Title: 3.5 Wireless Setup
Course: Information and Communication Technology: Module B > Section: Section 3 - Wireless Technology Basics

3.5.1 Wireless Setup

Wireless setups vary between vendors and models but for the most part, they are very similar. There are just a few basic steps to install a wireless network and make it operational. Security is important because wireless inherently allows easy access from outsiders.

Here are several strategies you can use to secure your wireless:

      ✓ Change the default IP.
       ✓ Change the default username and password.
       ✓ Change the SSID and disable the SSID broadcast.
       ✓ Apply strong encryption and authentication.
       ✓ Apply MAC filters.
       ✓ Apply traffic filtering.
       ✓ Secure the wireless and remote access.

Each of these configuration items will be discussed as part of the the setup process.

Most home routers will have a graphical user interface (GUI) and step-by-step instruction on how to complete the setup. Some will be sold with a CD to help automate the process, but in this course, we will manually set up the router.

There are five basic sections to be configured:

- setup
- wireless
- firewall
- administration
- status

3.5.2 Wireless Setup

The first step is to connect and power on the router:

1. Unbox the router, plug-in the power adapter, and turn on the router.

2. If this is not a new router, press and hold the reset button on the back of the router for 30 seconds. This will reset the router to the factory default settings.

3. Connect the computer’s network card to one of the router’s 4 switch ports using a straight-through RJ-45 cable.  It doesn't matter which port you choose.

4. Do not connect the router’s Internet port yet.

5. Open the Network and Sharing Center and select “Change Adaptor Setting” on the left.

6. Right-click the current wired adaptor and select “Properties."

7. Highlight “Internet Protocol Version 4 (TCP/IPv4)” and select “Properties." Be sure “Obtain IP Address Automatically” and “Obtain DNS Server Address Automatically” are selected. Click OK on all open windows.

8. Open the computer’s command prompt (select Run from the start menu and type “cmd” then click OK or select Start…All Programs…Accessories…Command Prompt and type “cmd” then click OK UB press the Window’s Key + R to open the Run prompt and type “cmd” then click OK.

9. From the command prompt, type “ipconfig." Be sure the IP address and Default Gateway are on the same network.

10. The Default Gateway address is the IP address of the router. Open a browser and type the Default Gateway address (router address) and hit Enter.

11. The router’s GUI should open and may ask for a username and password (supplied by your instructor).

12. Troubleshoot with your instructor if needed.

3.5.3 Setup Tab

Within the Setup tab, the Basic Setup page allows the setup of the Internet connection and services.

1. Internet (WAN) Setup:

  1. Set the connection type to “Automatic Configuration – DHCP." This will let the router get its Internet IP address from the modem connected to the Internet. This may vary depending on the connection to the Internet Service Provider (ISP).

Other options are:

    - Static - a fixed IP address to connect to the Internet

    - PPPoE - A Point-to-Point Protocol over Ethernet is used for a DSL or PPPoE connection

    - Bridge Mode - Uses the router as a wireless access point instead of a router

  2. Leave the Domain Name blank. This may be required by your ISP.

  3. The Maximum Transmission Unit (MTU) should be set to “Auto." This is the largest protocol data unit (PDU) that the network layer can pass. MTU can be a fixed size (manual) or the connection may decide the MTU at connect time (auto). This may be set from 1200-1500. 1500 bytes is the largest allowed by Ethernet.

3.5.4 Setup Tab

Basic Setup (continued).

1. Network Setup:

  1. The host name is the name to be associated with this router. It can be set to anything.

  2. The IP address is the local address of the router. This address will be used to access the router’s setup. It will also be Default Gateway address for the local network. It should be a private address. Most home routers will specify a non-routable class “C” network address such as 192.168.0.1.

  3. The subnet mask defines the size of your network.

  4. DHCP server should be Enabled. The Dynamic Host Control Protocol allows the router to dynamically assign IP addresses to all the connected devices. Without it, each device would have to configured manually.

  5. The start IP address is the first IP you want DHCP to assign to devices. If subnetting, be sure the address fits into the selected subnet. This address MUST be on the same network as the router’s IP address.

  6. The number of users is the maximum number of addresses the router will assign (DHCP Pool). This number should be set close to the maximum number of devices you expect to connect. The maximum number of devices for a Class C network is 254, but the number available will vary as you change the subnet mask.

  7. The client lease time is how long the device’s IP is good before it has to be renewed. Zero or one day is the default.

  8. DNS addresses are usually left blank as they are assigned by the automatic configuration in DHCP. In order to reach the Internet, DNS addresses may have to be located on the modem and statically assigned here.

2. Time Settings:
  1. Set the time zone to the local zone and enable automatic daylight savings.

3. Save the settings. Settings changes will not go into effect until the Save button is selected. All settings will be erased if they are not saved before moving off the page.

4. If the router’s IP address is changes, it is necessary to type “ipconfig /release” then “ipconfig /renew” at the command prompt to update the computer’s IP settings. Then type the new router IP address to access the router’s GUI.

3.5.5 Advanced Router Tab

The Advanced Routing tab.

1. Network Address Translation (NAT) should be Enabled. It allows this router to share its Internet connection with your local network.

2. Other options may include:

  1. Dynamic Routing using the Routing Information Protocol (RIP)—allows the router to automatically exchange routing tables with other routers that have the same protocol enabled. This option is available only when NAT is Disabled. Only use this when other routers are on the same network. Depending on the router, other routing protocols may be available.

  2. Static Routing—allows statically assigned routes to other routers. This should be left blank for this class.

3. Save the settings. Setting changes do not go into effect until the save button has been selected. They will be erased if not saved before moving off the page.

4. Now connect the router’s Internet port to the incoming signal (probably the modem supplied by your ISP) using a straight-through RJ-45 cable.

5. Test the Internet on a wired computer.

6. Troubleshoot with your instructor if needed.

3.5.6 Wireless Configuration Tab

The Wireless configuration tab.

1. Configuration options: Be sure the wireless option is Enabled.

2. Depending on the router and its dual band abilities, these settings may vary. The 2.4 GHz is the most common band. Basic wireless setup includes:

  1. The network mode allows the selection of the appropriate network standard. The available options are usually the following:

    1. Mixed—Allows any standard to connect. Any ”B”, “G”, or “N” clients may connect. (Note: All clients will run at the lowest standard currently connected.)
    2. “B” only—All clients must run at the 11 mbps standard. “G” and “N” may only connect at this rate.
    3. “G” only—All clients must run at the 54 mbps standard. “N” may only connect at this rate. “B” client cannot connect.
    4. “N” only—All clients can run up to the 540 mbps standard. “B” and “G” clients cannot connect.
    5. “B/G” only—All clients can run at the 11 mbps or 54 mbps standard.
    6. Disable—No 2.4 GHz connections allowed.

  2. The network name (SSID) is the name of the wireless network that all clients will see. It is alpha-numeric, case sensitive, and cannot contain any spaces.

3.5.7 Wireless Configuration Tab

Wireless setup (continued).

1. The Security mode contains the encryption and authentication methods for the wireless setup. Encryption is described as the encoding of wireless data to prevent intercepted data from being read by a hacker. It prevents unauthorized access to the wireless network and encrypts the data sent across it. There are three types of encryption for home (personal) use.  Methods for business or enterprise configurations will not discussed in this lesson. Home use encryption choices are:

  - Wired Equivalent Privacy (WEP) utilizes RC4 for encryption. This method can be easily cracked, so it should be avoided whenever possible. However, WEP may be the only method available on older wireless devices.

  - Wi-Fi Protected Access (WPA) utilizes the Temporal Key Integrity Protocol (TKIP) which uses dynamic keys for encryption. It was an intermediate measure to take the place of WEP. TKIP dynamically generates a new 128-bit key for each packet. This method was used with WPA until vulnerabilities were found in TKIP.

  - Wi-Fi Protected Access 2 (WPA2), also known as the IEEE 802.11i standard, was developed in response to the vulnerabilities in WPA/TKIP. WPA2 replaced TKIP with Counter Mode with Cipher Block Chaining Message Authentication Code Protocol (CCMP) which is based on Advanced Encryption Standard (AES). It uses a 256-bit encryption key. So far, no easy methods have been found to break AES.

3.5.8 Wireless Configuration Tab

Wireless setup (continued).

It is important to understand the distinction between being authenticated onto a wireless network and then having the traffic that passes through that network be encrypted.

It is possible to be authenticated onto a network and pass open, unencrypted traffic. Common authentication methods are:

- Open authentication—The simplest authentication method. It only requires that the end device be aware of the Service-Set Identifier (SSID) used on the network. As long as the SSID is known, then the device will be allowed onto the network. No passphrase is required. This method is used when you disable the security mode.

- Shared authentication—Commonly used on individual and small business wireless networks. This method uses a Pre-Shared Key (PSK) that is given to both sides of the connection. If the keys match, then the device is allowed onto the network. On your router, this is shown as WPA-Personal or WPA2-Personal.

- Extensible Authentication Protocol authentication (EAP)—Most common method used by enterprise or large companies. The EAP method utilizes an authentication or radius server that is queried for authentication using a variety of credential options. On your router this is shown as WPA-Enterprise or WPA2-Enterprise.

When deploying a wireless LAN, it is very important to deploy secure methods for both authentication and encryption so that the network can only be used by those individuals and devices that are authorized.

3.5.9 Wireless Configuration Tab

Wireless setup (continued).

  1. The "passphrase" is your password to access the wireless. It is alpha-numeric, case sensitive, cannot contain any spaces, and must be 8-63 characters long. This is the key that will be used to connect devices to the wireless network.

  2. The channel width is how the frequencies are bonded together. A channel requires at least a 20 MHz channel width. The wider the channel, the more bandwidth and data it can carry. 40 MHz is required for “N” to work at high speed.

  3. The channel is the frequency of a wireless signal. There are 11 channels designated in the 2.4 GHz range spaced 5 MHz apart in the U.S. Using only channels 1, 6, and 11 is recommended to avoid interference. The default is channel 6, therefore changing to channel 1 or 11 may help.

  4. The SSID broadcast allows the router to send out its name so other devices can see it. When disabled devices have to know it is available and manually input the SSID. Disabling broadcast adds a level of security.

2. The 5 GHZ band is very similar but with these differences:

  1. The network mode allows you to select the network standard you want to run. These options are available:

    1. Mixed – Allows any standard to connect. Any “A” or “N” clients may connect.
    2. “A” only – Only “A” standard may connect.
    3. “N” only – Only “N” standard may connect.
    4. Disable – No 5 GHz connections allowed.

  2. The channel width of each channel is separated by 20 MHz instead of 5 MHz. They can be bonded together to make a 40 MHz channel.

  3. There are 9 channels available without restrictions. There is some separation of channels (36, 40, 44, 48, 149, 153, 157, 161, 165) Channels 149-165 operate at a higher power and have the potential to increase the wireless signal range.

3.5.10 Wireless MAC Filter Tab

The Mac filter allows only selected devices to connect to the wireless network, even if they know the SSID and passphrase. Permitting allows only selected devices access to the network while denying all others.

Look at the Wireless Client List to see a list of devices that have previously accessed the wireless network or type “ipconfig /all” from the command prompt of a device to see its MAC address or physical address.

3.5.11 Firewall Tab

The Firewall tab allows the firewall to be turned on and off and the selection of some filtering. Stateful Packet Inspection (SPI), sometimes called dynamic packet filtering, keeps track of the state of network connections traveling across it.

The firewall is programmed to distinguish legitimate packets for different types of connections. Only packets matching a known active connection will be allowed through the firewall. The firewall should always be Enabled for the network’s protection.

The Internet filtering or traffic filtering is a feature that allows blocking undesirable traffic from entering or leaving the wireless network.

- Block Anonymous Internet Requests (Enabled)—This setting prevents the router from being able to be pinged or otherwise connected to on the external interface, unless there is a port-forwarding filter in place. This should be enabled, but it's important to keep in mind that not being able to ping the router can make it more difficult to troubleshoot.

- Filter Multicast (Disabled)—This setting allows multicast traffic to be forwarded to the appropriate destination. Multicast traffic is traffic destined to multiple hosts. This allows the traffic to be sent one time, while allowing multiple registered hosts to receive it, which it more efficient than sending the traffic to individual hosts. A host registers to receive this multicast traffic by virtue of the fact that it is running an application that is configured to listen on the corresponding multicast IP address. Multicast is frequently used for the transmission of multimedia and streaming data. Multicast traffic is frequently filtered when it is either unnecessary or to prevent multicast-based attacks. Although somewhat counterintuitive, filtering should be disabled if multicast traffic is to be permitted.

- Filter Internet NAT Redirection (Disabled)—This setting configures the router to block access to local resources from other local computers that are attempting to access the local resource via the external (NAT) address.

3.5.12 Firewall Port Forwarding Tab

The Port Forwarding tab allows certain types of traffic to be permitted from all external hosts over the specified ports to the specified internal destination. Thus, servers behind the router/firewall can be better protected while still allowing access to the applications and resources on the server from external hosts.

- Some common applications are preconfigured with dropdowns for your convenience (1-5). For example, if an FTP server is running on the internal server with an IP of 192.168.30.101, the router would be configured as shown.

- Others allow individual configuration (6-15). For example, to connect xBox Live© to an xBox located at 192.168.30.105, configure the router as shown. There are other types of forwarding (Port-Range Forwarding, Port Triggering, Quality of Service) that will not be discussed.

3.5.13 DMZ Tab

DMZ or demilitarized zone is a military term for a boundary between two military powers where activity is not permitted. It forms a border or neutral zone between them.

On the DMZ screen, a single host can be identified that will be treated as a completely unfiltered and unprotected host by the router. Although the internal host still uses NAT for communications with external resources, the router/firewall allows all solicited and unsolicited traffic from external sources to this server in the DMZ.

Only one device may be set as the DMZ. This device is vulnerable to attacks and poses a security risk. It should only be used when necessary.

Common uses include:

- web servers
- mail servers
- FTP servers
- VoIP servers

3.5.14 Administration Tab

On the Administration tab, management of the routes can be defined. Other management type tasks can be performed from this tab, such as software upgrades, how logging should be configured, and reset the router to the factory defaults.Those tasks will not be discussed in this lesson.

The Management screen is used to:

1. Specify the router password. Keep in mind that all users can access the router using the same password, so a unique password for the router should be selected and only shared with people responsible for the maintenance of the router.

2. Allow access to the router via HTTP and/or HTTPS:

  1. HTTP allows all the data being transmitted, including passwords, to be sent in an unencrypted format.
  2. HTTPS is a secure way of sending data. If wireless access to the router is permitted, only access via HTTPS should be allowed.

3. Allow Remote Access:

  1. Configure the router to allow remote management access. This can prove handy if your router is in a remote location that is not easily accessed. Permitting remote access allows anyone on the remote network who knows the password to be able to access and configure the router. Unless this functionality is really needed, it should be disabled. If it is required, only allow access via HTTPS and specify the IP address allowed to manage it.

4. Allow UPnP:

  1. Universal Plug-n-Play allows the router to automatically open ports and permit traffic. Unless UPnP is required, it should be disabled.

3.5.15 Status Tabs

The status tabs are used to check your configuration and to troubleshoot.

1. The Router tab shows basic information about the router and its Internet connection. The connection to the ISP can be reset from here.

2. The Local Network tab shows information about the LAN including the information supplied to all the DHCP clients on the network.

3. The Wireless Network tab shows information about the wireless connections.

Now that you've learned basic setup and security of a home router, let’s move to the Tech Park and configure a router.

Please complete assignment 3.5.1 in the lab manual.

Continue to the Tech Park: Park 2