In reply to a post by BatBoy:

but because the HG612 is configured as a modem, the firewall is inactive and the PC is on the internet "naked"

Ive unlocked mine but the firewall was enabled when i got it, is it safe to turn off as i have both the hh3 and pc firewalls on?

When I turned mine off, the web interface was available on the internet. So I turned it back on.

In reply to a post by BatBoy:

When I turned mine off, the web interface was available on the internet. So I turned it back on.

But yours has an IP address; if the other poster is using HomeHub then surely the public IP is only on the homehub, so you won't be able to get to the Huawei's web interface.

That said, if the poster is using the homehub there isn't any firewall in the Huawei that is doing anything!!

It's not very safe to disable the firewall. The HG612 firewall is best left up at all times (preferably with the "standard" ruleset, or better).

Otherwise rogues can log-in remotely via the embedded web server or via the telnetd interface to do all sorts of nasties. They could, e.g., install tcpdump on your router, and intercept all your traffic, perhaps even steal your entire p0rn stash!

The firewall on the HG612 is a standard Linux stateful packet inspection firewall. It comes in two parts, the netfilter kernel modules, and the userspace tool iptables.

While logged in to the Huawei via a telnet shell, it's possible to list all the rules in the current firewall chains using iptables. As a firewall, the barest safeguard is to drop incoming packets to 22/tcp, 23/tcp and 80/tcp.

Text

1 23 45 67 89 1011 1213 1415

# iptables -L -n ...Chain INPUT_SERVICE_ACL (1 references) target prot opt source    destination         ACCEPT all  --  0.0.0.0/0  0.0.0.0/0  state RELATED,ESTABLISHED ACCEPT all  --  0.0.0.0/0  0.0.0.0/0           ACCEPT tcp  --  0.0.0.0/0  0.0.0.0/0  tcp dpt:23 ACCEPT tcp  --  0.0.0.0/0  0.0.0.0/0  tcp dpt:80 ACCEPT tcp  --  0.0.0.0/0  0.0.0.0/0  tcp dpt:80 ACCEPT icmp --  0.0.0.0/0  0.0.0.0/0           ACCEPT tcp  --  0.0.0.0/0  0.0.0.0/0  tcp dpt:8081 ACCEPT tcp  --  0.0.0.0/0  0.0.0.0/0  tcp dpt:23 DROP   tcp  --  0.0.0.0/0  0.0.0.0/0  multiport dports 21,80,22,23,8081   <---- DROP   icmp --  0.0.0.0/0  0.0.0.0/0           ...

With the firewall disabled this is how the HG612 appears to an intruder*:

HG612 - Firewall Disabled (several critical network services open to every Tom, Dick and Harriet).

With the firewall enabled (with "standard" ruleset), this is how the HG612 appears to an intruder*:

HG612 - Firewall Enabled (sshd, telnetd, httpd all closed and stealthed by a DROP rule)

End-user security is probably a (valid) reason that Beatie locked down the GUI for the HG612.

cheers, a

* These are only network scans of common ports. Not shown in the grc.com scan, but nevertheless running by default is Beatie's remote management daemon, btagent which listens on 161/udp and 161/tcp. There are a couple other network services, too.

For the professional paranoiac, the netstat tool will list every network daemon running on the Huawei.

Edited by deleted (Mon 05-Nov-12 23:35:47)

In reply to a post by jchamier:

In reply to a post by BatBoy:

When I turned mine off, the web interface was available on the internet. So I turned it back on.

But yours has an IP address; if the other poster is using HomeHub then surely the public IP is only on the homehub, so you won't be able to get to the Huawei's web interface.
That said, if the poster is using the homehub there isn't any firewall in the Huawei that is doing anything!!

You're right...

It depends on how the HG612 is configured. If the Huawei HG612 is left running as an ethernet bridge, just as Beatie intended, then these network services are not visible on the WAN-side, and security is in the hands of the router (the BT Home Hub or whatever).

However, if the HG612 is configured as a modem-router (as per the thread topic) then pppd will be running on the HG612 to provide the TCP/IP layer of the stack. In that case, the Huawei's network services (telnetd, httpd, sshd, etc) will all become visible on the WAN-side and must be firewalled.

cheers, a

yes it was in bridge mode and i apologise for hijacking the thread but it was close to what i wanted (well in my mind it was)

Anyways ive left the firewall on and just to be on the safe side ive changed the default password as well

Edited by omnius (Mon 05-Nov-12 22:08:54)

Be aware changing the password does not change the password for telnet access, there is I believe no (easy) way to do that, making firewall on in router mode mandatory.

Can I enable the Huawei HG612 to respond to pings? I'm using it at the moment as a modem/router and can't make my TBB Ping Monitor to work.

Nevermind, I just had to allow ICMP in the firewall settings

In reply to a post by xtermy:

Nevermind, I just had to allow ICMP in the firewall settings

Can you please share how you did this?