Understanding router access via computer

[jimmyb2]

My knowledge of networking is extremely limited thus I need some help to understand what is happening when I use my computer to access my Asus GT-AXE16000 router which is on the 388.2.2.rog version of Asuswrt-Merlin.

I was under the impression that when I open a browser (using Brave browser), type 192.168.50.1 into the address bar, and press "Enter" it would go directly to the router and open the router login screen without going out on the internet.

When I do that the browser shows the login screen to my router. However, in the address bar it now shows "Not secure | http://www.asusrouter.com/Main_Login.asp". Then when I enter my username and password the browser opens up to the router "Dashboard" screen. So I am now logged into the router, but the browser address bar now shows "Not secure | http://www.asusrouter.com/GameDashboard.asp". The information in the address bar looks to me that it is going out on the internet for some reason in order to access the router.

My question: Is my computer going out to the Asus website or anywhere else on the internet before accessing the router, or is it accessing anything on the internet in order to access my router?

If it is, in fact, going out on the internet is there anyway to stop this and directly access the router only?

 

[L&LD]

Yes, the router GUI is not secure, as stated by your browser.

To test if it needs to 'go to the internet', to access your router, simply unplug the WAN. (It doesn't).

 

[ColinTaylor]

My question: Is my computer going out to the Asus website or anywhere else on the internet before accessing the router, or is it accessing anything on the internet in order to access my router?

No it is not going out to the internet. When you log into the GUI using its IP address it translates that to www.asusrouter.com which is a local name defined on the router itself.

Your browser is giving you the "Not secure" warning because you are connecting to the router using HTTP rather than HTTPS.

 

[jimmyb2]

Thank you. I was worried about that. Much relieved now.

 

[heysoundude]

when you get there, you'll be able to use Let's Encrypt to generate an SSL cert for your router and make that issue go away

 

[drinkingbird]

Thank you. I was worried about that. Much relieved now.

Others have already covered most of it but for your own understanding, most browsers nowadays warn you when you are on an http site instead of https. Some browsers are more aggressive about it. This in and of itself is not a security risk per se - just warning you not to put in sensitive information on that site.

You can even set many browsers to automatically replace http with https. However the asus by default is only listening on http, so that's why you're getting that warning.

Hardwired to the router there is near 0 chance anyone could snoop your login/password, but as @heysoundude mentioned, you can generate your own free SSL certificate and enable (even force) HTTPS in the router itself. In fact, even if you don't generate a certificate, it will work, but your browser will show you a different (and more dire) warning. In that case, you actually ARE very secure, it is just warning you that the default certificate on the Asus is not trusted and thus is a risk of being a malicious site (but it isn't in this case). This happens with lots of gear as they aren't going to pay for an annual trusted cert for every device they sell, they're just going to use a "self signed" one which is just as secure, but results in that warning (since anyone can generate a self signed cert, they are often used for malicious purposes).

To totally eliminate the warning, generate the letsencrypt certificate then turn on HTTPS and disable HTTP in the settings (or you can leave both enabled but use https). But not really anything to worry about, I use http to mine, I'm not using a password I use for anything else and even if I was, the chances that anyone in my neighborhood are skilled and bored enough to be using a man in the middle + KRACK attack to break my WPA2 are extremely low (and I'd notice the MITM, since I'm not the type to go hey, that's weird, I'm connected to a lower strength wifi signal and it has no internet access, but then it went full strength and my access was back, guess all is well).

Basically, you're already more secure than the phone app was, not really anything to worry about, even over wifi (as long as your wifi is decently secured). But certainly can't hurt to get https set up if you want to. If you now or ever use DDNS that same certificate can be used to secure your DDNS updates too.

 

[jimmyb2]

Others have already covered most of it but for your own understanding, most browsers nowadays warn you when you are on an http site instead of https. Some browsers are more aggressive about it. This in and of itself is not a security risk per se - just warning you not to put in sensitive information on that site.

You can even set many browsers to automatically replace http with https. However the asus by default is only listening on http, so that's why you're getting that warning.

Hardwired to the router there is near 0 chance anyone could snoop your login/password, but as @heysoundude mentioned, you can generate your own free SSL certificate and enable (even force) HTTPS in the router itself. In fact, even if you don't generate a certificate, it will work, but your browser will show you a different (and more dire) warning. In that case, you actually ARE very secure, it is just warning you that the default certificate on the Asus is not trusted and thus is a risk of being a malicious site (but it isn't in this case). This happens with lots of gear as they aren't going to pay for an annual trusted cert for every device they sell, they're just going to use a "self signed" one which is just as secure, but results in that warning (since anyone can generate a self signed cert, they are often used for malicious purposes).

To totally eliminate the warning, generate the letsencrypt certificate then turn on HTTPS and disable HTTP in the settings (or you can leave both enabled but use https). But not really anything to worry about, I use http to mine, I'm not using a password I use for anything else and even if I was, the chances that anyone in my neighborhood are skilled and bored enough to be using a man in the middle + KRACK attack to break my WPA2 are extremely low (and I'd notice the MITM, since I'm not the type to go hey, that's weird, I'm connected to a lower strength wifi signal and it has no internet access, but then it went full strength and my access was back, guess all is well).

Basically, you're already more secure than the phone app was, not really anything to worry about, even over wifi (as long as your wifi is decently secured). But certainly can't hurt to get https set up if you want to. If you now or ever use DDNS that same certificate can be used to secure your DDNS updates too.

Thank you. I greatly appreciate the detailed explanation. I am using ethernet cable from computer to router. I had tried to use https by typing it out in the address bar, but as you intimated the router would not answer. However, I do intend to attempt setting up https per your and other's suggestions.

 

[ColinTaylor]

You don't have to use Let's Encrypt to generate a certificate. There's an option in the GUI to export a local certificate that you can use. This is what I do.

[Troubleshooting] How to fix opening ASUS Router WEB GUI appears “Your connection is not private” | Official Support | ASUS Global

 

[drinkingbird]

You don't have to use Let's Encrypt to generate a certificate. There's an option in the GUI to export a local certificate that you can use. This is what I do.

[Troubleshooting] How to fix opening ASUS Router WEB GUI appears “Your connection is not private” | Official Support | ASUS Global

True. I think you can even go into the warning and "trust" the root CA of the certificate but that may depend on browser. I used to do it when I ran some of my own stuff, but haven't bothered since then. This wouldn't work for DDNS but sounds like the OP isn't using that anyway. My DDNS is just using HTTP and I use their unique key instead of my password. Don't think anyone is going to bother updating my DDNS IP for a MITM attack now that my home domain is just for my own remote access use.