Hacker News Reader

Comment by ohthehugemanate | Hacker News Reader

Personally I got tired of fighting my ISP for control of my router. Between CWMP and DOCSIS, I just gave up. So now I put my own NAT device/firewall behind the router, and treat that outer 192.168.1.0 subnet, DHCP, DNS, etc as if they were public. My home network starts at _my_ router.

In various periods of distrust for my ISP, I have also run the external interface of my NAT through a public VPN provider, and added monitoring to look for connection slowdowns or open ports on the router, as evidence of a compromise. So far it's just been jumping at shadows, though.

View on HN

When I had cable internet DOCSIS only configured this cheap "modem" box that I bought. It pretty much was just an adapter that turned the cable connection into an ethernet one. It sounds to me like people in this thread are buying routers with a built in modem and that creates a security problem because of how DOCSIS allows firmware uploads?

All DOCSIS devices by design only accept firmware uploads from the ISP they're connected to, you can't just log into the web UI on them and upload a firmware file

Regular modems are the least annoying bet however. They simply hand over an IP address and then act as a transparent coax <--> Ethernet bridge

minor edit: changed "vendor" to "ISP" to avoid confusion

The majority of ISP-issued gateways/routers will happily run in "gateway"/"passthrough" mode, where pretty much everything is disabled and it passes your (globally routable) IP down through the first ethernet port.

I just bought a second router, put it behind the ISP-provided router, then mark the new router's ip address as DMZ. Works pretty well so far.

A bit off topic but my ISP is a big fan of MikroTik routers. IIRC MikroTik had 1 or 2 0-days a few years back that let you get root. Sure enough my ISP decided to leave their http and WinBox (config tool) ports open to everyone downstream - easy target.

I contacted them and told them to upgrade the router and close the ports. Didn't get a reply but the ports were closed after a while so I thought that was that.

Fast forward to a few weeks back - I was playing around with RoMON settings on my MikroTik router (it's their proprietary protocol for debugging/proxying/chaining routers behind nat so if you mess up the config you can still access it). Lo and behold - over 150 MikroTik routers, all one hop way from each other, all with RoMON on for all ports. All over the city judging form the AP names. All outdated as well.

And to make matters worse - they hadn't even upgraded the one router upstream from me that I complained about in the first place!

Surprising amount of distrust of CWMP in this thread. As someone who implemented this and manages it at an ISP we really only use it to configure the WAN or VoIP connections.

Well yes but nothing prevents you from, for example, changing both user's passwords so they can't log in to even change WiFi password. [1]

Needless to say, I don't trust it and disable it whenever I can. I can set up my PPPoE or VoIP access myself.

[1] https://milankragujevic.com/uploads/oKazARE_.png

Yes, agreed technical people are fine. Most users struggle with basic setup so it's a win for them. Personally, why would I do anything hostile that generates support calls?

Agreed. For most people remote management is a life savior. But hostile can also be company policy, i.e. rewriting DNS servers every hour, etc.

I've been trying to set up something similar, do you have any advice for decent VPN providers? Each one I try caps out well below my bandwidth limit. For now, I've just been selectively routing specific non-TLS traffic over the VPN, but I know that's not necessarily a bulletproof practice.

I use PrivateInternetAccess (yes I know they were bought by a shady company, but I'm in the "wait for evidence of a problem" camp). Just did a test with fast.com, and I had 370Mbps with VPN, 410Mbps without. Perfectly OK for me.

But as I alluded in my original post, since it seems like my ISP doesn't do any monkey business, I mostly leave it off. I have specific services running in my network that use it, but my vanilla traffic is unencrypted from my router.

That said, even with no VPN I have a pihole backed by DNS-over-HTTPS, and almost all traffic (above 95%) goes over HTTPS or SSH anyway.

The double router approach always seemed a bit weird to me. I'm really glad that in the Netherlands ISPs are required to make it possible for you to use your own networking equipment. I removed all the ISP equipment and replaced it with a Ubiquiti USG and a tiny bit of configuration.

The added benefit is that it allows for a crude zoning. Untrusted devices go on ISP's router, trusted devices behind my own. This isn't perfect, but it does work.

Reply on news.ycombinator.com