How Do I secure Hybrid WDS (Repeater) - ASUS AC68U ?

[Livin]

Using two ASUS AC68U routers in Hybrid WDS mode.

Current Methodology...
5GHz for the bridge/repeating (ZERO security is a problem! ASUS WDS requires no security)
Wired & 2.4GHz for clients (WPA2 Personal)


I have a LOT of wifi networks around me and concerned with security.

Is there a way secure the 5GHz network - maybe limit it to the MAC addresses of each router or ?

Really appreciate the help!

 

[azazel1024]

With no encryption, you cannot really secure it.

I'd say go with a router that allows encryption for WDS (TP-Link does, though I don't know of their compatiblity outside of one or two routers I've tested paired together in WDS bridge mode).

 

[Livin]

I would think there would be a way to limit MAC addresses?

 

[azazel1024]

Maybe/possibly. You could certainly do a MAC exclusion list for the entire router, which I assume would carry over to the WDS bridge.

However MAC whitelisting isn't really security. Duping a MAC is child's play. It is basically in the catagory of "slightly more secure than an open wifi, not really any more secure than WEP"

 

[htismaqe]

Yeah, MAC addresses are ridiculously easy to spoof.

I know DD-WRT allows for use of WPA2/AES with WDS.

 

[thiggins]

With no encryption, you cannot really secure it.

I'd say go with a router that allows encryption for WDS (TP-Link does, though I don't know of their compatiblity outside of one or two routers I've tested paired together in WDS bridge mode).

If you're going to try to get an encrypted WDS link, better use a pair of the same routers, especially if you are going to try for WPA2/AES. Secure WDS implementations are basically proprietary.

 

[htismaqe]

If you're going to try to get an encrypted WDS link, better use a pair of the same routers, especially if you are going to try for WPA2/AES. Secure WDS implementations are basically proprietary.

Yeah, I believe the standard WDS implementation only allows for WEP or no security at all.

 

[thiggins]

Yeah, I believe the standard WDS implementation only allows for WEP or no security at all.

Static WEP keys are supported only.

 

[htismaqe]

Static WEP keys are supported only.

Hard to remember, haven't used WDS in probably 6 or 7 years.

 

[Livin]

Static WEP keys are supported only.

I cannot find any way to use WEP... it does not exist in the drop down options for the radio. How do I do it?

 

[stevech]

Some routers from the M2M world, such as Cradlepoint and others, can create an encrypted tunnel. No reliance on one-hop shared key encryption in the link layer, but rather, using layer 2 or 3 security.

 

[azazel1024]

If you're going to try to get an encrypted WDS link, better use a pair of the same routers, especially if you are going to try for WPA2/AES. Secure WDS implementations are basically proprietary.

I deffinitely agree. I'll expand it to say same manufacturer might be okay. Same chipset manufacturer and same router manufacturer better. Exact same router, best.

I've had success across a couple of TP-Link routers (WDR3600 to/from Archer C8 works great. WDR3600 to WDR3600 works great, 841ND to either also works. 1 of 3 TP-Link Range Extenders I've tried worked in WDS mode, the other two failed when attempting WDS).

I always only test WPA2/AES.

 

[azazel1024]

It likely isn't supported by your routers at all (for WDS).

 

[powerleakin]

Hey yeah to add to what others have said, it's really depends on the manufacturer.

I have an Asus RT-N56U that while powerful, only supports WDS unsecured.

But I have had good success with Buffalo, particularly WZR-HP-G300NH, I used 2 of the same kind and they do rock solid WDS. But I think that model is discontinued now, so check the specs of the latest ones.

A good way to find out before laying down the cash is to try to download the manual of the models you are looking at and dig in to see whether they allow WDS with encryption. Or you could just email their tech support...

And yes I would recommend going for the same models or at least the same manufacturer for maximum compatibility. WDS tends to be on the grey side of things when it comes to interoperability.

Hope this helps!