This is a pretty good shortlist.
Thank you.
I would also disable WPS if you want to improve security even more (Asus's WPS implementation isn't as bad as it was a few years ago in the majority of home routers) as you probably won't be needing WPS.
That's right, I forgot about it, but I thought to disable it, because I don't use WPS.
I would recommend that you keep the SSID broadcast enabled however. Hiding it doesn't increase security in any way (and in some cases it actually reduces security as some computers end up broadcasting the SSID name as they try to connect to it), and it can lead to hard-to-find issues. A hidden SSID would still show up on any Wifi analyzer, it just would show a blank name - it won't hide the fact that the router is there.
I know it shows up on wi-fi analyzer, but it seems to me less "tempting" hidden than visible. But I take good note of your rightful explanations.
You could also disable UPnP if you want to aim for paranoid, however it can make some things more difficult to handle (such as torrenting). I use a very recent version of miniupnpd (1.8.20130426), so it's kept up-to-date (the only changes in the version released after that are bugfixes), and has no known security issues that I'm aware of.
I may use UPnP for my Synology NAS, but I don't think to have the use of it on my router. Do you use miniupnpd on JFFS?
Même la traduction Anglaise a quelques petits accrocs
(Even the English webui has a few oddities)
Ok, je n'ai pas encore eu le temps de tout explorer, j'ai plus eu un aperçu rapide des différents menus. Mais l'interface n'est déjà qu'à moitié traduite, alors avec les fautes en plus c'est largement plus compréhensible en anglais !
(Ok, I haven't scout about everything for now, I only had a brief look at it. The interface is only half-translated, and with the mistakes, it is rather understandable in english!)
What this does is that it throttles certain packets types (icmp, syn, ack, etc...) to a maximum of 1/s. Personally I wouldn't enable that - it's not worth the trouble. If you were really DDoSed, then there is nothing your router could do about it - only your ISP could take care of the typical multi-gigabit DDoS attacks that are used these days.
That's right.
It reminds me, the french company OVH is working on something interesting to
protect from DDoS.
Set it manually to the correct timezone.
Ok.
IMHO,
keep that enabled. It will only be accessible from the LAN side. So if someone is already on your LAN, it's already game over IMHO
If you're still worried, then generate an RSA keypair, and disable password login - log using the keypair. Probably overkill for LAN-only access however if you trust everyone at home.
Default is "No", but it seems "overkill" to me too. And I like CLI from times to times.
The Bruteforce protection will limit the number of connection attempts to the SSH port. It shouldn't have any noticeable impact on router performance.
Ok, I didn't saw any options on it, like connections attempts authorised per minute...
IMHO a big no-no. If you really want to give yourself remote access, then configure OpenVPN, and use a VPN tunnel to connect back home. Avoid PPTP - it's easily cracked these days.
Ok, I did not know that. I connect to my NAS from WAN on https with a genuine certificate, thus it will be the same problem?
A big thank you for your detailed answers!
OP, what kind of security are you concerned about? Keeping people with physical access to the router from altering it or using your LAN?
Physical access is impossible, using my LAN is pretty difficult, even with the RT-AC66U big reach.
Keeping out bandwidth thieves from your LAN?
Risk near zero.
Keeping out external attacks?
Yes, that's the thing. The only way to be sure about it is to unsubscribe from Internet, but I want to have my privacy, like every other people. Not that I have secret things to hide, I just want to be peaceful, so I am looking for security to be an uninteresting target from WAN. Plus, I find it interesting to know how it works and to configure it. On every way, I am never the kind of guy to buy something, and to play power without configuring anything and without reading the manual (or part of it, I am not masochist
).
Keeping people from sniffing your wireless traffic and reading your packets in transit?
Yes, even if the risk is low for me, I think everybody using wi-fi should know about that.
Are you in a densely packed urban neighborhood, i.e. apartment building in New York City?
Not in New York City.
I am in an apartment building. But without explaning personal details, the risk is low. WPA2-AES should be ok. But I take every advice interesting to strengthen wi-fi networks.
There's lots of different kinds of security...and depending on how likely you are to have a break in, and what manner of security you're concerned about there's many many many different methods you can take.
Yes, I know about that, you can take my demand like a general question about security for a nobody. If it were that important, I would not use this kind of hardware, not "public" hardware.
Thank you too.
