An Easy Guide to Securing Your W

Free counter

An Easy Guide to Securing Your Wireless Home Network

www.logicworks.co.uk

System Requirements
Introduction
System Set Identifier (SSID)
Wired Equivalent Privacy (WEP)
Wi-Fi Protected Access (WPA)
MAC Address Filtering
How To Secure Your Wireless Network With Windows XP Running Service Pack 2
Configuring Security on a D-link DSL-G604T Wireless ADSL router
Configuring Security on a LINKSYS WGKPC354G WIRELESS-G ADSL router
Configuring Security on a Belkin F5D7630-4A ADSL Wireless router
Glossary of Terms

SYSTEM REQUIREMENTS

This guide is primarily aimed at home users running either Windows XP Home or Windows XP Professional. Users of older operating systems such as Windows 2000/98/Me will still benefit from the information in this guide, but these operating systems were developed before wireless communications were commonplace and therefore they do not have native support built in. Most wireless network card vendors however do support previous windows operating systems and you should use their supported client software in securing your network.

If you are a Windows XP user, I would strongly urge you to upgrade to service pack 2 (if you have not done so already) using Windows Update Software or visit http://www.microsoft.com/windowsxp/sp2/default.mspx and follow the download links. Apart from invaluable bug and security fixes, it also has a much superior support for wireless security and a new wizard based security setup tool to make life much easier. Examples in this guide are assuming that you are using the built in Windows XP (SP2) wireless networking tools.

INTRODUCTION

These days, wireless home networks are commonplace due to their relatively low cost, the desirability of a cable free environment and the ability to share one internet connection throughout your home. Unfortunately because the technology is aimed at the average home user who wants the system up and running out of the box as quickly as possible, manufacturers are forced to take a ‘one size fits all’ approach to the setup of their products. Compromises in security will inevitably happen as a result.

The most common situation is where a wireless network is left unsecured. In effect this means that ANY wireless device in range is able to connect to YOUR network. In real terms this would allow say your next door neighbour to connect to your pc and look through your files and folders, delete information or anything in effect you can do yourself on your pc. Assuming that you at least have some share level security on your files and folders, it is still very easy for them to use your internet connection for free even with little pc knowledge.

Most wireless access points (also known as routers) support certain levels of security which can be tailored to your specific needs and help keep intruders out.

In this guide we will be looking at the common various methods of wireless security and will go through step by step guides for three popular wireless routers available on the market at the time of writing.

SYSTEM SET IDENTIFIER (SSID)

Every manufacturer ships their device with a default username and password normally along the lines of username:admin password:admin. Therefore the first step to security is to change the default username and password as any casual internet user can look up the defaults on the manufacturers web site and wreak havoc on your wireless routers settings!

The next step would be to alter the name of the SSID. Your router will transmit a default name (SSID) something along the lines of Netgear, D-link, Belkin-g and so on and it is important that you change it to something unidentifiable to you or your network. Whereas something like smithfamily is a bad choice as it is identifiable to you, something less obvious such as smudge or flowers for example is a much better choice.

If your router supports it, another security measure you could take is to close your network by disabling the router's ability to transmit the network name (SSID). All access points ship with a wireless beacon signal so that wireless PCs can easily find them. In effect, the signal is shouting 'I'm here! log on!' By turning the SSID (sometimes known as ESSID) off you are effectively closing your network to anyone who shouldn't have access, as your network is no longer visible. Obviously, it is best to do this once you have finished connecting all your wireless devices to your network.

Another good practice is to position the wireless access point towards the middle of your home and if possible avoid leaving it near a window. Metal and solid walls reduce the distance the wireless signal can travel. To test how far your wireless network 'leaks' out of your house, you can walk round the outside of your property with a wireless equipped laptop and see how far you can walk before losing the signal. You may be shocked!!

WIRED EQUIVALENT PRIVACY (WEP)

The original form of securing your network is by using a WEP key. This is a string of random numbers and letters (0-9, A-F) to form an encryption key. Some routers also make it easier to create the encryption key by using a ‘passphrase’. This would take a desired name such as ‘newnetwork’ for instance and convert it into an encryption key. After you have defined your chosen key in your access point, each wireless workstation or device on your network will prompt you to type in the encryption key to be able to connect. Most devices support 64,128, and for newer routers, 256-bit key encryption. The bit rate essentially forms the length of the key required to secure your network (10 hexadecimal digits for 64-bit, 26 for 128-bit and 58 for 256-bit). After enabling this feature it allows traffic to pass through your network in an encrypted form. Although with freely available tools on the internet it is quite possible for the encryption keys to be ‘cracked’, so newer devices have an infinitely stronger encryption system known as Wi-fi protected access (WPA) and is therefore the preferred method of encryption. Another short-coming of WEP is that it can be a bit tricky to set up and can cause confusion and frustration.

WI-FI PROTECTED ACCESS (WPA)

In an effort to address all the shortcomings and weaknesses of WEP, newer access points and related wireless devices have the option of WPA (Wi-Fi Protected Access or sometimes also known as Wireless Protected Access). It must be noted that WEP and WPA cannot coexist and it is up to you which one to use.

WPA is available in two forms. The first is known as WPA-PSK aimed at the home or small office user. The second type is WPA (radius). This is aimed at the the medium to large business market and requires an additional piece of hardware configured as a radius server to allow authentication and encryption. This latter system is beyond the scope of this guide, therefore we will be concentrating on the WPA-PSK method of encryption.

WPA-PSK uses a system of Pre-Shared Keys (PSK) which though similar to the passphrases or shared keys of WEP, are altogether more secure. This is because the pre-shared keys are not actually used to encrypt the data, but instead are used to create ever changing ciphers, so it is almost impossible to crack.

If your wireless access point and other wireless products supports this technology, you are advised to use this preferred method. On older wireless devices that at first do not appear to have WPA support, it may be worth checking manufactures web sites for driver and/or firmware updates. If you are running WindowsXP with service pack 1, there is a Windows security update patch for free download that allows WPA encryption. You can download this from www.microsoft.com If you are running WindowsXP with service pack 2, WPA encryption is already supported. Older operating systems such as Windows 2000/98/Me do not support wireless networking natively. Please refer to your manufacturers guide that came with your wireless network card to see if WPA is supported.

MAC ADDRESS FILTERING

Another security measure commonly used is MAC address filtering. Every network card ever made, wired or wireless, has a unique address hardwired into the card. It takes the form of 00:00:00:00:00:00, so a typical address would be 00:A3:F3:07:5B:C9. The address of your network card can usually be found printed on the network card itself (if you have a removable device), or some laptop computers have it printed on the underside of the machine itself. If you cannot locate the MAC address, an easy way of finding it is by going START > RUN and type cmd followed by pressing return or clicking OK (on older Windows 98 or Windows Millennium Edition machines please type command in the run box instead). This will bring up a command line box. Type ipconfig /all followed by return (Windows XP/2000) or winipconfig for Windows 98/Me and you will be see the MAC address in the text as follows.

Then press OK

A dos dialog box will appear as below. Then type

ipconfig /all followed by return.

You will see that from the above there are two network adapters installed. The first adapter is a standard Ethernet wired type connection, and the second is the wireless connection. On a piece of paper write down the MAC addresses and keep to one side. Close the dialogue box by clicking the x in the top right hand corner of the screen. The great thing about MAC address filtering is that you get to choose which network cards gets permission to use your network.

In order to implement this you, need to get into your wireless access points management console. To get to the management console most routers require you to type an address in your internet browser. Please refer to your manufacturers handbook on how to do this. Once you are into the management console look for something along the lines of Client Access List, Advanced security, MAC address filtering etc. If in doubt consult your manufacturers handbook to find the relevant section. It must be noted that if you have any network printers, wireless equipped printers or other devices that are network enabled you must add their MAC addresses to the list in the access point too, otherwise they will not be seen by the network.

How To Secure Your Wireless Network with Windows XP running Service Pack 2

Securing your wireless network was made considerably more easier with the advent of Windows XP running service pack 2 in the form of a wizard based system. To check what version of Windows you are running, do the following

Start > Run >

In the box type winver

followed by OK

you should see a box similar to this

As you can see this version of Windows does have Windows XP with Service pack 2

close the dialog box

In order for the wizard to work effectively you are also going to need a USB flash drive (also known as memory key or a thumb drive) or some other kind of removable media. USB flash drives are available from all good computer stores for only a few pounds.

Note: It is recommended that you first set up your wireless access point with your new SSID, WPA or WEP security manually before embarking on the following steps, as most routers don't support the fully automated method. Details on how to do this with a few example wireless access points can be found later on in this guide.

Assuming you have chosen WPA security over WEP, do these steps in order.

1 Right-click your wireless network connection (normally found in the bottom right corner of your screen), and then click View Available Wireless Networks.

2 Under Network Tasks, click Set up a wireless network for a home or small office, and then click Next on the Welcome screen.

3 If prompted choose Set up a new wireless network

4 In the Network name (SSID) type in the name you have chosen to call your wireless access point as shown below

5 Click Manually assign a network key.

6 Select the Use WPA encryption instead of WEP check box, then click Next.

7 Clear the Hide characters as I type check box.

8 Type in the WPA passphrase into the Network key and Confirm network key fields as shown. Click Next

Note: It is more desirable from a security point of view to use the 64 characters using 0-9 and A-F, than to choose between 8 to 63 characters (although this is much easier to remember and type in). So another alternative would be something like

9 Select Use a USB flash drive (or if you don't have removable storage) select Set up a network manually. Make sure you print out the settings you have created for safe keeping and for setting up additional computers

10 Plug in the USB flash drive when prompted, complete the wizard pages, and safely remove the USB flash drive.

Follow the instructions as given in the screen shot above. It must be noted that most Wireless Access Points do not support the automatic transfer as many wireless access points haven't a got a USB connecter. Therefore you are better off configuring your wireless access point first manually and making a note of the settings and keys as you go along before starting this wizard, again check the documentation you got with your router to see if it supports this feature.

You can now configure the other computers automatically using the USB flash drive. To do this:

1 On each additional computer running Windows XP with Service Pack 2, plug in the USB flash drive. The Wireless Network Setup Wizard should start automatically.

2 In the event that you have different types of content stored on your USB drive, Windows XP will show a list of choices. Select the Wireless Network Setup Wizard

Click OK to add a computer to the network name displayed as below

Windows will do the rest, including configuring the SSID and WPA passphrase and adding the network to the list of preferred wireless networks. When this finishes, a connection to the wireless network is automatically established.

Configuring Security on a D-link DSL-G604T Wireless ADSL Router

Changing the Default Username and Password

Go to your preferred browser such as Internet Explorer and in the address bar type

192.168.1.1 then press go

The default login name for this router is admin. The default password is admin. Enter these details and login.

On the tabs across the top choose tools then on the left panel choose user management

Change your User Name and Password to your preferred choice (and make a note of the changes) then hit Apply

To make these changes permanent, you need to select System Commands (top left button) and choose Save All

then choose to logout. Log back in with your new settings to make sure the changes have been made

Changing the Default SSID

The default SSID for this model of router is G604T_WIRELESS. Now change the SSID to a suitable non-identifiable name and apply the settings, then permanently save those changes (as before). It is also worth mentioning that you can change the channel the router transmits on. Most manufacturers favour channel 6 and channel 11. It may be worth changing it to a less used channel such as 3 for an added security measure and to reduce crosstalk (interference) with other routers transmitting in the same airspace.

Configuring WPA Security

Under setup (top tabs) and wireless (left tabs) choose the radio button WPA then apply

Choose either the PSK Hex (pre-shared key) or PSK String. For ultimate security choose the PSK Hex. You need to very carefully type 64 random characters that must only form 0-9 and A-F. I would recommend you write it down first in a word document or as a notepad document, check very carefully it is exactly 64 characters without any illegal characters (this brand of router doesn't check user errors and could render the unit being totally locked out if you make a mistake)! Copy then paste it into the Hex box as shown below. A good example is a23017ffeb4904cd3af467875bbd186f6fd3628100ffccd7148c1d1f6526cfde then choose apply On this particular model of router you also need to restart the AP service for any changes to be kept. To do this go to tools (top tabs) system commands (left tabs) and choose restart AP. Then logout and close your browser.

If you choose PSK String, this allows you to type a name from 8 characters to 63 characters. The longer the name is, the more secure your network will be. For home network security aim for around 20 characters as this is more than adequate to keep out the casual hacker!

Once you have typed your preferred string, choose apply. Again on this particular model of router you also need to restart the AP service for any changes to be kept. To do this go to tools (top tabs) system commands (left tabs) and choose restart AP. Then logout and close your browser.

Don't be tempted to choose the Save All command until you have tested that you can re-access your network after the changes have been made. To check whether your new security is working, right click on your wireless network connection (bottom right hand corner in the task bar) and choose view available wireless networks. You should see a screen similar to the one below. Note that the G604T_Wireless network now shows it has security enabled

Highlight your new secured network and hit connect and you should see the following box appear.

Type in your WPA key you set in the router. In this case 'mynewnetwork19293949' and then connect. If you decided on the WPA hex then type your chosen hex value. In the example earlier, this was a23017ffeb4904cd3af467875bbd186f6fd3628100ffccd7148c1d1f6526cfde. Bearing in mind that Windows won't let you view the characters as you type, this can be a challenge in itself. To make life easier cut and paste the key in.

This may take a minute or two to connect then you should see this box.

To make these changes permanent you need to log back into the router then select System Commands (top left button) and choose Save All

Configuring WEP Security

NOTE: The preferred security networking method is WPA. ONLY use WEP if any of your networking devices do not support WPA!!!

The process is similar to configuring WPA security. Log into the router and choose Setup (top tabs) Wireless (left tabs) Choose WEP for the security and you will be presented with a box as below

Tick on the box which says Enable WEP Wireless Security, set the cipher to 128 bits and in the first box type 26 hexadecimal characters as in the example below. Set the authentication box to Shared.

Apply the changes and restart the AP service, then log out.

Right click on your wireless network connection (bottom right hand corner in the task bar) and choose view available wireless networks. You should see a screen similar to the one below. Note that the G604T_Wireless network now shows it has security enabled

Highlight your new secured network and hit connect and you should see the following box appear.

Type in your WEP key you set in the router and then connect.

This may take a minute or two to connect.

If you don't get the dialogue asking for the network key (Windows does have a small bug here) do the following:

Right click on your wireless network connection (bottom right hand corner in the task bar) and choose view available wireless networks. In the left pane under related tasks choose change advanced settings. Under the Wireless networks tab select your network and choose properties.

Make sure that the credentials you set in the router match the credentials here. Quite often it is necessary to re-type the network key again. When done click OK and try to reconnect.

When you are satisfied that you can successfully connect to the network, don't forget to permanently save the changes to the router.

If you are still having difficulties in connecting, right click on your wireless network connection (bottom right hand corner in the task bar) and choose repair. This action clears all current network settings, renews your ip address and tries to reconnect you. If your still encountering difficulties try re-booting your computer and try connecting again.

Configuring Mac Address Filtering

In this section we are going to configure your router (wireless access point) to accept only approved network cards to gain access to your network.

For an ultra secure network use both WPA and MAC address filtering.

Login to your router and choose advanced (top tabs) and wireless management (left tabs) and tick enable access list. Now in the mac address box type each mac address you want to allow access to your network in the form of 00-00-00-00-00-00. As mentioned earlier, you can find out the mac addresses by typing the ipconfig /all command on each computer that you want to have network access to. Write each address down before starting. Don't forget you need to add wired and wireless adapters and also don't forget to add any direct network enabled printers. If you have a network enabled printer, follow your manufacturers guide to find out the mac address. Stand alone printers are not affected as they don't broadcast a mac address.

When finished choose Apply and restart the AP service. When satisfied the changes made are working correctly and everything on your network is working properly, make the changes permanent to your router.

Configuring Security on a LINKSYS WGKPC354G WIRELESS-G ADSL Router

Note: This router comes with a wizard based front end that enables you to setup your wireless network and security settings in an easy step by step routine. I recommend running through those steps.

To manually configure the settings follow the guide below:

Changing the Default Username and Password

Go to your preferred browser such as Internet Explorer and in the address bar type:

192.168.1.1 then press go

the default login name for this router is admin. The default password is admin. Enter these details and login.

Choose administration on the menu across the top and you will be presented with this box. Change the default gateway username and password to your preferred choice and then save settings (found at the bottom of the screen).

Note: Unlike the D-link DSL-G604T router, when you make changes to any configuration, the Linksys router permanently saves any changes as soon as you choose save changes.

Changing the Default SSID

Login to your access point again. On the top menu choose Wireless and on the submenu choose Basic Wireless Settings.

The default SSID for this model of router is linksys. Now change the Wireless Network Name (SSID): to a suitable non-identifiable name, and choose save settings. It is also worth noting that you can change the channel the router transmits on. Most manufacturers favour channel 6 and channel 11. It may be worth changing it to a less used channel such as 3 for an added security measure and to reduce crosstalk (interference) with other routers transmitting in the same airspace.

Configuring WPA Security

On the top menu choose Wireless and on the submenu choose Wireless Security. Under Security Mode choose Pre-Shared Key and in the Shared key box choose your preferred encryption key between 8 and 63 characters. The longer the name is, the more secure your network will be. For home network security aim for around 20 characters as this is more than adequate to keep out the casual hacker! When done choose Save settings. Leave the Group Key Renewal at its default values.

To check whether your new security is working, right click on your wireless network connection (bottom right hand corner in the task bar) and choose view available wireless networks. You should see a screen similar to the one below. Note that the linksys network now shows it has security enabled.

Highlight your new secured network and hit connect and you should see the following box appear:

Type in your WPA (pre-shared key) you set in the router. In this case 'mynewnetwork19293949' and then connect.

This may take a minute or two to connect then you should see this box.

This may take a minute or two to connect.

If you don't get the dialogue asking for the network key (Windows does have a small bug here) do the following:

Make sure that the credentials you set in the router match the credentials here. Quite often it is necessary to re-type the network key again. When done click OK and try to reconnect.

Configuring WEP Security

NOTE: The preferred security networking method is WPA. ONLY use WEP if any of your networking devices do not support WPA!!!

The process is similar to configuring WPA security. Log into the router, on the top menu choose Wireless and on the submenu choose Wireless Security. Under Security Mode choose WEP. I would recommend that you use 128-bit encryption. Decide upon a suitable passphrase and let the router add the hexadecimal keys by hitting the Generate button as shown below. When done choose Save settings.

Highlight your new secured network and hit connect and you should see the following box appear.

Type in your WEP key you set in the router. In this case '08ccea32d1752497074fb8d09d' and then hit connect.

This may take a minute or two to connect.

If you don't get the dialogue asking for the network key (Windows does have a small bug here) do the following:

Make sure that the credentials you set in the router match the credentials here. Quite often it is necessary to re-type the network key again. When done click OK and try to reconnect.

Configuring Mac Address Filtering

In this section we are going to configure your router (wireless access point) to accept only approved network cards to gain access to your network.

For an ultra secure network use both WPA and MAC address filtering.

Login to your router. On the top menu choose Wireless and on the submenu choose Wireless Access. Click the permit only radio box as shown and then select the Grey box which says Edit Mac Address Access List.

Now in the mac address filter list type each mac address you want to allow access to your network in the form of 00:00:00:00:00:00. As mentioned earlier, you can find out the mac addresses by typing the ipconfig /all command on each computer that you want to have network access to. Write each address down before starting. Don't forget you need to add wired and wireless adapters and also don't forget to add any direct network enabled printers. If you have a network enabled printer, follow your manufacturers guide to find out the mac address. Stand alone printers are not affected as they don't broadcast a mac address.

This router has a handy scan button called Wireless Client MAC List that automatically detects wireless network adapters by their mac address and gives you the option to add it to the list. Hit the button and add or deny wireless devices you want on your network.

When done choose close and then Save Settings.

This router also has some extra security settings that allow blocking of internet access. You may find this useful and you can find it by going to Access Restrictions and then choosing Internet Access on the sub menu. Its quite self-explanatory and allows you to target specific computers by their mac address or ip address to restrict access to your chosen pc's.

Configuring Security on a Belkin F5D7630-4A ADSL Wireless Router

Changing the Default Password

Go to your preferred browser such as Internet Explorer and in the address bar type

192.168.2.1 then press go

By default this wireless router has a blank password. Leave the box empty and hit 'Submit'

On the left hand side under the main menu, choose Utilities and under the sub menu choose System Settings. Leave the current password blank, type in your new password, confirm then choose Apply Changes

Note: Unlike the D-link DSL-G604T router, when you make changes to any configuration, this Belkin router permanently saves any changes as soon as you choose Apply Changes.

Changing the Default SSID

Login to your access point again. On the left hand side under the main menu, choose Wireless and under the sub menu choose Channel and SSID. Here you can change the Wireless channel, change the SSID, and choose whether or not to broadcast the SSID. This router also gives the option of using nitro-g. By default it is switched off and should only be switched on if your wireless network cards support this technology. Once you are satisfied with your changes choose the Apply Changes button.

Configuring WPA Security

On the left hand side under the main menu, choose Wireless and under the sub menu choose Security. Under the Security Mode drop-down box, select WPA-PSK (no server)

Un-tick the box which says obscure PSK, so you can see what you type, then in the Pre-shared key (PSK) box choose your preferred encryption key between 8 and 63 characters. The longer the name is, the more secure your network will be. For home network security aim for around 20 characters as this is more than adequate to keep out the casual hacker! When done choose Apply Changes

Highlight your new secured network and hit connect and you should see the following box appear.

Type in your WPA key you set in the router. In this case 'mynewnetwork19293949' and then connect.

This may take a minute or two to connect.

If you don't get the dialogue asking for the network key (Windows does have a small bug here) do the following:

Make sure that the credentials you set in the router match the credentials here. Quite often it is necessary to re-type the network key again. When done click OK and try to reconnect.

Configuring WEP Security

NOTE: The preferred security networking method is WPA. ONLY use WEP if any of your networking devices do not support WPA!!!

The process is similar to configuring WPA security. Log into the router and on the left hand side under the main menu, choose Wireless and under the sub menu choose Security. Under the Security Mode drop-down box, select 128-bit WEP

Decide upon a suitable passphrase and let the router add the hexadecimal keys by hitting the Generate button as shown below. When done choose Apply Changes.

Highlight your new secured network and hit connect and you should see the following box appear.

Type in your WEP key you set in the router. In this case '4d8a6a453b4c9df632b119b82f' and then connect.

This may take a minute or two to connect.

If you don't get the dialogue asking for the network key (Windows does have a small bug here) do the following:

Make sure that the credentials you set in the router match the credentials here. Quite often it is necessary to re-type the network key again. When done click OK and try to reconnect.

Configuring Mac Address Filtering

In this section we are going to configure your router (wireless access point) to accept only approved network cards to gain access to your network.

For an ultra secure network use both WPA and MAC address filtering.

Login to your router. On the left hand side under the main menu, choose FireWall and under the sub menu choose Mac Address Filtering. Click the Enable radio button then enter your mac addresses. As mentioned earlier, you can find out the mac addresses by typing the ipconfig /all command on each computer that you want to have network access to. Write each address down before starting. Don't forget you need to add wired and wireless adapters and also don't forget to add any direct network enabled printers. If you have a network enabled printer, follow your manufacturers guide to find out the mac address. Stand alone printers are not affected as they don't broadcast a mac address.

This router also has a handy feature that can pick up all DHCP enabled computers on your network and gives you the option of copying them in without the need to type it manually.

When satisfied with your list choose Apply Changes at the bottom of the page.

Glossary of terms

Wireless Access Point

Also known as an ADSL router or a hardware device capable of broadcasting a wireless signal.

WEP Wired Equivalent Privacy

Simple legacy form of encryption to protect a wireless network using encryption keys, though easily cracked.

WPA Wi-fi Protected Access

More sophisticated form of encryption using ever changing encryption keys employed by newer wireless devices.

PSK Pre-Shared Key

Term to define the passphrase used in the encryption process.

Mac Address

Hard Wired physical address of the network device.

Mac Address Filtering

Method in which you can filter network adapters from having or not having access to the network.

DHCP Dynamic Host Configuration Protocol

Most routers are capable of assigning a network address automatically (dynamically) to the client machines or printers on a network without the need to specify a static IP address.

IP Address

Unique address your computer or other networked devices must have to be visible on any TCP/IP network. It takes the form of xxx.xxx.xxx.xxx

Ad hoc Wireless Network

Method employed to connect computer by computer wireless networks without the need for a stand-alone Wireless Access Point.

SSID System Set Identifier

Network name that is broadcasted to available clients by the wireless access point

Free counter