC86U 192.168.2.X (main subnet) + 192.168.3.X (openvpn server) [firmware 384.17]

home 2:
ont fiber 192.168.5.X
Asus RT-AC86U 192.168.0.X (main subnet) + 192.168.4.X (openvpn server) [firmware 384.17]

routers create a site to site vpn network

on home 1 RT-AC86U (192.168.2.X) I activated a guest network with disabled intranet.
wireless guest clients fail to reach subnet 192.168.2.X but successfully reach other subnets (192.168.0.X, 192.168.3.X, 192.168.4.X)

for this reason I had to close the guest network and I had to use another device to create a wireless guest network. do you have any advice for this problem?

thanks

Try my script https://www.snbforums.com/threads/y...-merlin-guest-wifi-inc-ssid-vpn-client.45924/

 

[Enrico85]

excellent, it should be present by default!
thanks

 

[Enrico85]

I did other tests, the vpn clinets remain reachable (in my config 192.168.3.1 and 192.168.4.2 respond to ping).

The subnet 192.168.0.X is not reachable, great!

 

[Jack Yaz]

I did other tests, the vpn clinets remain reachable (in my config 192.168.3.1 and 192.168.4.2 respond to ping).

The subnet 192.168.0.X is not reachable, great!

They shouldn't be, as iptables and ebtables block traffic to those interfaces. how are you testing their connectivity? also PM me diagnostics and i can show you the firewall rules

 

[Enrico85]

hi, using kali on wifi ASUS_Guest2 (ip 192.168.12.227), with nmap I found the host 192.168.3.1

 

[Jack Yaz]

hi, using kali on wifi ASUS_Guest2 (ip 192.168.12.227), with nmap I found the host 192.168.3.1

View attachment 23292 View attachment 23293 View attachment 23294 View attachment 23297

Please send me diagnostics so that I can check firewall rules. Option d in YazFi

 

[Odkrys]

Currently, the router's ebtable seems to block only the main subnet.
It looks good to report to Asus and suggest adding rules to block the entire private network.
192.168.0.0/16, 172.16.0.0/12, 10.0.0.0/8

 

[Enrico85]

Please send me diagnostics so that I can check firewall rules. Option d in YazFi

hi, please send me on PM your email address to send you the report archive
thanks