Is my router effectively secured?

Question

I was wondering if the following what I have done is the best possible, if there is any possible way to improve the security:
I have a WRT320N
SSID: just let it broadcast. Removing this broadcast will not improve overal security. SSID will be shown even if you diable periodic broadcasts.
Change Router default name to something that does not suggest it's location or brandname/type
change the default password (the one to access the router from your browser)
Disable remote management: don't want anyone using Wi-Fi to try to hack my router
disable Upnp, automatic configuration of router has possible security leaks.
use WPA2 personal (just choose the highest encryption) and use the longest, uppercase, lowercase numbers and letter combination you can think off.
mac filtering can be set to on, but hackers can clone MAC addresses, the extra security is doubtfull.
AP isolation: Prevent wi-fi users on my router from accessing eachother, isolate all wi-fi users from eachother.
enable SPI firewall: blocks incoming network packets that originate from the internet. And were not started by me: internet at port 80, my firefox tries to open a webpage, these kind of incoming packets will be alowed by the router to pass from internet to my computer.
use webfilter and prevent any network packet with java, proxy, activex  to pass my router: at this moment I am blocking proxy. I am filtering webcasts.
Blocking any port except 20,21,25,53,80,110,443. (port range is from 0 to 65523)Blocking both UDP and TCP for all IP addresses 192.168.0 to 192.168.0.254 So only these mentioned ports are allowed to be used.
Thanks for helping out.
Solved!
Go to Solution.

Answer 1

Re SSID broadcast.
1. Correct. Even with SSID broadcast disabled the router will still broadcast a periodic beacon which means a wireless scanner will immediately pick up the existence of a wireless network.
2. The SSID is transferred in plain text during association with the router. Any network sniffer will learn the SSID at the moment a (legitimate) device connects to your network.
3. By sending some rogue packets to the AP it is easily possible to disassociate any connected wireless device forcing a re-association. This way you can learn the SSID immediately.
1-3 means that a SSID of a wireless access point with SSID broadcast disabled is unknown as long as no wireless device is connected to the router because there is no way to force an association request of a legitimate device. Some people therefore believe the disabled SSID broadcast is a important means for increased security, in particular when the wireless is not used very often. Of course, if you don't need the wireless for most of the time you should turn it off completely.
On the other hand, disabling the SSID broadcast technically breaks the 802.11 standard and is known to cause connectivity and stability problems with some wireless cards. Therefore, I usually recommend not to disable the SSID broadcast.
Re "router default name". If you mean the SSID, of course, changing it is important. Mostly to prevent your wireless devices to connect to your neighbor's router who still uses the default SSID.
Changing the "router name" on the main setup is not necessary. It's only necessary for the internet connection and only if required by your ISP.
Changing SSID or "router name" won't change the MAC address on the wireless. The first half of that MAC address will reveal the manufacturer (Linksys or Cisco)
Re remote management. Disabling remote management is good. Of course, verify that it really works. Some routers had a firmware bug which opened the web interface to the internet regardless of that setting.
Re UPnP. Correct. It should be disabled at all times.
Re WPA2 Personal with AES only encryption and a strong passphrase is the best wireless security you can have at this time. Passphrase can be up to 63 characters long.
Re wireless mac filter: MAC addresses are always transferred unencrypted (even with WPA2) and are easily cloned. Thus a simple network sniffer will be able to pick up MAC addresses of legitimate devices which you can use to connect.
Re AP isolation. Can be used if no wireless-wireless connections are required. Of course, if an intruder hacked into your wireless network he can try to hack into your router from there. The protection of the web interface on the LAN side is quite weak.
Re SPI firewall. Must be on. It protects the router from the internet.
What you write on that subject is the "protection" due to NAT, i.e. because you use private IP addresses. NAT technically does not block unsolicited incoming traffic. It simply drops unsolicited incoming traffic because it does not know what to do with it, i.e. it does not know where to deliver it to unless you configure port forwarding or similar. By design, NAT is not a security mechanism as its design goal is to allow connections and not to block them. Some (older) NAT implementations tried to deliver unsolicited incoming traffic by some heuristics. Some (older) NAT implementations had FTP helper functionality (to make FTP work properly through a NAT router) which made it possible to get any port opened on the router.
Re webfilter: depends. Will cause trouble with HTTPS web sites as HTTPS requires secure end-to-end security.
Re blocking all ports except 20,21,25,53,80,110,443. Well depends again. In your list for instance, you block port 995 (POP3S) and only accept 110 (POP3). Depending on your mail client and the pop server this may lead to an unencrypted connection between the client and the server because port 995 is not accessible. Similar with port 25 (SMTP). Some web servers run on port 8080 or other ports which won't work or work only partially (because some content is on a web server with different port number).
So technically, your block list will probably more affect you and your ability to use the most secure protocol which might be currently on your block list. In addition, as most people have ports 80 and 443 open for outgoing traffic most malware uses it to talk to the outside. Thus, your list although the idea sounds good probably won't help you.
Thus I would say that in most home networks such a blocking list based on a list of a few excempt ports won't really help your security and mostly will cause problems for you and nothing else. Such a list will work in a corporate setup where you can narrow down the legimite traffic very well. But for home use and general browsing habits it won't really work.
In addition, I think you cannot set up such a list on a Linksys router. You can only block ports but not all ports except a few.
Another, extremely important point missing from your list: Always change the router default password (admin) to a strong password. But I guess you already did that, too.
Overall, I would say you have got everything right...