4 ms·

Like I have said in another thread, if you misconfigure a firewall, the network usually works, but not secure. If you misconfigure a NAT, nothing works, and you

Like I have said in another thread, if you misconfigure a firewall, the network usually works, but not secure. If you misconfigure a NAT, nothing works, and your error is clearly visible. I don't see a way to fix this (and configuration errors are common).

unethical_ban 4y ago
Fix it with user experience. Routers should have dashboards that give easy status of firewall configuration ala Windows firewall: Green for no inbound rules (or whitelisted rules) and yellow/red for non-checked rules. Routers could even have LEDs or status displays like some higher end Ubiquiti prosumer products have, showing firewall status. Routers could have a user-accessible API and Windows client that shows status on a taskbar item. The technical solutions are there, but I don't have faith ASUS and co will build a competent product.
- atemerev 4y ago
  The technical solutions will not work, as there are many, many possibilities to make a mistake. Misleading router UI, copying the configuration from somewhere else and forgetting to update it, moving a computer to another network, just forgetting to enable a firewall (in many cases it is impossible to set up a IPv4 network without a NAT precisely because IPv4 addresses are rare — but it is perfectly possible to do it with IPv6, and it will be insecure by default). Secure systems are robust against user mistakes (and even middlemen mistakes). A NAT is one such system. Alternatives do not work like that.
- throw0101a 4y ago
  > The technical solutions are there, but I don't have faith ASUS and co will build a competent product. The last time I was looking for a home router I specifically went for Asus because their default firmware is pretty good, and third-party options are available: * https://www.asuswrt-merlin.net/features https://www.asuswrt-merlin.net/features Currently running an RT-AC68U.

unethical_ban 4y ago

Fix it with user experience. Routers should have dashboards that give easy status of firewall configuration ala Windows firewall: Green for no inbound rules (or whitelisted rules) and yellow/red for non-checked rules. Routers could even have LEDs or status displays like some higher end Ubiquiti prosumer products have, showing firewall status. Routers could have a user-accessible API and Windows client that shows status on a taskbar item. The technical solutions are there, but I don't have faith ASUS and co will build a competent product.

atemerev 4y ago
The technical solutions will not work, as there are many, many possibilities to make a mistake. Misleading router UI, copying the configuration from somewhere else and forgetting to update it, moving a computer to another network, just forgetting to enable a firewall (in many cases it is impossible to set up a IPv4 network without a NAT precisely because IPv4 addresses are rare — but it is perfectly possible to do it with IPv6, and it will be insecure by default). Secure systems are robust against user mistakes (and even middlemen mistakes). A NAT is one such system. Alternatives do not work like that.
throw0101a 4y ago
> The technical solutions are there, but I don't have faith ASUS and co will build a competent product. The last time I was looking for a home router I specifically went for Asus because their default firmware is pretty good, and third-party options are available: * https://www.asuswrt-merlin.net/features https://www.asuswrt-merlin.net/features Currently running an RT-AC68U.