WRT54G2 V.1 - Mac Filter List gone - Security Hole ?

Help,
I was trying to block some unwanted users using Mac Filter but for unknown reason, after I succeed, my Mac Filter List gone empty. It happened several times. First I let it happened some times so I'm sure what really happened there.
My config is let wireless users able to access the web server by Http. I use WPA2 Personal with TKIP-AES. I let my SSID broadcast, and I let any users who need access to the network know/use the secret key.
I thought it shouldn't be mattered since I protect my Linksys Web Server use good password. But I was wrong. And when 'it' happened (just before MAC Address gone empty and blocked users then able to connected to my network), uknown device got connected to the network first.
It happened several times as I said before, but the last one hit me surely that my config, Mac Filter list, anyhow, can get erased by something/someone if I keep this way. So I decided to change the config and not let the wireless users to have access to my linksys web server.
I change from Http to Https. I disabled wireless users to having access to the web server. And to make me comfort I activate AP Isolation too. I use Access (internet) Restriction rather than Mac Filter because it is more comfortable to me as I can create policies.
Anyone have same experience ? Expert explanation would be a great appreciate.
Oh yes. I don't have any config change since I use my new configuration. That's what I can tell. Thanks.

to a determined hacker, MAC address filtering is a trivial security block to overcome (as you seem to have found out). You would be better, as Gandalf said, to disable SSID broadcast, and provide the SSID and WPA passphrase to anyone that you want to allow to connect to your network.
Tomato 1.25vpn3.4 (SgtPepperKSU MOD) on a Buffalo WHR-HP-G54
D-Link DSM-320 (Wired)
Wii (Wireless) - PS3 (Wired), PSP (Wireless) - XBox360 (Wired)
SonyBDP-S360 (Wired)
Linksys NSLU2 Firmware Unslung 6.10 Beta unslung to a 2Gb thumb, w/1 Maxtor OneTouch III 200Gb
IOmega StorCenter ix2 1TB NAS
Linksys WVC54G w/FW V2.12EU
and assorted wired and wireless PCs and laptops

Similar Messages

MAC filter for wireless security????

I have hooked up my wireless router and had trouble with the security part. I am now set up with the wireless security disabled but the MAC filter enabled and my wireless computers mac number entered and all is working. will the MAC filter work as security for my wireless network. thanks tdm

MAC address filtering is considered a very low level of security. It will keep honest people from accidentally logging into your network, but that is about it. MAC addresses are transmitted wirelessly when you use your router. Anyone can monitor your transmissions, so it is easy to learn a working MAC address. They can then fake the MAC address and loggin to your network whenever you are not connected.
Also, when your transmissions are not encrypted, anyone within range can monitor your wireless transmissions, even without logging into your network. With a good antenna, your transmissions can probably be picked up for at least half a mile from your home. So someone could monitor the web sites you visit, your email, etc., and in some cases, your passwords.
You really should setup wireless security on your network.
Here are my tips for setting up wireless security:
To set up wireless security, you must use a computer that is wired to the router.
Where to find the router settings: The router's login password is usually on one of the "Administration" pages. The other settings are all found in the "Wireless" section of the router's setup pages, located at 192.168.1.1
First, give your router a unique SSID. Don't use "linksys".
Make sure "SSID Broadcast" is set to "enabled".
Next, leave the router at its default settings (except for the unique SSID), and then use your pc to connect wirelessly to the router. Test your wireless Internet connection and make sure it is working correctly. You must have a properly working wireless connection before setting up wireless security.
To implement wireless security, you need to do one step at a time, then verify that you can still connect your wireless computer to the router.
Next, encrypt your wireless system using the highest level of encryption that all of your wireless devices will support. Common encryption methods are:
WEP - poor (see note below)
WPA (sometimes called PSK, or WPA with TKIP) - good
WPA2 (sometimes called PSK2, or WPA with AES) - best
WPA and WPA2 sometimes come in versions of "personal" and "enterprise". Most home users should use "personal". Also, if you have a choice between AES and TKIP, and your wireless equipment is capable of both, choose AES. With any encryption method, you will need to supply a key (sometimes called a "password" ).
The wireless devices (computers, printers, etc.) that you have will need to be set up with the SSID, encryption method, and key that matches what you entered in the router.
Retest your system and verify that your wireless Internet connection is still working correctly.
And don't forget to give your router a new login password.
Picking Passwords (keys): You should never use a dictionary word as a password. If you use a dictionary word as a password, even WPA2 can be cracked in a few minutes. When you pick your login password and encryption key (or password or passphrase) you should use a random combination of capital letters, small letters, and numbers, but no spaces. A login password, should be 12 characters or more. WPA and WPA2 passwords should be at least 24 characters. Note: Your key, password, or passphrase must not have any spaces in it.
Most home users should have their routers set so that "remote management" of the router is disabled. If you must have this option enabled, then your login password must be increased to a minumum of 24 random characters.
One additional issue is that Windows XP requires a patch to run WPA2. Go to Microsoft Knowledge base, article ID=917021 and it will direct you to the patch.
Sadly, the patch is not part of the automatic Windows XP updates, so lots of people are missing the patch.
Note:
WEP is no longer recommended. The FBI has demonstrated that WEP can be cracked in just a few minutes using software tools that are readily available over the Internet. Even a long random character password will not protect you with WEP. You should be using WPA or preferably WPA2 encryption.
Message Edited by toomanydonuts on 01-16-2008 03:38 AM

Howto refresh MAC-filter list in WCS ?

Hello
We?re using WLC4402 with WCS 4.
We are using MAC filters with WPA to limit which clients can connect.
My problem is this:
I think it is smoother to insert new MAC filters through the WLC web interface instead of using the WCS.
When I do this the new MAC filters I put in through the WLC web interface will not show up in the WCS, how can I refresh the WCS to make the new MAC filters show up there ?
/Dan

Make sure the controller is using version in Release 3.2.78.0.If not upgrade the controller so that updates are sent properly to wCS .Max number of mac filter that could be configured is 512 on WCS 2.2

WS-C3524-XL-EN , mac access-list , ssh ..

does this switch CATALYST 3500 24 PORT 10/100 SWITCH WITH 2 GBIC SLOTS, ENTERPRISE EDITION with last IOS running on, support SSH , and mac access-list to secure the port with mac
thanks

There is IOS software for the 3550 that supports ssh. You have to have cco login with priviledges - There is a "strong cryptographic (3DES) location on CCO for that software. Go to downloads for 3550 and look for the link.

WRT54GSV4 and MAC Filter

Hello, i'm using WRT54GSV4 with mac filter list. I've used maximum of 40 macs in filter list. Is there any posibilities to expand list? Thanks.

sorry to step in here, frank.. but I believe you must have misunderstood him... he is not specifically saying that hes blocking wireless MAC adresses... although his wireless router can only support 32 wireless clients maximum, it's too early to say if he is trying to block it. he might have wireless acess points...
"a helping hand in a community makes the world a universe"

Problem with connetction to wrt54g2 via wireless connection with WPA/WPA2 & wireless MAC filter

Hello,
I'm Alexey from Novosibirsk, Russia.
I have a problem with connection to wrt54g2 from my DELL D630 notebook via wireless connection. When I setup WPA/WPA2 in wireless security and wireless MAC filter I can't connect from notebook to WRT - in Windows I see that dynamic IP address from WRT is not assigned. When I switch off security mode to disable always OK, but I need a wireless security between DELL and WRT.
Connection via cable Ethernet port is OK.
Can You help me?

Have you tried the different laptop...?
Download 1.71 MB the firmware for WRT54G2 v1 and reflash the router's firmware.After reflashing/upgrading the router's firmware,reset the router for 30 seconds and reconfigure the router from scratch.

E4200 multiple unknown MAC's in filter list

I have a few desktops in my home network with a new E4200 router.
Have to add my wifes Lenovo notebook to the net and activated MAC filtering as addition to the WPA2.
Set her MAC address in the filter list. Only one MAC is allowed to access WLAN.
An hour later I see in the Filter list four (4) different and unknown MAC adresses added to the list. (???)
Do I have to worry? I removed them and all works well.

gv wrote:
somms wrote:
sabretooth wrote:
You don't need MAC filtering as it does nothing for security. As long as you have WPA2-AES you are good for the next 100 years.
This does not apply to the majority of Linksys/Cisco wireless routers w/gimped firmware unable to turn WPS off. Their WPA2-AES can be cracked in a couple hours easy...
That is not correct. You cannot crack WPA2-AES in a couple of hours. Reaver doesn't crack the WPA2-AES keys. It cracks the WPS PIN which allows you to retrieve the WPA2-AES directly from the router. WPS is like a backdoor into the router to retrieve the passphrase. WPA2-AES is still extremely secure. If you could disable WPS the WPA2-AES network would be perfectly secured.
WPA2-AES cannot be cracked at this time.
The wireless MAC filter generally doesn't provide security. MAC addresses are always transferred unencrypted thus they are very easy to find. I would not bother with the wireless MAC filter.
I think the appearing MAC addresses is a bug in the router firmware. But it's difficult to tell if you don't post the MAC addresses you have found...
This does not apply to the majority of Linksys/Cisco wireless routers w/gimped firmware unable to turn WPS off. Their WPA2-AES can be 'obtained' easily in a couple hours...
Thanks for pointing this out and I have amended my previous statement above!
Member of the Professional Aviation Safety Specialists Union!

WRT610N: Cannot enter MAC address in MAC address filter list

My WRT610N cannot accept a very specific MAC address in any position of the MAC address filter list. It is a valid address and it was working fine in the filter list of my WRT54G but the 610N will just not take that specific address! What is this all about?
Solved!
Go to Solution.

gv wrote:
There is nothing like a "non-critial setup". It's enough to drive by with a car and within a few minutes your network is hacked. Or it's the bored teenager next door...
I recommend to replace the WEP only device instead of taking the risk of a hacked network.
And just forget about the wireless mac address filter. Anyone, who wants to crack your WEP network will collect enough accepted MAC addresses during the cracking process. It's just not worth the trouble to set up the filter and keep the list current...
Thanks for the diligent follow-up gv but I can't replace the WEP-only device for now. (I need to go through a conversion process for that device to accept WAP and that will take a fair amount of time) I understand your point about getting accepted MAC addresses but, at least, it requires a bit more effort... Maybe I will return the WRT610 and stick with my old WRT54 until the 610 gets fixed...

Filter list items based on security groups o365

How to filter list items based on security groups in o365.

Hi,
According to your description, my understanding is that you want to filter list items based on the Office 365 security groups.
If that is the case, I suggest you can create a data view to filter the list items with CAML Query like below:
<Where>
<Membership Type="CurrentUserGroups">
<FieldRef Name="VisibleToGroup"/>
</Membership>
</Where>
For more information, please refer the detailed article below:
SharePoint - Filtering a View by Group Membership
Thanks
Best Regards
TechNet Community Support
Please remember to mark the replies as answers if they help, and unmark the answers if they provide no help. If you have feedback for TechNet Support, contact
[email protected]

I've downloaded the free pixel bender plugin for my mac (it says toolkit) for cs5 but I don't know how to put it in my filter list, can someone walk me thru it please?

I've downloaded the free pixel bender plugin for my mac (it says toolkit) for cs5 but I don't know how to put it in my filter list, can someone walk me thru it please?

Copy it in the respective plug-in folder.
Mylenium

MAC address gets removed from the CAM 4.8 Filter List??

Hi,
we got WLC and NAC integration going. I have a smartphone wi-fi client I would like to exclude from logon and posture assessment, so I add the MAC into the CAM's Filter List. It works fine for a short while and then the MAC gets deleted from the list for some reason. Here’s what CAM log show (roughly an hour between the MAC is manually added and then gets deleted):
any ideas why it's happening and how to fix this?

Faisal,
I looked through the NAC log again, and I did miss another piece of info, so here's how the log looks after adding the MAC in the filter list:
Administration      2010-11-01 17:53:31       38:E7:D8:0B:42:A3 added to MAC list
Administration      2010-11-01 18:51:10       38:E7:D8:0B:42:A3 removed from the MAC list
Administration      2010-11-01 18:51:10       (API removemac): Succeeded!
So, it looks like there is some process running that removes the MAC from the list every time it's added in raughly an hour?
Dmitri.

NAC Profiler integration - cant add filter list on CAM

Hi All,
I have a problem regarding the Profiler - NAC integration for end point profiling.
Here is the situation:
I already created the integration based on the steps on the guide: Configuring Cisco NAC Appliance Integration. I think the configuration is correct because i can do database synchronization between Profiler and CAM. Here is the Profiler server log:
   NAC_SYNC: Task_Queue_Runner starting up
   NAC_SYNC: Profiler / NAC Synchronization END [add 0, upd 0, desc 0, rm 0]
   NAC_SYNC: Profiler / NAC Synchronization START
   INFO: [2010-12-15 11:01:09 (fcapGetHWAddr:49)] Getting MAC for eth0
I already created end point profile named "Admin" which is based on IP address. I also created NAC events based on the end point profile "Admin".
The NAC event is profiling "Admin" to a NAC role. The purpose for this event is to bypass "Admin" from NAC authentication so that the "Admin" can connect to network automatically to one NAC role.
However when "Admin" connect to network, it is still challanged by NAC. I dont see the "Admin" on the CAM filter list either.
This means that the end point profiling is still failed.
Is there anyone who have any experiences with this?
Thank you for the supports and comments
Imad

Hi,
Ok, so the Profiler will only add devices to the CAM filter list, if a device fals into a profile for which a nac event is configured.
If there is no device on the profile -> No NAC event -> No device added to the CAM.
Is there any device that was assigned to that profile?
Regarding the Active Rule column, it is used to quickly ascertain which Endpoint Profiles on a system (if any) contain an Active Rule that will result in the Profiler system doing active collection if one or more NetInquiry Collector component modules are enabled. Active profiling rules and active profiling is described in detail in the "Configuration of Active Directory Data Rules" section: http://www.cisco.com/en/US/docs/security/nac/profiler/configuration_guide/311/p_endpt_part231.html#wpxref59325.
HTH,
Tiago

Where to add mac filter without template on Prime 2.0?

Hi,
Can someone point me to where I should go to add mac filter under security>AAA in Prime 2.0 directly to controller without using templates? Check the screenshot attached. there is no option to add filter. It only give option to edit. Going to Classic view I see the add option is available. Puzzled. Any help is appreciated.
Cheers,
Fadi

I am unabl eto find any way to configure mac-address filter without template. To configure with template you can go through the following steps-
Step 1 Choose Configure > Controller Template Launch Pad.
Step 2 Click MAC Filtering or choose Security > MAC Filtering from the left sidebar menu. The Security > MAC Filtering page appears.
Step 3 If you want to add a new template, choose Add Template from the Select a command drop-down list, and click Go. To modify an existing template, click the template name. The MAC Filtering template page appears.
Step 4 If you keep Import From File enabled, you must enter a file path or click Browse to navigate to the file path. The import file must be a CSV file with MAC address, profile name, interface, and description (such as 00:11:22:33:44:55, Profile1, management, test filter). If you unselect the Import from File check box, continue to Step 5. Otherwise, skip to Step 8.
The client MAC address appears.
Step 5 Choose the profile name to which this MAC filter is applied or choose the any Profile option.
Step 6 Use the drop-down list to choose from the available interface names.
Step 7 Enter a user-defined description of this interface. Skip to Step 9.
Step 8 If you want to override the existing template, select the Override existing templates check box.
Step 9 Click Save.

Can't use MAC Filter and have Blinking Red Link Light on WRE54G

I just added a WRE54G V3 extender to my WRT54G V8, I have download the most recent firmware on both products. My network in using WPA and after fixing all the typo associated with setting all that up I still could not establish wireless connectivity. I am/was using MAC Filters on the WRT54G and had added and triple checked the WRE54Gs Mac address,, but until I disabled the Mac Filter I could not connect to the network. I would like to get that issue resolved. Secondly even with the MAC Filter disabled the Link Light blinks red at a regular interval. It does appear that I have connectivity, but the light just blinks away. If this is normal I could not find any reference is the written materal. Thanks for any advice you might have.
Message Edited by ecanon on 04-16-2008 01:31 PM

Sorry to appear toltake so long to get back to this, but I did post a message in reply somewhere ????, but it doesnt appear here??? and then I got tied up on some personal stuff.
Anyway, I followed all the advice I could find on this thread (thanks to everyone who has posted to any question on this thread) and after starting completely over reseting everything and basically configuring the RE with everything else turned off and then powering up everything starting with the router, I got everything up and running using WAP and all.
The only issue left is when I enable MAC filtering on the router to allow only the MAC addresses in the list access to the network the RE goes belly up. Disable Mac filtering and it comes right back up. I have triple checked the Mac address I entered on the list. The only reference to the RE's MAC address is on the sticker on the back. I can't find that verified anywhere in the configuration screens on the RE.
If I could get his working I could count my security as good as it gets and go on about my business.
Thanks again to all for helping me get this far.

MAC filter on WRT54GS2 V1 - loses some MAC numbers :(

I have a WRT54GS2 V1 and I use only the MAC filter for wireless protection.
It has the annoying habit of losing some of the MAC numbers I have typed in.
I haven't been able to correlate these events with any other predictable events - the problem seems to happen at random times.
Is this a known problem? I have had many other earlier versions of the 54G series - use the MAC filter in the same way on them and never had this problem.
Any suggestions would be appreciated.
Thanks
Walt

Sorry. But you wrote you want to use the MAC filter for "wireless protection". The MAC filter is absolutely unsuitable for "wireless protection".
MAC addresses are always transferred unencrypted.
MAC addresses are easily modified and cloned.
You block my MAC address in the list? I change my MAC address and I am back in.
You only allow a few MAC addresses on the list? I pick up the allowed MAC addresses with a standard network sniffer and change my MAC address to a whitelisted one.
Trust me: the wireless MAC filter is absolutely useless for wireless security/protection.
And don't forget: if you only use the MAC filter without any wireless encryption it is trivial to sniff on all your network traffic. With WEP it takes about 5 minutes to crack the WEP keys and then you can capture and sniff all network traffic again.
Again: use WPA2 Personal with AES and a strong passphrase. That provides you with real wireless security.

WRT54G2 V.1 - Mac Filter List gone - Security Hole ?

Similar Messages

Maybe you are looking for