setting up wirless security for a Dlink DSL-G604T

can anyone give me a step by step guide to setting up wirless security
for a laptop for this router Dlink DSL-G604T.

I have one which I use wirelessly. I'll send you a PM and we can go through it.

Here's that url I mentioned in the PM.

http://www.expansys.se/f.aspx?i=110551

A useful resource for those with a D-Link DSL-G604T.

Since eXpansys is a Manchester-based British company, a slightly better link is:
http://www.expansys.com/forum.asp?man=D-LIN&code=110551

As far as setting up wireless security goes, this is based on *authentication* and *encryption*. The important thing is to use the highest level of these which is common across all wireless devices on your network.

From highest to lowest, these are:
- IEEE 802.1X authentication against a RADIUS server. This is unlikely to be present on a home network
- WPA-PSK using AES (often referred to as WPA2). Although the hardware of the DSL-G604T is capable of this, D-Link has not released firmware support
- WPA-PSK using TKIP (often referred to as WPA1). This is the best available on the DSL-G604T
- WEP. Readily cracked, but better than nothing

Don't bother with a hidden SSID (it is always transmitted and cannot be hidden) nor with MAC address filtering (the MAC address is broadcast in the clear and easily spoofed).

WPA-PSK using TKIP is secure when using a long (20 character) passphrase of non-dictionary words. This is an example:
%maryhadalittlelamb$
It's not worth bothering with longer/random keys or passphrases.

The config screen for this varies depending on which firmware you are using.
In V1 firmware, it's on the Setup | Wireless screen
In V2 and V3 firmware, it's on the Home | Wireless screen

Selet the WPA button and Pre-Shared Key / PSK String.

If you are reduced to using WEP (as the only common encryption across your devices) find it in the same place but a different radio button. But think seriously about replacing any WEP-only devices.

After configuring the router, save the settings and reboot.

I recommend that you configure the router's wireless security settings from an Ethernet-connected PC. Why? Because a wireless connected PC will lose connection with the router until it is itself configured with the matching encryption details - and if you make an error, it can be awkward to correct.

I also recommend that you use Internet Explorer when configuring the router. Why? Because some config screens use MS-specific Javascript, and you may find that certain settings don't 'take' when using other browsers. Thanks, D-Link

Hope this helps

EDIT: Just a note, since you linked to the eXpansys forum. Don't be put off by the large number of apparent problems. With due respect to the posters, most of these are 'finger trouble'. I hold no brief for D-Link, but the DSL-G604T is a good, reliable device - when it's running good, reliable firmware. The firmware does have a couple of well-known faults - but equally well-known fixes.

Edited by rperkin (Sun 08-Apr-07 03:23:38)

Thanks for the url.

I would personally still recommend:-

1) do not broadcast your ssid
2) do limit access to specified MACs
3) the highest level of encryption

As some combinations of wireless equipment do not function propely when 3) is attempted.

As an analogy

1) disguise your door
2) shut your door
3) lock your door

Also, since I take a layered approach to security, I do not use IE. Probably the biggest single step you can currently take to increase your security on-line is to stop using IE.

edited to say 'currently take'

Edited by deleted (Sun 08-Apr-07 09:35:02)

You did not publish your advice to the OP, so I thought it worthwhile to offer some guidance. These issues have been discussed many times before in this and other forums, and I have no intention of starting a flame war.

Of your statements, the only one (?) which is correct is to use the highest level of encryption (implied: available across all devices on your network)..

Whatever you may hear or read, no matter how authoritative sounding, attempts to hide the SSID or to use MAC address filtering do *not* increase your security. Such actions are merely 'security by obscurity', which is worth so little as to be no security at all.

At best they may make you feel better, but far worse - they may lead to a dangerous sense of false security.

Your analogy is poor. The first element of security would be your option 3 - lock your door. This is achieved by using a reliable technique for authentication and encryption.

The other 'techniques' you recommend are equivalent to asking a passing burglar to close his eyes as he passes so that he doesn't see your door. Likely? I don't think so.

At the risk of repeating myself, the facts are :

The SSID is merely a network identifier. It is part of the IEEE 802.11 standard. It is always transmitted. It *cannot* be hidden. Attempts to 'hide' it are doomed to failure. Certain things will not work, or will not work well, when it is not broadcast. Quite why the myth has arisen that the SSID offers some form of security mechanism is a mystery to me - all I can think of is that it dates back to the early days of wireless networks when such things were less well understood.

Every wireless frame transmitted (depending on type) contains up to four MAC addresses. The MAC address is transmitted in the clear; it is not encrypted. The wireless traffic - and hence any valid MAC address - can be read off the air. It requires no tricky decryption or cracking. A MAC address can be trivially spoofed, and reliance on MAC address filtering it is the least secure of any so-called 'security' mechanisms.

Suffice to say that such bogus methods did not make it into IEEE 802.11i. [Aside: In my original post I used the WPA acronyms of the Wi-Fi Alliance rather than the less widely used terminology of IEEE 802.11i]

Using terms like 'a layered approach to security' means little or nothing. Security is a continuous process of risk identification and assessment, and taking appropriate steps to mitigate such risks.

As far as Internet Explorer goes, it does indeed have a poor reputation for security. Like it or loath it, it's hardly the biggest security risk. To guard against on-line security risks, everyone should practice 'safe hex'. Google for it.

If you operate behind a router (protection from incoming baddies), run a half-decent software firewall (protection from outgoing baddies and other unwanted connections), have an up-to-date antivirus program, and occasionally run anti-malware programs, you will be fine. None of these have anything whatsoever to do with wireless security but are sensible precautions in an unsafe on-line world.

Kind regards

Well we will have to leave it to others to judge but I think I said pretty much what you did but in a lot less words.

No. You made certain recommendations about wireless security which are:
- misleading
- worthless

Provided the OP (or any other user) uses WPA with a key length recommended in IEEE 802.11i, that's fine. If they implement other (lesser) forms of authentication / encryption, that's also fine, if less secure. But they should be aware they are less secure.

What's not fine is publishing poor advice about what constitutes 'good' security measures.

Wireless security is an extremely important issue. There is much poor advice around. Myths should not be propagated further.

And no, I'm not looking for a flame war.

Kind regards

EDIT: Typo

Edited by rperkin (Sun 08-Apr-07 14:05:21)

As has been said, hiding SSID is not only pointless but it can also cause difficulties. "MAC locking" is also a pointless exercise. To further your analogy:

1/ Your door will only really be "disguised" to you.
2/ The door may be shut but it's lock is visibly broken.
3/ The door is visible and so is that unpickable lock. Unless someone really wants something that you have, they will simply move on.

We need to bear in mind that these are mainly home based networks that are under discussion and in virtually all cases, the "hackers" or "crackers" that will be encountered as far as wireless is concerned are merely script kiddies looking for a free internet connection. They will have tools that will sniff out an SSID within seconds and that will easily spoof MAC addresses within minutes.

A strong, eight character plus, alphanumeric passphrase used in conjunction with WPA/PSK encryption is protection enough in most cases and I feel that while all this largely unnecessary attention is being focused on over the top and largely useless wireless security, far more important issues regarding basic system security are being overlooked. A simple trojan, rootkit, keylogger etc dropped on a poorly administered system will probably reveal all the methods and keys that have been used to "lock down" the wireless system anyway.
Therefore, 1 and 2 do little but waste the time and resources of the user - Time and resources that would be better applied in locking down the base system.

Edited by Deadbeat (Sun 08-Apr-07 13:39:54)

Well said.