Routers

A router connects multiple networks together and forwards packets among networks.

Routers protect against sniffing and man-in-the-middle attacks by sending to a subnet only the traffic that needs to be there, limiting the number of nodes with access to packets.

Sometimes packet filtering is implemented on routers via access lists.

Router Configuration

Other security features commonly found in routers are configuration options to protect malformed or possible vulnerability-exploiting packets from being forwarded to other network interfaces, and to prevent packets with spoofed source or destination addresses from entering or leaving the network. How does the router know a spoofed address when it sees it? If the router sees a packet coming into it from an external interface, and that packet’s source address is set to an IP address within the internal network, odds are that the address was spoofed. Similarly, the router knows that packets coming into it from internal networks should not have external network source addresses – if they do, that may be a sign that someone is using one of your systems as part of a DoS or DDoS attack. Blocking such outgoing packets is just a matter of being a good net neighbor. If everyone did this, a number of DoS techniques would be much less effective, since they rely on the ability to send out packets with a spoofed source address equal to one on the target’s internal network.

A key point is: Don’t depend on your ISP to do this address-check for you, even though it’s pretty clear that they could. Some ISP’s, even large ones, are notoriously unconcerned about security. For example, one unnamed ISP connected to one of the “Baby Bells” has been overheard telling small business customers that individual businesses don’t need to bother with a firewall, because the ISP’s staff monitors the network very carefully – as if all the monitoring in the world would protect against a carefully-executed intrusion. Just like when you’re walking around in an unfamiliar city after dark, you have to watch your own back.