Could a router be hacked from WAN end if firmware always up to date, no portwarding, no upnp and wifi disabled.

[johnqhu]

Hi,

I'm trying to setup some servers to host some applications which I can access from Internet. So, some ports of my router may need to be open to public. Of course, I'll try to implement reverse proxy, https and firewall to make is as safe as possible.

But to further secure my important data, I'm considering split my home network into two layers. What I have now are one asus rt-ac86u router and one synology rt2600ac routers. I think they both are just consumer routers.

I'm planning to put Synology router for Internet connection. Its WAN holds public IP address, and the LAN subnet is set to 192.168.1.0/24. The servers I want to access from Internet are in this subnet. Port forwarding has to be enabled for the Synology router.

The Asus router is behind the Synology router. Its WAN is in Asus router LAN subnet, for example, the WAN IP address is set to 192.168.1.100 and its LAN subnet is set to 192.168.10.0/24. All my working PCs and NAS are in this subnet. Wifi, port forwarding and upnp of Asus router are all disabled. The default admin account also changed. And let's assume the firmware of the routers are always up to date.

So, my question is:
1. If somehow my Synology router was hacked because of the port forwarding, could the hacker be able to further hack my Asus router?
2. If the answer of the first question is Yes. Then comparing to just put the Asus router facing Internet (no upnp, no port forwarding, no server could be accessed from internet), does the data behind the Asus router have the same security for both scenario? I just care the security of my working PC and NAS data. The servers are not important.

Thanks,

 

[coxhaus]

Everybody ends up with software bugs. You have to pick a company and trust them.
It is one of the reasons I use Cisco.

 

[follower]

Hi,

I'm trying to setup some servers to host some applications which I can access from Internet. So, some ports of my router may need to be open to public. Of course, I'll try to implement reverse proxy, https and firewall to make is as safe as possible.

But to further secure my important data, I'm considering split my home network into two layers. What I have now are one asus rt-ac86u router and one synology rt2600ac routers. I think they both are just consumer routers.

I'm planning to put Synology router for Internet connection. Its WAN holds public IP address, and the LAN subnet is set to 192.168.1.0/24. The servers I want to access from Internet are in this subnet. Port forwarding has to be enabled for the Synology router.

The Asus router is behind the Synology router. Its WAN is in Asus router LAN subnet, for example, the WAN IP address is set to 192.168.1.100 and its LAN subnet is set to 192.168.10.0/24. All my working PCs and NAS are in this subnet. Wifi, port forwarding and upnp of Asus router are all disabled. The default admin account also changed. And let's assume the firmware of the routers are always up to date.

So, my question is:
1. If somehow my Synology router was hacked because of the port forwarding, could the hacker be able to further hack my Asus router?
2. If the answer of the first question is Yes. Then comparing to just put the Asus router facing Internet (no upnp, no port forwarding, no server could be accessed from internet), does the data behind the Asus router have the same security for both scenario? I just care the security of my working PC and NAS data. The servers are not important.

Thanks,

1. Yes.
2. No matter what you do, the server makes your system get hacked.

Don't expect anything with consumer grade network devices.

 

[sfx2000]

Don't expect anything with consumer grade network devices.

Or enterprise level gear - they've also been bent over the table giving up the goods...

 

[Justinh]

It is one of the reasons I use Cisco.

Even Cisco has issues ... and of course they aren't consumer-grade.

“Cisco buried the lede.” >10,000 network devices backdoored through unpatched 0-day

An unknown threat actor is exploiting the vulnerability to create admin accounts.

arstechnica.com

Backdoors Keep Appearing In Cisco's Routers

Five different backdoors were found in Cisco's software this year, and Cisco's history with backdoors goes back many years.

www.tomshardware.com

US and Japan warn of Chinese hackers backdooring Cisco routers

A joint cybersecurity advisory by the FBI, NSA, CISA, and the Japanese NISC (cybersecurity) and NPA (police) sheds light on the techniques the Chinese threat actors known as BlackTech use to attack Japanese and U.S. organizations.

www.bleepingcomputer.com

Hackers exploit zero-day to compromise tens of thousands of Cisco devices | TechCrunch

Hackers have exploited an unpatched zero-day vulnerability in Cisco’s networking software to compromise tens of thousands of devices, researchers have

techcrunch.com

 

[coxhaus]

Cisco is probably the most hacked network devices in the world. But Cisco fixes things as they come up fairly quickly. Better than most.