What security features are offered by the BT Homehub 6?
up vote
1
down vote
favorite
A friend of mine requires tight security on her home network to deal with a child protection and safeguarding issue. As a trusted friend of the family, I was asked to help.
After some risk analysis, I have identified that the family would benefit from a router with the following features:
- Wildcard blocking of domains (e.g. "*proxy*", etc.)
- Blocking of specific domains (e.g. "torproject.org")
- Firewalling of specific ports (e.g. 1194, 1743, 500, 4500, 1723, etc.)
- Mac address filtering
A bonus would be ease-of-disassembly so that the factory reset switch and WPS button can be physically-disconnected. (This was easy with Homehub 5.)
While I do not expect the first item on the list to be available on any consumer router, I was disappointed that the other three were not available with Homehub 5. Which of these features (if any) are available with Homehub 6?
networking wireless-networking router security home-hub
add a comment |
up vote
1
down vote
favorite
A friend of mine requires tight security on her home network to deal with a child protection and safeguarding issue. As a trusted friend of the family, I was asked to help.
After some risk analysis, I have identified that the family would benefit from a router with the following features:
- Wildcard blocking of domains (e.g. "*proxy*", etc.)
- Blocking of specific domains (e.g. "torproject.org")
- Firewalling of specific ports (e.g. 1194, 1743, 500, 4500, 1723, etc.)
- Mac address filtering
A bonus would be ease-of-disassembly so that the factory reset switch and WPS button can be physically-disconnected. (This was easy with Homehub 5.)
While I do not expect the first item on the list to be available on any consumer router, I was disappointed that the other three were not available with Homehub 5. Which of these features (if any) are available with Homehub 6?
networking wireless-networking router security home-hub
add a comment |
up vote
1
down vote
favorite
up vote
1
down vote
favorite
A friend of mine requires tight security on her home network to deal with a child protection and safeguarding issue. As a trusted friend of the family, I was asked to help.
After some risk analysis, I have identified that the family would benefit from a router with the following features:
- Wildcard blocking of domains (e.g. "*proxy*", etc.)
- Blocking of specific domains (e.g. "torproject.org")
- Firewalling of specific ports (e.g. 1194, 1743, 500, 4500, 1723, etc.)
- Mac address filtering
A bonus would be ease-of-disassembly so that the factory reset switch and WPS button can be physically-disconnected. (This was easy with Homehub 5.)
While I do not expect the first item on the list to be available on any consumer router, I was disappointed that the other three were not available with Homehub 5. Which of these features (if any) are available with Homehub 6?
networking wireless-networking router security home-hub
A friend of mine requires tight security on her home network to deal with a child protection and safeguarding issue. As a trusted friend of the family, I was asked to help.
After some risk analysis, I have identified that the family would benefit from a router with the following features:
- Wildcard blocking of domains (e.g. "*proxy*", etc.)
- Blocking of specific domains (e.g. "torproject.org")
- Firewalling of specific ports (e.g. 1194, 1743, 500, 4500, 1723, etc.)
- Mac address filtering
A bonus would be ease-of-disassembly so that the factory reset switch and WPS button can be physically-disconnected. (This was easy with Homehub 5.)
While I do not expect the first item on the list to be available on any consumer router, I was disappointed that the other three were not available with Homehub 5. Which of these features (if any) are available with Homehub 6?
networking wireless-networking router security home-hub
networking wireless-networking router security home-hub
asked Nov 22 at 14:40
DMCoding
158110
158110
add a comment |
add a comment |
1 Answer
1
active
oldest
votes
up vote
2
down vote
I do not expect the first item on the list to be available on any consumer router
My apologies for not being able to answer your question directly regarding the availability of features in the pursuit of security, but I feel I must highlight one overriding aspect in this scenario.
The BT Home Hub provided by BT, MAY NOT BE in ownership by the end user. For example, you talk about wanting to disallow/disconnect physically the WPS and Factory Reset buttons. Doing so in a destructive manner and on hardware which isn't yours will incur a cost, unless, by reading license agreement/speaking with customer services, you're able to verify who's in ownership of the router.
Ultimately, if the BT Home Hub doesn't satisfy your "security features" list, the next best solution is to place the Home Hub into "bridge" mode and pass the connection onto a true or other, consumer-owned router (possibly one running something well documented, like pfSense etc.) which would meet both your software AND hardware requirements. Lastly, in any case, how can you be certain that physically modifying hardware won't detriment functionality? Placing some tape or supergluing a button is one thing, but cutting cables and into circuitboards is another.
That is ultimately the plan, yes: in the long-term we would like to move from a system of fully-monitored access to a system with a scanning proxy and dedicated AP, where the proxy will perform deep packet inspection up to and including SSL unpacking so that we can monitor social media usernames and passwords, etc. The main network (with mac filtering) will still be avaialble unmonitored for the rest of the family. In the meantime, I'm worried that all of this can be circumvented by just plugging an ethernet cable directly into the hardware as in the system which you describe.
– DMCoding
Nov 22 at 15:24
Removing the WPS button and reset switch proved extremely easy: all that was necessary to physically secure access was to remove the plastic button assembly, exposing the bare metal of the circuit which we then taped over. Thus it is still possible to access this functionality, but only by opening the case and shorting the circuit electronically. Super-gluing the case shut would be the next logical mechanism to reduce the attack surface further, but for now we don't think that's needed.
– DMCoding
Nov 22 at 15:26
I'm not too concerned about liability. The ISP does not usually ask for these devices back when service is terminated as they are mass-produced so cheaply that they are not typically worth refurbishing. These things suffer weird failures all the time, often due to tripped cables, spilled liquids, pets, etc. I doubt BT are going to care very much about some plastic being removed.
– DMCoding
Nov 22 at 15:31
Writing this with the assumption that the BT Home Hub 5 is a no-go due to the FR/WPS buttons being physically unconnectable, and/or that the HH5 doesn't meet the security features listed on the software level. DD-RWT: dd-wrt.com/support/router-database This is a community database of hardware support for commercially available routers. Find a router without the buttons, and see how well it supports DD-WRT; if it seems like a good match, see your favourite outlets for pricing. OR, you could build your own FreeBSD supporting PC without the hw buttons and install pfSense.
– njs-se
Nov 22 at 15:40
pfSense: pfsense.org/products/#requirements List of router software solutions: en.wikipedia.org/wiki/List_of_router_firmware_projects Edit: above comment should read "BT Home Hub 6"/"HH6"
– njs-se
Nov 22 at 15:46
|
show 4 more comments
1 Answer
1
active
oldest
votes
1 Answer
1
active
oldest
votes
active
oldest
votes
active
oldest
votes
up vote
2
down vote
I do not expect the first item on the list to be available on any consumer router
My apologies for not being able to answer your question directly regarding the availability of features in the pursuit of security, but I feel I must highlight one overriding aspect in this scenario.
The BT Home Hub provided by BT, MAY NOT BE in ownership by the end user. For example, you talk about wanting to disallow/disconnect physically the WPS and Factory Reset buttons. Doing so in a destructive manner and on hardware which isn't yours will incur a cost, unless, by reading license agreement/speaking with customer services, you're able to verify who's in ownership of the router.
Ultimately, if the BT Home Hub doesn't satisfy your "security features" list, the next best solution is to place the Home Hub into "bridge" mode and pass the connection onto a true or other, consumer-owned router (possibly one running something well documented, like pfSense etc.) which would meet both your software AND hardware requirements. Lastly, in any case, how can you be certain that physically modifying hardware won't detriment functionality? Placing some tape or supergluing a button is one thing, but cutting cables and into circuitboards is another.
That is ultimately the plan, yes: in the long-term we would like to move from a system of fully-monitored access to a system with a scanning proxy and dedicated AP, where the proxy will perform deep packet inspection up to and including SSL unpacking so that we can monitor social media usernames and passwords, etc. The main network (with mac filtering) will still be avaialble unmonitored for the rest of the family. In the meantime, I'm worried that all of this can be circumvented by just plugging an ethernet cable directly into the hardware as in the system which you describe.
– DMCoding
Nov 22 at 15:24
Removing the WPS button and reset switch proved extremely easy: all that was necessary to physically secure access was to remove the plastic button assembly, exposing the bare metal of the circuit which we then taped over. Thus it is still possible to access this functionality, but only by opening the case and shorting the circuit electronically. Super-gluing the case shut would be the next logical mechanism to reduce the attack surface further, but for now we don't think that's needed.
– DMCoding
Nov 22 at 15:26
I'm not too concerned about liability. The ISP does not usually ask for these devices back when service is terminated as they are mass-produced so cheaply that they are not typically worth refurbishing. These things suffer weird failures all the time, often due to tripped cables, spilled liquids, pets, etc. I doubt BT are going to care very much about some plastic being removed.
– DMCoding
Nov 22 at 15:31
Writing this with the assumption that the BT Home Hub 5 is a no-go due to the FR/WPS buttons being physically unconnectable, and/or that the HH5 doesn't meet the security features listed on the software level. DD-RWT: dd-wrt.com/support/router-database This is a community database of hardware support for commercially available routers. Find a router without the buttons, and see how well it supports DD-WRT; if it seems like a good match, see your favourite outlets for pricing. OR, you could build your own FreeBSD supporting PC without the hw buttons and install pfSense.
– njs-se
Nov 22 at 15:40
pfSense: pfsense.org/products/#requirements List of router software solutions: en.wikipedia.org/wiki/List_of_router_firmware_projects Edit: above comment should read "BT Home Hub 6"/"HH6"
– njs-se
Nov 22 at 15:46
|
show 4 more comments
up vote
2
down vote
I do not expect the first item on the list to be available on any consumer router
My apologies for not being able to answer your question directly regarding the availability of features in the pursuit of security, but I feel I must highlight one overriding aspect in this scenario.
The BT Home Hub provided by BT, MAY NOT BE in ownership by the end user. For example, you talk about wanting to disallow/disconnect physically the WPS and Factory Reset buttons. Doing so in a destructive manner and on hardware which isn't yours will incur a cost, unless, by reading license agreement/speaking with customer services, you're able to verify who's in ownership of the router.
Ultimately, if the BT Home Hub doesn't satisfy your "security features" list, the next best solution is to place the Home Hub into "bridge" mode and pass the connection onto a true or other, consumer-owned router (possibly one running something well documented, like pfSense etc.) which would meet both your software AND hardware requirements. Lastly, in any case, how can you be certain that physically modifying hardware won't detriment functionality? Placing some tape or supergluing a button is one thing, but cutting cables and into circuitboards is another.
That is ultimately the plan, yes: in the long-term we would like to move from a system of fully-monitored access to a system with a scanning proxy and dedicated AP, where the proxy will perform deep packet inspection up to and including SSL unpacking so that we can monitor social media usernames and passwords, etc. The main network (with mac filtering) will still be avaialble unmonitored for the rest of the family. In the meantime, I'm worried that all of this can be circumvented by just plugging an ethernet cable directly into the hardware as in the system which you describe.
– DMCoding
Nov 22 at 15:24
Removing the WPS button and reset switch proved extremely easy: all that was necessary to physically secure access was to remove the plastic button assembly, exposing the bare metal of the circuit which we then taped over. Thus it is still possible to access this functionality, but only by opening the case and shorting the circuit electronically. Super-gluing the case shut would be the next logical mechanism to reduce the attack surface further, but for now we don't think that's needed.
– DMCoding
Nov 22 at 15:26
I'm not too concerned about liability. The ISP does not usually ask for these devices back when service is terminated as they are mass-produced so cheaply that they are not typically worth refurbishing. These things suffer weird failures all the time, often due to tripped cables, spilled liquids, pets, etc. I doubt BT are going to care very much about some plastic being removed.
– DMCoding
Nov 22 at 15:31
Writing this with the assumption that the BT Home Hub 5 is a no-go due to the FR/WPS buttons being physically unconnectable, and/or that the HH5 doesn't meet the security features listed on the software level. DD-RWT: dd-wrt.com/support/router-database This is a community database of hardware support for commercially available routers. Find a router without the buttons, and see how well it supports DD-WRT; if it seems like a good match, see your favourite outlets for pricing. OR, you could build your own FreeBSD supporting PC without the hw buttons and install pfSense.
– njs-se
Nov 22 at 15:40
pfSense: pfsense.org/products/#requirements List of router software solutions: en.wikipedia.org/wiki/List_of_router_firmware_projects Edit: above comment should read "BT Home Hub 6"/"HH6"
– njs-se
Nov 22 at 15:46
|
show 4 more comments
up vote
2
down vote
up vote
2
down vote
I do not expect the first item on the list to be available on any consumer router
My apologies for not being able to answer your question directly regarding the availability of features in the pursuit of security, but I feel I must highlight one overriding aspect in this scenario.
The BT Home Hub provided by BT, MAY NOT BE in ownership by the end user. For example, you talk about wanting to disallow/disconnect physically the WPS and Factory Reset buttons. Doing so in a destructive manner and on hardware which isn't yours will incur a cost, unless, by reading license agreement/speaking with customer services, you're able to verify who's in ownership of the router.
Ultimately, if the BT Home Hub doesn't satisfy your "security features" list, the next best solution is to place the Home Hub into "bridge" mode and pass the connection onto a true or other, consumer-owned router (possibly one running something well documented, like pfSense etc.) which would meet both your software AND hardware requirements. Lastly, in any case, how can you be certain that physically modifying hardware won't detriment functionality? Placing some tape or supergluing a button is one thing, but cutting cables and into circuitboards is another.
I do not expect the first item on the list to be available on any consumer router
My apologies for not being able to answer your question directly regarding the availability of features in the pursuit of security, but I feel I must highlight one overriding aspect in this scenario.
The BT Home Hub provided by BT, MAY NOT BE in ownership by the end user. For example, you talk about wanting to disallow/disconnect physically the WPS and Factory Reset buttons. Doing so in a destructive manner and on hardware which isn't yours will incur a cost, unless, by reading license agreement/speaking with customer services, you're able to verify who's in ownership of the router.
Ultimately, if the BT Home Hub doesn't satisfy your "security features" list, the next best solution is to place the Home Hub into "bridge" mode and pass the connection onto a true or other, consumer-owned router (possibly one running something well documented, like pfSense etc.) which would meet both your software AND hardware requirements. Lastly, in any case, how can you be certain that physically modifying hardware won't detriment functionality? Placing some tape or supergluing a button is one thing, but cutting cables and into circuitboards is another.
edited Nov 22 at 15:31
answered Nov 22 at 15:14
njs-se
463
463
That is ultimately the plan, yes: in the long-term we would like to move from a system of fully-monitored access to a system with a scanning proxy and dedicated AP, where the proxy will perform deep packet inspection up to and including SSL unpacking so that we can monitor social media usernames and passwords, etc. The main network (with mac filtering) will still be avaialble unmonitored for the rest of the family. In the meantime, I'm worried that all of this can be circumvented by just plugging an ethernet cable directly into the hardware as in the system which you describe.
– DMCoding
Nov 22 at 15:24
Removing the WPS button and reset switch proved extremely easy: all that was necessary to physically secure access was to remove the plastic button assembly, exposing the bare metal of the circuit which we then taped over. Thus it is still possible to access this functionality, but only by opening the case and shorting the circuit electronically. Super-gluing the case shut would be the next logical mechanism to reduce the attack surface further, but for now we don't think that's needed.
– DMCoding
Nov 22 at 15:26
I'm not too concerned about liability. The ISP does not usually ask for these devices back when service is terminated as they are mass-produced so cheaply that they are not typically worth refurbishing. These things suffer weird failures all the time, often due to tripped cables, spilled liquids, pets, etc. I doubt BT are going to care very much about some plastic being removed.
– DMCoding
Nov 22 at 15:31
Writing this with the assumption that the BT Home Hub 5 is a no-go due to the FR/WPS buttons being physically unconnectable, and/or that the HH5 doesn't meet the security features listed on the software level. DD-RWT: dd-wrt.com/support/router-database This is a community database of hardware support for commercially available routers. Find a router without the buttons, and see how well it supports DD-WRT; if it seems like a good match, see your favourite outlets for pricing. OR, you could build your own FreeBSD supporting PC without the hw buttons and install pfSense.
– njs-se
Nov 22 at 15:40
pfSense: pfsense.org/products/#requirements List of router software solutions: en.wikipedia.org/wiki/List_of_router_firmware_projects Edit: above comment should read "BT Home Hub 6"/"HH6"
– njs-se
Nov 22 at 15:46
|
show 4 more comments
That is ultimately the plan, yes: in the long-term we would like to move from a system of fully-monitored access to a system with a scanning proxy and dedicated AP, where the proxy will perform deep packet inspection up to and including SSL unpacking so that we can monitor social media usernames and passwords, etc. The main network (with mac filtering) will still be avaialble unmonitored for the rest of the family. In the meantime, I'm worried that all of this can be circumvented by just plugging an ethernet cable directly into the hardware as in the system which you describe.
– DMCoding
Nov 22 at 15:24
Removing the WPS button and reset switch proved extremely easy: all that was necessary to physically secure access was to remove the plastic button assembly, exposing the bare metal of the circuit which we then taped over. Thus it is still possible to access this functionality, but only by opening the case and shorting the circuit electronically. Super-gluing the case shut would be the next logical mechanism to reduce the attack surface further, but for now we don't think that's needed.
– DMCoding
Nov 22 at 15:26
I'm not too concerned about liability. The ISP does not usually ask for these devices back when service is terminated as they are mass-produced so cheaply that they are not typically worth refurbishing. These things suffer weird failures all the time, often due to tripped cables, spilled liquids, pets, etc. I doubt BT are going to care very much about some plastic being removed.
– DMCoding
Nov 22 at 15:31
Writing this with the assumption that the BT Home Hub 5 is a no-go due to the FR/WPS buttons being physically unconnectable, and/or that the HH5 doesn't meet the security features listed on the software level. DD-RWT: dd-wrt.com/support/router-database This is a community database of hardware support for commercially available routers. Find a router without the buttons, and see how well it supports DD-WRT; if it seems like a good match, see your favourite outlets for pricing. OR, you could build your own FreeBSD supporting PC without the hw buttons and install pfSense.
– njs-se
Nov 22 at 15:40
pfSense: pfsense.org/products/#requirements List of router software solutions: en.wikipedia.org/wiki/List_of_router_firmware_projects Edit: above comment should read "BT Home Hub 6"/"HH6"
– njs-se
Nov 22 at 15:46
That is ultimately the plan, yes: in the long-term we would like to move from a system of fully-monitored access to a system with a scanning proxy and dedicated AP, where the proxy will perform deep packet inspection up to and including SSL unpacking so that we can monitor social media usernames and passwords, etc. The main network (with mac filtering) will still be avaialble unmonitored for the rest of the family. In the meantime, I'm worried that all of this can be circumvented by just plugging an ethernet cable directly into the hardware as in the system which you describe.
– DMCoding
Nov 22 at 15:24
That is ultimately the plan, yes: in the long-term we would like to move from a system of fully-monitored access to a system with a scanning proxy and dedicated AP, where the proxy will perform deep packet inspection up to and including SSL unpacking so that we can monitor social media usernames and passwords, etc. The main network (with mac filtering) will still be avaialble unmonitored for the rest of the family. In the meantime, I'm worried that all of this can be circumvented by just plugging an ethernet cable directly into the hardware as in the system which you describe.
– DMCoding
Nov 22 at 15:24
Removing the WPS button and reset switch proved extremely easy: all that was necessary to physically secure access was to remove the plastic button assembly, exposing the bare metal of the circuit which we then taped over. Thus it is still possible to access this functionality, but only by opening the case and shorting the circuit electronically. Super-gluing the case shut would be the next logical mechanism to reduce the attack surface further, but for now we don't think that's needed.
– DMCoding
Nov 22 at 15:26
Removing the WPS button and reset switch proved extremely easy: all that was necessary to physically secure access was to remove the plastic button assembly, exposing the bare metal of the circuit which we then taped over. Thus it is still possible to access this functionality, but only by opening the case and shorting the circuit electronically. Super-gluing the case shut would be the next logical mechanism to reduce the attack surface further, but for now we don't think that's needed.
– DMCoding
Nov 22 at 15:26
I'm not too concerned about liability. The ISP does not usually ask for these devices back when service is terminated as they are mass-produced so cheaply that they are not typically worth refurbishing. These things suffer weird failures all the time, often due to tripped cables, spilled liquids, pets, etc. I doubt BT are going to care very much about some plastic being removed.
– DMCoding
Nov 22 at 15:31
I'm not too concerned about liability. The ISP does not usually ask for these devices back when service is terminated as they are mass-produced so cheaply that they are not typically worth refurbishing. These things suffer weird failures all the time, often due to tripped cables, spilled liquids, pets, etc. I doubt BT are going to care very much about some plastic being removed.
– DMCoding
Nov 22 at 15:31
Writing this with the assumption that the BT Home Hub 5 is a no-go due to the FR/WPS buttons being physically unconnectable, and/or that the HH5 doesn't meet the security features listed on the software level. DD-RWT: dd-wrt.com/support/router-database This is a community database of hardware support for commercially available routers. Find a router without the buttons, and see how well it supports DD-WRT; if it seems like a good match, see your favourite outlets for pricing. OR, you could build your own FreeBSD supporting PC without the hw buttons and install pfSense.
– njs-se
Nov 22 at 15:40
Writing this with the assumption that the BT Home Hub 5 is a no-go due to the FR/WPS buttons being physically unconnectable, and/or that the HH5 doesn't meet the security features listed on the software level. DD-RWT: dd-wrt.com/support/router-database This is a community database of hardware support for commercially available routers. Find a router without the buttons, and see how well it supports DD-WRT; if it seems like a good match, see your favourite outlets for pricing. OR, you could build your own FreeBSD supporting PC without the hw buttons and install pfSense.
– njs-se
Nov 22 at 15:40
pfSense: pfsense.org/products/#requirements List of router software solutions: en.wikipedia.org/wiki/List_of_router_firmware_projects Edit: above comment should read "BT Home Hub 6"/"HH6"
– njs-se
Nov 22 at 15:46
pfSense: pfsense.org/products/#requirements List of router software solutions: en.wikipedia.org/wiki/List_of_router_firmware_projects Edit: above comment should read "BT Home Hub 6"/"HH6"
– njs-se
Nov 22 at 15:46
|
show 4 more comments
Thanks for contributing an answer to Super User!
- Please be sure to answer the question. Provide details and share your research!
But avoid …
- Asking for help, clarification, or responding to other answers.
- Making statements based on opinion; back them up with references or personal experience.
To learn more, see our tips on writing great answers.
Some of your past answers have not been well-received, and you're in danger of being blocked from answering.
Please pay close attention to the following guidance:
- Please be sure to answer the question. Provide details and share your research!
But avoid …
- Asking for help, clarification, or responding to other answers.
- Making statements based on opinion; back them up with references or personal experience.
To learn more, see our tips on writing great answers.
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
StackExchange.ready(
function () {
StackExchange.openid.initPostLogin('.new-post-login', 'https%3a%2f%2fsuperuser.com%2fquestions%2f1377590%2fwhat-security-features-are-offered-by-the-bt-homehub-6%23new-answer', 'question_page');
}
);
Post as a guest
Required, but never shown
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown