105 Digital Life Security #9: Inside Your Router — The Firewall Between Your Network and the Internet

Digital Life Security Series ...Practical ways to protect your devices, accounts, privacy, information and home

There is a little box sitting somewhere in your house or business that quietly handles an enormous amount of responsibility.

We usually call it the router.

Every day, thousands or millions of pieces of network traffic may pass through it.

Computers browse websites.

Phones check email.

Televisions stream video.

Applications contact cloud services.

Smart devices communicate with remote servers.

And while all of that is happening, systems elsewhere on the Internet may also be sending traffic toward your Internet connection.

Some of it may be legitimate.

Some may be automated scanning.

Some may be looking for systems that have accidentally been exposed.

Standing at the boundary between your local network and the larger Internet is one of our most important security controls:

The firewall.

First, WAN and LAN

Before we look at the firewall, let's learn two abbreviations commonly found in router interfaces.

LAN stands for Local Area Network.

This is the network on your side of the router: computers, phones, switches, printers, access points, cameras, and other local devices.

WAN stands for Wide Area Network.

On a typical home or small-business router, the WAN side faces toward your Internet provider and ultimately the larger Internet.

So we can create a simple picture:

Internet → WAN → Router / Firewall → LAN → Your Devices

That boundary is extremely important.

A Firewall Is a Rule Enforcer

A firewall is not a mysterious wall that somehow makes dangerous Internet traffic disappear.

It examines network communication and applies rules.

Those rules may consider things such as:

• Where the traffic came from
• Where it is going
• Which protocol is being used
• Which port is involved
• Whether the communication belongs to an existing connection
• Which network or security zone is involved

The firewall then decides what should happen.

Allow it.

Reject it.

Drop it.

Perhaps log it.

At its heart, a firewall is a traffic-control system.

Why Can I Browse Outward but Strangers Cannot Simply Browse In?

This is one of the most useful questions for understanding a modern firewall.

You open your browser and visit a website.

Your computer sends traffic through the router toward that website.

The website sends information back.

The firewall allows the returning traffic through.

But if some unrelated computer on the Internet suddenly attempts to initiate an unexpected connection to your computer, the firewall will commonly block that traffic.

How does it know the difference?

This is where stateful inspection enters the story.

The Firewall Remembers Conversations

A stateful firewall keeps track of network connections.

When a device inside your network initiates an allowed connection, the firewall records information about that connection.

When response traffic returns, the firewall can recognize that it belongs to a communication that was already established or expected.

A simplified version looks like this:

Your computer: I am starting this connection.

Firewall: Allowed. I will remember it.

Remote server: Here is the response.

Firewall: I recognize this traffic. It belongs to that connection. Come through.

Now imagine unsolicited traffic arriving from somewhere else.

Unknown system: I would like to connect to this device inside your network.

Firewall: I have no established connection or rule permitting that. No.

That is greatly simplified, but it captures the basic idea.

This Is Why “Inbound” and “Outbound” Matter

Outbound traffic is communication moving from your local network toward another network.

Inbound traffic is communication arriving toward your network from elsewhere.

A typical home firewall often permits a great deal of outbound communication while being much more restrictive about unsolicited inbound connections.

That provides useful protection.

But it raises another security question:

Should every device on our network be allowed to communicate outward with anything it wants?

We will return to that question when we discuss IoT devices and network segmentation.

Remember NAT?

In the previous topic, we introduced Network Address Translation.

On many IPv4 networks, your local devices have private addresses such as:

192.168.1.25

Those private addresses are not normally routed across the public Internet.

The router translates communication between the internal network and its external connectivity.

NAT and stateful firewalling frequently occur together in consumer routers, which can make them appear to be one technology.

But remember:

NAT deals with address translation.

The firewall deals with traffic policy.

Now Let's Talk About Ports

We also introduced network ports.

A server can provide multiple network services from the same IP address.

Port numbers help distinguish those services.

Common examples include:

22 — SSH

80 — HTTP

443 — HTTPS

A port is not a physical hole in the firewall.

It is a logical part of TCP/IP communication.

But people often talk about “opening a port,” and that phrase is worth understanding carefully.

What Does “Open Port” Actually Mean?

An open port generally means that network traffic can reach a service listening for communication on that port.

That does not automatically mean something is insecure.

A public web server, for example, normally needs to accept connections from the Internet on the port used for HTTPS.

If nobody could connect to it, it would not be much of a public web server.

The security question is:

Does this service need to be reachable from this network?

If the answer is no, there is little reason to expose it.

Every Exposed Service Adds Attack Surface

We previously introduced the idea of attack surface.

Now we can see it in networking.

Suppose a device exposes a management interface to the Internet.

That interface may contain software.

The software may have vulnerabilities.

It may have a login page.

Someone may try passwords against it.

Automated scanners may discover it.

A future vulnerability may be found in it.

If the service does not need to be reachable from the Internet, exposing it creates unnecessary attack surface.

This leads to a very useful rule:

Do not expose a network service simply because you can.

What Is Port Forwarding?

Suppose you have a device inside your private network:

192.168.1.50

You want someone on the Internet to be able to reach a service running on that device.

With IPv4 NAT, one traditional method is port forwarding.

You configure the router so that incoming traffic arriving on a particular external port is forwarded to a particular internal IP address and port.

Conceptually:

Internet → Router:Port → Internal Device:Port

You have now intentionally created a path from the Internet to that internal service.

That can be useful.

It can also be significant from a security standpoint.

Port Forwarding Is a Security Decision

Before creating a port-forwarding rule, ask:

• Why does this service need to be accessible from the Internet?
• Is the software still supported?
• Is it fully updated?
• How is access authenticated?
• Is the connection encrypted?
• Can access be restricted?
• Will failed login attempts be detected?
• Is there a safer way to provide the needed remote access?

The question should not simply be:

How do I open this port?

The better question is:

Should this port be reachable at all?

Here Come the Security Cameras

This becomes especially relevant with network cameras.

Imagine installing several cameras around a property.

You want to view them while away.

An easy approach might appear to be:

Let's forward some ports through the router directly to the cameras.

Technically, that may make remote access possible with some systems.

But now those camera services may be directly reachable from the Internet.

We should immediately ask:

How secure is the camera firmware?

How strong is its authentication?

Is communication encrypted?

Will the device receive security updates?

What happens if a vulnerability is discovered?

Does the camera really need direct Internet exposure?

This is why learning the network before installing the cameras matters.

Remote Access Does Not Have to Mean Direct Exposure

There are other ways to reach resources on a remote network.

One important approach is a VPN, or Virtual Private Network.

Instead of exposing many individual internal services directly to the Internet, a properly configured VPN can provide an authenticated, encrypted path into an appropriate part of the network.

After establishing that protected connection, an authorized user may be able to access internal services without making each one publicly reachable.

VPNs deserve their own topic later because there are several architectures and important security considerations.

But the underlying idea is powerful:

Secure the entrance rather than opening many individual doors.

What Is UPnP?

Now we encounter a feature found on many routers:

UPnP — Universal Plug and Play.

UPnP can allow devices and applications on the local network to automatically request certain networking configurations.

This can make things wonderfully convenient.

A game console or application may need incoming connectivity and arrange the necessary mapping automatically.

The user never has to understand ports or NAT.

Convenient?

Absolutely.

But from a security perspective, we should understand what that convenience means.

Automation Can Change the Firewall

If devices on the network can automatically request port mappings, then software may be able to alter how certain inbound connections are handled without the network administrator manually creating every rule.

That does not mean UPnP is automatically dangerous in every environment.

It means we should understand whether we need it and what trust assumptions it makes about devices already inside the network.

This gives us another security principle:

Convenience features deserve more attention when they can change security boundaries.

Remote Router Administration Deserves Special Attention

Your router itself has a management interface.

That interface can control:

• Firewall rules
• Wi-Fi configuration
• DNS settings
• Port forwarding
• Connected devices
• Administrator accounts
• Network configuration
• Sometimes VPNs and other security features

Someone who gains administrative control of the router can potentially make major changes to the network.

Therefore, exposing the router's administrative interface directly to the Internet without a specific, securely designed reason is generally something to avoid.

Management interfaces deserve strong credentials and careful access controls.

Change Default Credentials

Network equipment should not remain protected by a well-known default administrative password.

Modern devices increasingly require unique credentials during setup, but older equipment may have shipped with predictable defaults.

When configuring network equipment, determine:

What is the administrator username?

What protects the administrator account?

Is the password unique?

Is stronger authentication available?

Who actually needs administrative access?

Again, we return to least privilege.

Firmware Is Software

A router may look like an appliance, but inside it is a computer running software.

That software is commonly called firmware.

Firmware can contain vulnerabilities just like software running on a desktop computer or server.

That means routers, switches, access points, cameras, and other network devices need security updates too.

A device that still works electrically may nevertheless become a security concern if its manufacturer no longer provides updates.

End of Support Changes the Security Equation

This is worth emphasizing.

We often replace equipment because it breaks.

Security sometimes gives us another reason.

If a router is ten years old and still routing packets perfectly, we may be tempted to leave it alone forever.

But if the manufacturer stopped fixing vulnerabilities years ago, the device may no longer be appropriate at an important security boundary.

Functional does not always mean secure.

What About IPv6?

IPv6 changes some of the assumptions people learned from traditional IPv4 home networking.

IPv6 provides an enormous address space, and devices do not need traditional IPv4-style NAT merely because addresses are scarce.

This makes an important principle even clearer:

Do not depend on NAT as your security policy.

The firewall should explicitly control what traffic is permitted.

Whether a network uses IPv4, IPv6, or both, we still need sensible firewall rules.

Outbound Traffic Matters Too

Home-network security often concentrates on keeping attackers out.

But suppose a compromised device is already inside.

Perhaps an IoT device has been compromised.

Perhaps malicious software is running on a computer.

That device may attempt to contact an external command-and-control system or send information elsewhere.

This is why more advanced security designs also think about outbound traffic.

Does every device need unrestricted Internet access?

Should a security camera be able to communicate with arbitrary systems anywhere on the Internet?

Should an IoT thermostat be able to initiate connections to every device on the local network?

Those questions lead us toward segmentation and firewall zones.

Default Deny

Here is another important security concept:

Default deny.

Instead of starting with:

Allow everything unless we discover a reason to block it.

a stronger security model often starts with:

Block communication unless we have a reason to allow it.

Then necessary access is deliberately added.

This is not always practical in exactly the same way on every home network, but the concept is fundamental to firewall design.

Allow what is needed.

Do not automatically allow everything else.

Firewalls Create Security Boundaries

Until now, we have mainly pictured one firewall boundary:

Internet | Firewall | Local Network

But that does not have to be the only boundary.

Imagine:

Internet | Firewall | Trusted Computers

Internet | Firewall | Guest Devices

Internet | Firewall | IoT Devices

Internet | Firewall | Security Cameras

Rules can also control communication between those internal networks.

Now the firewall is not simply protecting us from the Internet.

It is helping control movement inside our own infrastructure.

Why Internal Boundaries Matter

Suppose one inexpensive Internet-connected device becomes compromised.

If every device is on one unrestricted network, the compromised system may be able to communicate with many other local devices.

If the device is isolated on a separate network with carefully designed firewall rules, its ability to move elsewhere may be greatly reduced.

This is another form of defense in depth.

We assume that someday one layer might fail.

Then we ask:

What stops the problem from spreading?

This Is Called Limiting Lateral Movement

Attackers do not always reach their ultimate target immediately.

They may compromise one system and then attempt to reach additional systems from there.

This movement through an environment is often called lateral movement.

Network segmentation, firewalls, authentication, least privilege, and system hardening can all help limit that movement.

Notice how our security concepts keep connecting.

Take a Look Inside Your Router

Without changing anything yet, open the administrative interface for your own router and simply look around.

Can you identify:

• The WAN address or connection status
• The LAN address
• The DHCP settings
• The DNS settings
• The firewall settings
• IPv4 and IPv6 information
• Port-forwarding rules
• UPnP settings
• Remote-management settings
• Connected devices
• Wi-Fi networks
• Guest-network settings
• Firmware version
• Available updates

Do not change settings merely because you find them.

First understand what they do.

That is how we turn administration into security administration.

Ask Why Before Opening the Door

When configuring a firewall, one question is extraordinarily useful:

Why does this communication need to be allowed?

If there is a good reason, create the appropriate access securely.

If there is no reason, perhaps the connection should not exist.

This applies to ports.

Remote administration.

Cameras.

Servers.

IoT devices.

And eventually the individual networks we create inside a property.

The Router Is More Than the Box That Gives You Wi-Fi

It is easy to think of the router as the device we restart when the Internet stops working.

But it is much more important than that.

It sits at a major security boundary.

It routes traffic.

It may translate addresses.

It tracks connections.

It enforces firewall rules.

It may provide DHCP and DNS functions.

It may control Wi-Fi.

It may establish VPN connections.

And it can determine which parts of your network are allowed to communicate with other parts.

Understanding the router means understanding one of the central control points in your digital environment.

We Are Ready to Divide the Network

We now understand enough to ask a much more sophisticated question.

Instead of asking:

How do I connect everything to my network?

we can ask:

Should everything be on the same network in the first place?

That question takes us into VLANs, network segmentation, guest networks, IoT isolation, firewall zones, and eventually a properly designed security-camera network.

The physical Cat 6 cable gives us the pathway.

Switches give us connectivity.

Routers move traffic between networks.

Firewalls decide which traffic should be permitted.

And good network design determines where the boundaries should be.

We are no longer simply connecting devices.

We are designing a network.