1. You are viewing our forum as a guest. For full access please Register. WindowsBBS.com is completely free, paid for by advertisers and donations.

Comparing Routers

Discussion in 'Security and Privacy' started by BillyBob, 2004/02/07.

Thread Status:
Not open for further replies.
  1. 2004/02/07
    BillyBob Lifetime Subscription

    BillyBob Inactive Thread Starter

    Joined:
    2002/01/07
    Messages:
    6,048
    Likes Received:
    0
    I put this in this Section as I have a tough time deciding whether it is more hardware or security related. I think Security.

    In another post Newt got me thinking ( unusual for me but that is another story ) when he mentioned replacing a working Router/Switch with a newer one because of the firewall.

    This testing is done with no software Firewall even installed ( at this time )

    I don't think the OS even has anything to do with this but I list them just in case. Testing involves a XP Pro machine and a Win98 SE machine.

    When I use a Linksys BEFSR41.

    We can play all LAN games between the two machine with no problems. Including Links 2001.

    With no software firewall we can play Links 2003 with our Friend in Canada from the XP machine ( won't run on the SE machine anyway ) with no proplem.

    When I use a D-Link704UP.

    We can play all games between the machines except Links 2001 and a Bowling game that we have.

    We can not connect to the Friend in Canada.

    Doing some checking on the two I read that;

    With the Linksys NAT acts as a Firewall

    With the D-Link it has a hardware firewall

    Is this telling me that the D-link is not only protecting us better from the Web side but also from the LAN side ?

    If this is the case then;

    With three machines on most of the time and three teenagers and one 7 year old using two of them I get the strong feeling that I should accept the slight inconvience ( which can be fixed by working at it ) and leave the D-Link in service because it appears to be much better protection.

    BillyBob
     
    Last edited: 2004/02/07
    BillyBob,
    #1
  2. 2004/02/07
    BillyBob Lifetime Subscription

    BillyBob Inactive Thread Starter

    Joined:
    2002/01/07
    Messages:
    6,048
    Likes Received:
    0
    Latest test results and more ideas.

    D-Link704UP

    According to GRC ALL ports except 1 are STEALTHED

    They aso explain why that one is only closed. I take it as that is an intentionally done by the Router.

    Symantec also reports all ports ( except the same one ) as STEALTHED

    This is BY FAR better ( I think ) than the same reports when using the Linksys BEFSR41 where all but a few ports were just [color-red]CLOSED[color]

    BillyBob
     
    Last edited: 2004/02/07
    BillyBob,
    #2


  3. to hide this advert.

  4. 2004/02/07
    TonyT

    TonyT SuperGeek Staff

    Joined:
    2002/01/18
    Messages:
    9,072
    Likes Received:
    400
    Doing some checking where?

    A NAT firewall (as in the Linksys) IS a hardware firewall.
    The DLink is ALSO a hardware firewall using NAT.

    They are both use NAT and thus are both hardware firewalls using NAT.

    Here's the DLink datasheet that tells that it uses NAT:
    ftp://ftp10.dlink.com/pdfs/products/DI-704UP/DI-704UP_ds.pdf

    If you can do one thing on one router and not do it on the other then:
    1. router misconfigured to do what you want it to do OR
    2. router does not have the required feature to do what you want it to do.
     
    Last edited: 2004/02/07
    TonyT,
    #3
  5. 2004/02/07
    TonyT

    TonyT SuperGeek Staff

    Joined:
    2002/01/18
    Messages:
    9,072
    Likes Received:
    400
    I use a linksys and all scans at all test sites will show my machione as stealthed. Port 113 (ident) will show as closed UNLESS you use port forwarding to forward port 113 requests to an unused ip such as 192.168.1.250. (way up the line an ip that will never ever get handed out to a DHCP client on the local network. Then all stealth results.
     
    TonyT,
    #4
  6. 2004/02/07
    BillyBob Lifetime Subscription

    BillyBob Inactive Thread Starter

    Joined:
    2002/01/07
    Messages:
    6,048
    Likes Received:
    0
    Hi there TonyT

    Looks like you and I were writing at the same time.

    Doing some checking where?

    At the Home site of each Router.

    Accroding to the reports ( in my previous reply ) there must be something different about the two.

    It may well be because my Linksys is an older model too.

    BillyBob
     
    BillyBob,
    #5
  7. 2004/02/07
    BillyBob Lifetime Subscription

    BillyBob Inactive Thread Starter

    Joined:
    2002/01/07
    Messages:
    6,048
    Likes Received:
    0
    I also forgot something.

    The D-Link does not allow Links Golf and a Bowling game to connect over the LAN like the Linksys did.

    So again. There must be some difference somewhere.

    With either one I just plugged them in and set them for DHCP and let the Router do the rest.

    Ain't that the way it is supposed to be ?

    BillyBob
     
    BillyBob,
    #6
  8. 2004/02/08
    TonyT

    TonyT SuperGeek Staff

    Joined:
    2002/01/18
    Messages:
    9,072
    Likes Received:
    400
    No, you must setup and configure the router according to your requirements. Routers are not entirely 'plug+play-connect+forget' hardware, they must be setup properly.

    For example, the default username and pasword in Linksys routers is insecure, the password is 'admin' and everyone knows that, so if you don't change it, anyone can access it. And some routers allow telnet or tftp connections, so the router can be accessed from anywhere in the world by anyone!
     
    Last edited: 2004/02/08
    TonyT,
    #7
  9. 2004/02/08
    TonyT

    TonyT SuperGeek Staff

    Joined:
    2002/01/18
    Messages:
    9,072
    Likes Received:
    400
    TonyT,
    #8
  10. 2004/02/08
    BillyBob Lifetime Subscription

    BillyBob Inactive Thread Starter

    Joined:
    2002/01/07
    Messages:
    6,048
    Likes Received:
    0
    First and foremost. Thank you TonyT for helping me out here.

    That was a rather non-thinking Question on my part.

    What I may have been thinking about was the DHCP side that assigns IP addresses to each NIC. ( that part does work just fine )

    But I think there must be a different in the Routers themselves somewhere.

    A check at GRC with the D-Link set at default returns all ports but 113 to be stealthed.

    If I enable the DMZ on the D-Link the same test comes back the same as the Linksys. ( most ports just clesed with a few open )

    But as I mentoned before, my Linksys is an okder model ( I think one of the first ones out )

    But I think the bpttom line is that I just need to get used to something new and different. And with help from you and others I will get things fixed up and working.

    ANd I want to keep the D-Link as it does have the Print server on it which I have had working.

    I looked at the site you pointed to and now all I need to do is figure out how to enter that data. And get in contact with out Friend and test it out. As I Links 2003 will not run on the 98SE machine. Well it will run but SLOWER the SLOW. The SE machine lacks both Procsesser Power and RAM.

    BillyBob
     
    BillyBob,
    #9
  11. 2004/02/08
    BillyBob Lifetime Subscription

    BillyBob Inactive Thread Starter

    Joined:
    2002/01/07
    Messages:
    6,048
    Likes Received:
    0
    In the Advanced/Application Section of the D-Link Router.

    Is this where I would enter the Info provided by the Link YonyT pointed me too ?

    From the page above.

    Enabled Disabled
    Name
    Trigger Port -
    Trigger Type TCPUDPBoth
    Public Ports
    Public Type TCPUDPBoth


    So it would look like

    Enabled

    Name=Links 2003
    Trigger Port = 6073
    Trigger Type= UDP

    Public ports= 2302-2400
    Public type = UDP

    I need ALL of the help I can get here as this is all new to me.

    BillyBob
     
    BillyBob,
    #10
  12. 2004/02/08
    Newt

    Newt Inactive

    Joined:
    2002/01/07
    Messages:
    10,974
    Likes Received:
    2
    Clarification. NAT is not a firewall although it will block some unwanted stuff in semi-firewall fashion and earlier SOHO router/switch devices would strongly imply that it was a good firewall or firewall substitute or similar phrase.

    Take a look at Router, NAT, Firewall discussion from the Networking section for details.
     
    Newt,
    #11
  13. 2004/02/08
    TonyT

    TonyT SuperGeek Staff

    Joined:
    2002/01/18
    Messages:
    9,072
    Likes Received:
    400
    Billybob
    I'm not familiar w/ the DLink configs, but try out the way you have it above and see what happens. Also, I believe there's no need to use DMZ for anything in order to game on the LAN, but DMZ is required to game on the LAN and allow other LANs outside the local network to play.

    Newt
    NAT, all by itself is not a firewall, it's a www standard for assigning a set of internal adrdresses and another set for external addresses. But NAT used in a router or broadband router/gateway IS a firewall by definition because one of the purposes of NAT is to hide internal addresses from exterior sources, or hide addresses from designated internal sources.


    Firewall defined:

    A system designed to prevent unauthorized access to or from a private network. Firewalls can be implemented in both hardware and software, or a combination of both. Firewalls are frequently used to prevent unauthorized Internet users from accessing private networks connected to the Internet, especially intranets. All messages entering or leaving the intranet pass through the firewall, which examines each message and blocks those that do not meet the specified security criteria.

    There are several types of firewall techniques:

    1. Packet filter: Looks at each packet entering or leaving the network and accepts or rejects it based on user-defined rules. 2. Packet filtering is fairly effective and transparent to users, but it is difficult to configure. In addition, it is susceptible to IP spoofing.
    2. Application gateway: Applies security mechanisms to specific applications, such as FTP and Telnet servers. This is very effective, but can impose a performance degradation.
    3. Circuit-level gateway: Applies security mechanisms when a TCP or UDP connection is established. Once the connection has been made, packets can flow between the hosts without further checking.
    4. Proxy server: Intercepts all messages entering and leaving the network. The proxy server effectively hides the true network addresses.
     
    TonyT,
    #12
  14. 2004/02/10
    Newt

    Newt Inactive

    Joined:
    2002/01/07
    Messages:
    10,974
    Likes Received:
    2
    Good info TonyT and thanks.

    Let me rephrase a little. For me, a router's NAT is not a good substitute for a stateful firewall. For me, a dedicated hardware firewall is a much better option than a software firewall.
     
    Newt,
    #13
  15. 2004/02/10
    TonyT

    TonyT SuperGeek Staff

    Joined:
    2002/01/18
    Messages:
    9,072
    Likes Received:
    400
    agreed
     
    TonyT,
    #14
  16. 2004/02/13
    BillyBob Lifetime Subscription

    BillyBob Inactive Thread Starter

    Joined:
    2002/01/07
    Messages:
    6,048
    Likes Received:
    0
    Latest report.

    I went back to a newer model of the Linksys BEFSR41 Router and all problems have left the scene. ALL games play between the machines. We played Golf with our Friend in Canada Tuesday evening and all went just fine.

    I lost of course. And YES I did play in the sand a time or two-:( But I got a 45 yard BIRDIE out of one bunker. But my Wife was just kind enough to make a 20 foot putt for a Birdie so we tied the hole.

    GRC and Symantec now report all ports ( except 113 ) to be stealthed. ( unlike the old Linksys where they were reported only closed.

    Both the LAN and the WAN are working MUCH smoother and faster.

    So it is on to the next project. A Print serveer. But I need to get a printer that is compatable with a server. The one I have is not. Or so I was impolitely told when I tried to set it up.

    Well, my Wife wants to play a game of Cribbage and that is a chalenge that I can't refuse.

    BillyBob
     
    BillyBob,
    #15
Thread Status:
Not open for further replies.

Share This Page

  1. This site uses cookies to help personalise content, tailor your experience and to keep you logged in if you register.
    By continuing to use this site, you are consenting to our use of cookies.
    Accept Learn More...