NetComm NB1300 Istruzioni di installazione e manutenzione

Securing your NB1300 ADSL Router / Modem Document version 1.03

5/09/2003 Page 1of 10

Securing Your NB1300 -Once connected.

There are eleven areas that need your attention to secure your NB1300 from

unauthorised access -these areas or features are;

•Physical Security

•Admin Password

•User Password

•SNMP Community Strings (when SNMP is available in your firmware)

•FTP server

•HTTP Server

•DMZ Host

•Half Bridge mode

•Port Forwarding

•Dynamic Routing (RIP Configuration)

•Telnet

The features are accessed via the menu item choices shown circled in the screen shot

below. Each item is either disabled or changed in it’s appropriate page and as always

you must click the Submit button at the bottom of the page. Once you have made

all your changes you must then click the Save Setting and Reboot button to

commit your changes and reboot the NB1300.

Don’t forget you can incorporate all of these settings into an Easy config profile for

easier deployment for endusers. See the section on Easy config at the end of the

document.

}These options are all found under ‘Misc Configuration’

Securing your NB1300 ADSL Router / Modem Document version 1.03

5/09/2003 Page 2of 10

You may need to click

here to display the

advanced settings.

Securing your NB1300 ADSL Router / Modem Document version 1.03

5/09/2003 Page 3of 10

1. Physical security -should be considered because if a malicious person has

physical access to the unit they can damage it, steal it, reset it to factory

defaults or just sabotage it to allow them remote access later on.

Note: Your Admin password can be deleted with physical access.

2. Administration Password– Your Admin Password gives you complete

control over the NB1300 it should NEVER be left as default because it can

allow access from a Web browser, FTP or Telnet service from bothyour LAN

and the Internet. You should change your Administration Password to

something complex and involving many UPPER and lower case Characters.

The Minimum password length is fixed at eight characters. Some examples of

suitable passwords in growing complexity are;

fa11en4you <-mixing words and numbers, replacing letters with numbers.

Buz911B0xzero <-as above but using upper and lower case as well.

SecN@tC0mmwillyou <-The ‘0’ is a zero, the use of ‘@’ instead of ‘e’

To change your Admin password choose the ‘Admin Password’ option on the

menu and you will see a screen similar to the one below. Enter your new

password twice, once in each field and then click the submit button

Note: For security your password’s characters will be replaced with dots so

no one can see you type it on the screen.

3. User Password– Your User password is used to log-in with the username

‘User’ this is a restricted account that allows you to view router status but not

change anything in the router. However the less information a ‘Hacker’ can

find out about your system the less chance the hacker has of finding an exploit

for your system. Depending on your needs you may wish to make the User

password as secure as the Admin password or a little easier for regular

everyday use.

To change your User password choose the ‘User Password’ option on the

menu and you will see a screen similar to the Admin Password screen above.

Enter your new password twice, once in each field and then click the submit

button.

Securing your NB1300 ADSL Router / Modem Document version 1.03

5/09/2003 Page 4of 10

4. SNMP– Simple Network Management Protocol is used to manage devices on

networks from a central location. The authentication for SNMP is based on

‘Community Strings’ these are like passwords and should be treated as such

when it comes to security. If SNMP is available in your Router (NB1300) you

should change all your community strings (both public and private) to more

secret names with more complexity. If you wish to block SNMP access from

the Internet you should create a dummy port forward for external port 161 as

is displayed in the image below for points 5 or 9.

5. FTP– The FTP server that is built into the NB1300 is not normally used by

the average user and so it should be disabled. This will not affect any FTP

services running through the NB1300 but it will prevent local and remote

access to the FTP server ofthe NB1300.

Note: The FTP server is used by NetComm’s Easy Config software to send a

pre-configured profile to the NB1300. If you disable FTP you will not be able

to use the Easy Config software with the NB1300 until it is reset to factory

defaults.

You can leave the FTP server enabled but not vulnerable to access via the

WAN port by adding two ‘Dummy dead-end’ port forwards as shown in the

screen shot below, with this method you can still use Easy Config to configure

the NB1300 locally but FTP via the WAN is blocked.

Note: This security method is automatically incorporated into Firmware

versions 5.x.x as shown below.

6. HTTP– The HTTP server built into the NB1300 is used to allow you to view

configuration pages via a web browser. You can set the NB1300 to allow this

information to be viewed or changed via the LAN or via the WAN (Internet)

or both. The Defaults shown here are for Firmware V4.004.1 and they show

the access restricted to the LAN. To secure your NB1300 you should have the

WAN check box disabled as shown in the screen shot below as this will

prevent configuration access from the internet. You can change the port that

the service runs on (e.g port 8080 instead of 80) but this means when you

Securing your NB1300 ADSL Router / Modem Document version 1.03

5/09/2003 Page 5of 10

access your NB1300 you will need to include the different port when you type

its IP address E.g;

http://192.168.1.1:8080

You could disable LAN access but this would prevent you from making

further changes or viewing your routers status.

Note: If you block yourself out of your NB1300 you will have to use the Reset

button to return to factory defaults.

7. DMZ Host– The DeMilitarized Zone Host setting is used to specify the IP

address of a computer (Host) that will deal with any data received from the

internet that is not a response to an internal computer’s request (via NAT).

This data would normally be ‘dropped’ by the NB1300 but if you wish to

allow external access to a particular internal computer, this option is used to

‘expose’ the ‘Host’ to raw connections from the internet.

The DMZ host feature is most commonly used to allow Internet users access

to a Web server or Game server.

To secure your network you should ensure that the DMZ host feature is

disabled. If you need to use the DMZ host feature you should ensure the

computer with the IP address specified is secured with a firewall.

8. Half Bridge mode – This mode allows the NB1300 to work in an

‘Unumbered port’ mode which means that you can plug only one computer

into your NB1300 and that computer will be assigned the public (internet) IP

address as designated by your ISP. In this mode your computer will be directly

exposed to the Internet even though the NB1300 is logging into and

maintaining a PPP connection to your ISP.

This mode should be disabled for security, if you want to use Half bridge

mode you should run personal firewall software on your computer.

Securing your NB1300 ADSL Router / Modem Document version 1.03

5/09/2003 Page 6of 10

9. Port Forwarding – This feature is similar to the DMZ host feature listed in

step 7 except it allows individual ports on the public Internet IP address to be

forwarded to a private IP address. This is most commonly used to allow

Internet users to access a Web service on port 80 etc.

To secure your NB1300 you should not have port forwards that are not being

used (excluding the FTP dead-end port forwards suggested in point 5). Any

port forwards that have been configured should only specify the IP address of

Set all of these to

‘Disabled’ if

possible.

Set to ‘Restricted’

and tick the ‘LAN’

box.

Ensure ‘WAN’ is

not ticked.

Securing your NB1300 ADSL Router / Modem Document version 1.03

5/09/2003 Page 7of 10

secure computers. Ideally there should be no port forwards accept for

“Dummy” port forwards included as factory defaults (port 21, 23, 161 & 254).

If you are using older firmware you may wish to add port forwards as shown

below.

Note: The ‘Dummy’ Host IP address does not have to be in the same subnet as

your NB1300 LAN IP address but it shouls end in ‘.255’

10. Dynamic Routing (RIP)– RIP is disabled by default, you would only enable

RIP if you want your NB1300 to accept information from other LAN routers

or if you want it to share it’s routing information with other router’s. As

always the less information a ‘Hacker’ can find out about your system the less

chance the hacker has of finding an exploit for your system.

Ensure RIP is disabled if you do not need to use it.

Set to ‘Disabled’

and click submit.

Securing your NB1300 ADSL Router / Modem Document version 1.03

5/09/2003 Page 8of 10

11. Telnet –Newer firmware (Release V5.x.x +) now supports Telnet which

allows you to manage and configure the NB1300 via a text terminal screen.

Externally there are two Telnet ports available;

Port 23 – This is the standard telnet port and it allows full control of the

NB1300 in the same way that logging in as ‘admin’ does via Web / HTTP.

This port is already blocked in firmware releases that include Telnet.

Port 254 – This port is an extra telnet port that allows minimal monitoring of

the ADSL connection, some of the functions are disabled and although it looks

like you can reset your NB1300 to factory defaults via this port, this is not

true. NetComm recommend you create a dummy port forward for this port

number as discussed in Point 9 (Port Forwarding) and shown below.

Securing your NB1300 ADSL Router / Modem Document version 1.03

5/09/2003 Page 9of 10

Other Security Measures.

NetComm’s Easy Config -You can use NetComm’s Easy Config software to

easily deploy preconfigured profiles which include all the required ISP and ADSL

settings as well as any extra security choices you want. The Easy Config software

profile will include settings made to disable services such as FTP.

NetComm’s Easy Config even has a feature to “Scramble the Admin Password” to

lockout every one, this is offered as a simple tick box in the Advanced area of the

Software. Easy config must have LAN FTP access to the unit to deploy your

profile but it can be locked out by your profile.

MAC Filters – The NB1300 also has a MAC filtering function, if you wish to

restrict which Network Interface Cards (NICs) can use the NB1300 to connect to

the internet.

i.e. If you only use 10 computers in your network you may wish to list the MAC

addresses of the NIC in just the administration computers as the only devices that

can connect to the internet to prevent unwanted internet access by employees.

Securing your NB1300 ADSL Router / Modem Document version 1.03

5/09/2003 Page 10 of 10

Resetting to factory defaults

If you forget your passwords, lock out HTTP or FTP access or simply can’t

remember what IP address youhave set the NB1300 on you will probably need to

perform a factory defaults reset.

To perform a factory defaults reset you must have physical access to the unit then

follow these steps;

1. Make sure the NB1300 is powered on and the RDY light is flashing.

2. Locate the Reset button hole on the back of the unit.

3. Gently press in and hold the button for 5-10 seconds with a suitably thin

appliance (E.g. a Pen). 3 seconds after release the RDY light will turn off

4. Watch the RDY light and wait for it to stabilise and start pulsing again.

5. Your router should now be set to factory defaults (192.168.1.1, ‘admin’ &

‘password’)

1. Power up NB1300.

2. Press and hold Reset

button for about 5 – 10

seconds.

Altri manuali per NB1300

Indice

Altri manuali NetComm Router di rete

NetComm

NetComm Freshtel NB9 Manuale

NetComm

NetComm NB5PLUS4 Manuale utente

NetComm

NetComm VELOCITY NP805N Manuale utente

NetComm

NetComm NB5 Manuale utente

NetComm

NetComm 3GM1WN Manuale utente

NetComm

NetComm V300 Manuale utente

NetComm

NetComm NB9WMAXX Manuale utente

NetComm

NetComm MyWay YMLO-3G8WV Manuale utente

NetComm

NetComm NTC-5000 Series Manuale utente

NetComm

NetComm NB3100 Manuale utente

NetComm

NetComm 3G42W-M Manuale utente

NetComm

NetComm FIBRE NF3ADV Manuale utente

NetComm

NetComm Dynalink NP800 Series Manuale utente

NetComm

NetComm NB5 Manuale utente

NetComm

NetComm Whitepaper TR-069 Manuale utente

NetComm

NetComm NB604N Manuale utente

NetComm

NetComm N3G002W Manuale utente

NetComm

NetComm NB16WV-02 Manuale utente

NetComm

NetComm LIBERTY 3G22WV Manuale utente

NetComm

NetComm 3G38WV Manuale utente

NetComm

NetComm NB6PLUS4WN Manuale utente

NetComm

NetComm NB604 Manuale utente

NetComm

NetComm NF12 Manuale utente

NetComm

NetComm Freshtel NB9 Manuale utente

Manuali Router di rete popolari di altre marche

Allnet

Allnet ALL0333AU Manuale utente

HomeSeer

HomeSeer HT-SEL Manuale utente

Sercomm

Sercomm Genesis OC3505D Manuale utente

Billion

Billion BIPAC 5102 Series Manuale utente

TP-Link

TP-Link TD-8817 Manuale utente

Motorola

Motorola MR1900 Manuale utente

Digi

Digi IX14 Manuale utente

Cisco

Cisco NCS 540 Manuale

XAVi

XAVi X8821e Manuale utente

BEC

BEC 6200WZL Manuale utente

MikroTik

MikroTik hAP ac3 Series Manuale utente

Korenix

Korenix JetNet 5428G Series Manuale utente

NETGEAR

NETGEAR FS526T - Switch Manuale utente

Korenix

Korenix JetNet 5710G Series Manuale utente

Automated Logic

Automated Logic ZN551 Manuale del proprietario

Cisco

Cisco ASR 1000 Series Manuale dell'operatore

EnGenius

EnGenius ESR-9710 Manuale utente

Cisco

Cisco 805 Series Istruzioni operative e di sicurezza