0

I'm looking to setup my home network with xfinity and am looking for a modem and a router to use.

Any suggestions for modems and routers that are compatible with xfinity that would provide as much initial security as possible?

I do not want to use their recommended stuff.

Also, any pointers as to what else I could do to protect my network as possible? Besides what was listed here:

https://security.stackexchange.com/questions/215254/setting-up-a-secure-modem-router-with-isp

Improve this question

2 Answers 2

Reset to default
2

For starters, make sure that if you get a third party modem/router you get an approved device since you'll be up a creek if you want Comcast to acknowledge that you have an Internet outage because of them. Their support page gives some tips on selecting an approved one. Supposedly there's an Amazon page that has a bunch of approved modems/routers as well, but I don't know how outdated it is.

I personally use the rented modem/router (I live in a rural area, so there are no other xfinity hotspots to leech off of when my monthly cap is used up) in bridge mode and use a Linux-based PC for my router/firewall. You can get a residential router and just use that, but odds are pretty good that when a new model comes out the firmware updates will stop coming, leaving it vulnerable to new security exploits. Vendors have also historically been pretty slow at creating and distributing firmware updates, while with some Linux distributions you can set up automatic/unattended updates. There is also at least one case of backdoored firmware, such as D-Link's DIR-620 router (casual Google search also shows up many similar cases of easily exploited base firmware).

There was a comment in that link you posted about WPA3 as well. If it requires hardware support, you will not have access to it when it finally is released and will be stuck with WPA2. Updating a custom router would only require purchasing a new wireless adapter that is compatible with WPA3 (again, if there are hardware requirements for it).

If you do end up purchasing a router/modem combo you will want to go and disable things like WPS and UPnP port forwarding, and probably other quality of life "enhancements" since they're bad for security.

Improve this answer
3
  • I'm surprised you don't mention the middle ground - semi- and professional router hardware. In my experience they are easier to set up and use less power than a dedicated PC. Although the point about upgradeability is valid.
    – jaskij
    Commented Sep 15, 2019 at 13:28
  • @JanDorniak Good point. I actually use a PC Engines device for my router, so I suppose it can be thought of as semi-professional router hardware. Obviously not as upgradeable as a full blown desktop computer, but it's still running a standard x86 Linux operating system. It would be nice to find something with lower power usage though, I think it uses about 6 watts under load.
    – user
    Commented Sep 16, 2019 at 12:26
  • I think it will be hard to lower that unfortunately. Personally my colleague recommend MikroTik devices to me and I quite like them: cheap and full featured. A 5-port router with an SFP cage and one PoE port with MSRP of 40 or 50 USD?
    – jaskij
    Commented Sep 16, 2019 at 14:22
1

I second @user: use your provider's router/modem as a bridge and your own router behind that. Waaay less hassle and not using their hardware does not gain you anything honestly.

If you are worried about eavesdropping: don't. Wether you use your ISPs modem or not won't change a thing. One thing which you could do is set up a site-wide VPN which is supported by all of the solutions listed below.

As for devices: while setting up a router and firewall on a Linux box is a good way it is very technical and requires a lot of knowledge.

Typical commercial devices are out because their security is substandard.

That leaves a few options:

  • pfSense - a dedicated BSD-based system intended to work as a firewall. You can buy an appliance or install it on a spare PC.
  • OpenWRT - a free Linux-based router operating system which can be installed on many commercial routers. You also lose warranty by installing it.
  • MikroTik - dedicated routers with their own Linux-based OS (aptly called RouterOS), it works quite well and is easier then using a typical GNU/Linux, they are not expensive as well. In my local circles they're preferred over Cisco - similarly full featured but cheaper.
  • Ubiquiti - high quality but a bit expensive routers and access points. Their main selling point is the ease of setup.

All listed above are thought to be secure, as far as software bugs go. Personally I would choose between Ubiquiti (easier to set up, better Wi-Fi, expensive) and MikroTik (cheaper, hard to set up, worse Wi-Fi). OpenWRT is IMO not worth the hassle for the money saved and pfSense appliances comes with Wi-Fi (at least the official ones).

Improve this answer
8
  • appreciate the info. So you're basically saying that there's no point in using an ISP provided equipment vs anything else in terms of any kind of added benefits?
    – mph85
    Commented Sep 15, 2019 at 19:08
  • @mph85 no, you misunderstand me. What I mean is to use ISP equipment and your own after that. So you have: cable - ISP modem - your router. And your whole network connected to your own router.
    – jaskij
    Commented Sep 15, 2019 at 19:12
  • It's easier and cheaper to add your own router after ISP router then to replace ISP equipment entirely.
    – jaskij
    Commented Sep 15, 2019 at 19:13
  • i've never heard of using 2 routers, so using ISP provided router and then add my own router on top of that? how do you do that?
    – mph85
    Commented Sep 15, 2019 at 20:10
  • @mph85 connect them with an Ethernet cable. I assume the ISP router will have at least one Ethernet port. You take a cable, plug it into the ISP router and then into your own router into the port which is labelled WAN or Internet. And I don't want to be rude but if you need to ask such basic questions you definitely want the ISP equipment. And buy Ubiquiti. And disable Wi-Fi on your ISP router. Or treat it as the guest network.
    – jaskij
    Commented Sep 15, 2019 at 20:33

Not the answer you're looking for? Browse other questions tagged or ask your own question.