Disable LAN port on Asus wifi repeaters

[criminala]

Since I am planning to use a wifi repeater in a hallway which is also accessible to other (unknown) people , I would like to disable the LAN port which these repeaters (almost always) have on board .
So no one can come and just plug in an rj45 and get access to the internal network .

Or if any proper wifi repeater without lan port exist that is OK for me too .

I have tried netgear and tp-link wifi repeaters but they all come with their own security issues (not being able to disable lan port , not being able to change password for repeated signal from the internal signal , not being able to permanently disable the lights after unplugging , and so on ..) .

Am looking at Asus products right now since my main router is an AX86U .

 

[itpp20]

rj45 plug and superglue?

Or lock it, https://www.amazon.com/rj45-lock/s?k=rj45+lock

 

[degrub]

Better to hide where no one has physical access and use poe to power the device.
since this will just be a transparent repeater, why not Ubiquiti ?

 

[criminala]

@itpp20
Well superglue , haha , not that i did not think about such solutions but it will mess up the warranty of the device itself .

A physical lock is OK in secure places where only restricted personnel comes in . Just so no one accidently plugs something in . It is not meant for public places where if someone has physical access to the device can also remove it and have immediate network access through the port . It is not a route I want to go .

Thank you for trying to find solutions though

@degrub
I am open to anything that suits my needs really . Can Ubiquity lock/disable it's ethernet port through it's software that you know ?
I saw the UAP-AC-M , but it is unavailable . Also I think it needs a separate controller ?
Any other recommendation ?

What I need needs to be able to :
- Connect to the 5Ghz on the AX86U router (repeater mode , not access point)
- Be able to create a seperate SSID on 2.4Ghz , with a different password than the password used on the 5Ghz band
- No ethernet port that has access to the internal network or one that I can disable
- Be able to shut off lights which stay off even after a power outage or reboot of the unit
- Have high output (preferably higher than 20dbm , out of the box or through a mod)
- At least MiMO 2x2

 

[eibgrad]

If we're talking about a router that can be reconfigured as a repeater, then any router that supports VLANs natively can easily be reconfigured to simply NOT include certain ports in the default VLAN to prevent their use. You could pick up a cheap T-Mobile TM-AC1900 on eBay ($30-40) (which is just a rebranded ASUS RT-AC68U), install FreshTomato (my preference and recommendation) or DD-WRT, and do most everything you've described, including disable the LEDs. What I can't speak to is dBi. Whatever it is (can't imagine it's anything close to 20dBi, that's pretty high), there's probably replacement antennas available to improve it.

 

[criminala]

If we're talking about a router that can be reconfigured as a repeater...

No we are not talking about that .

If Asus would not have a proper wifi repeater in their lineup , what would you recommend for my repeater usecase ?

 

[criminala]

Tried a CPE510 from tplink today but it was not even seeing the Asus AX86U 5ghz network ... so I sent it back .

I welcome any other recommendations for a proper wifi repeater .


- Connect to the 5Ghz on the AX86U router (repeater mode , not access point)
- Be able to create a seperate SSID on 2.4Ghz , with a different password than the password used on the 5Ghz band
- No ethernet port that has access to the internal network or one that I can disable
- Be able to shut off lights which stay off even after a power outage or reboot of the unit
- Have high output (preferably higher than 20dbm , out of the box or through a mod)
- At least MiMO 2x2

 

[unsynaps]

If someone has physical access there is no such thing as secure.

 

[dosborne]

If you are talking about a *wired* AP, then don't overlook the possibilty of someone disconnecting the AP and plugging in directly to the connection. If you are looking at a wireless backhaul for the AP, then it isn't an issue obviously