Fergie said:
Okay, so do I use the WAN IP or the regular IP?
Hm... Let's make sure we're both applying the terminology in the same ways before getting into it. Out of curiosity, which make and model of router is it?
WAN = your router's connection to your ISP.
LAN = the client machines on your network. This includes both wired and wireless clients.
The changes we're talking about making here effectively pertain to the LAN side, since what we're trying to do is secure the wireless connection from unwanted access. However, they don't affect your IP addresses, just the characteristics of the wireless connection.
Think of it this way: your wireless connection has two basic components (I'm oversimplifying here, but the idea's still valid). One is the radio signal that lets your client machines connect to the AP; the other is the IP address used to identify those machines on your network. To draw an analogy, consider the radio signal equivalent to a telephone line and the IP address equivalent to a telephone number. One (radio signal, phone line) is a medium used to transport your traffic, the other (IP, telephone number) is a method used to identify who that traffic is coming from and where it should go to.
With that in mind, the changes we'll be making effect the radio signal, not the IP addressing of your network. The idea is that by making it as difficult as possible to discover and use the AP's signal, the casual idiot will be discouraged from using your AP and move on.
OK, on to the technical/configuration side.
- Disabling SSID broadcast. Each wireless network is given a name (SSID). By default, the majority of access points broadcast this name along with their signal. This is not good because it's the most basic piece of information needed to associate with (and ultimately connect via) an AP. Really, though, because you know your network's name and can configure your clients directly to use that name, you don't need to tell the whole world about it.
- WEP. This is the method by which your radio traffic is encrypted and is accomplished by sharing a key used to encrypt the traffic with between the AP and the client machines. As long as the keys match, everyone can connect to the AP and send traffic through it. If the keys don't match, the AP rejects the client's attempt to send traffic through it.
Note that WEP does not encrypt your IP traffic, *only* your radio traffic - effectively, it makes the link between the client machines and the AP impractical to eavesdrop on. Having said that, WEP is not the be-all, end-all of wireless security. Given a suitably-determined attacker with enough time and enough captured traffic, your WEP keys can be derived. For this reason, you should only use 128-bit WEP encryption to make this sort of attack as unattractive a prospect as possible.
- MAC address controls. Every ethernet-based network card, wired or wireless, has what's known as a MAC address; each address is specific to each card. By specifying which MAC addresses are allowed to connect to the AP and rejecting all others, you've added another layer of protection against an attacker associating with and connecting through your AP. There are a number of ways of obtaining the MAC address of a wireless card: if you're using PCMCIA cards in a laptop, for example, the MAC address is usually printed on the card itself somewhere. If not, there are other ways of obtaining it; if you can't get the addresses off of the cards themselves, post back and I'll show you how to obtain them.
Now, there's also one other very important thing I forgot to mention initially: management of the AP.
Basically, most access points allow you to manage them from either the WAN or LAN side. If your AP is connected to your ISP via the WAN port, this is bad: pretty much anyone on the Internet can now attempt to log in to and manage it. In most cases (particularly if the administration password hasn't been changed from the factory default), this can lead to an attacker ultimately gaining access to your home network. For this reason, you should set it to *only* allow administration from the LAN side.
And that's about all I have for now... Feel free to let me know if you have any other questions, but seeing as how you've got some folks locally who can help you out you might want to sit down with them and go over the configuration. This stuff's a lot easier to digest when someone's giving you a hands-on demo than trying to explain it over a forum
