Router

• Internet Service Provider (ISP) assigns a router IP
  • A dynamic public IP (which may change periodically), or
  • A static public IP (for business or specific needs)
• A router assigns devices IP in the LAN using DHCP (Dynamic Host Configuration Protocol)
  • A dynamic private IP (default)
  • A static private IP
• A router can see connection between LAN devices with servers (e.g. DNS server, VPN server, web server).
• A router can see the connection’s content if the connection is not encrypted. (e.g. DNS request content via UDP, No SSL site request content via HTTP).

<aside> 📎

About Security

Traditional DNS request ****uses UDP without encryption, the WiFi router or a middleman can intercept the request (MITM attack) and see what domain’s IP is requesting, then response a malicious IP, letting user visit the malicious website (DNS attack). The website can have their self-issued SSL, so user won’t notice easily.

How to Avoid

1. Use encrypted connection to make DNS request, preventing MITM attacks.
2. Ensure the device requests to trustworthy DNS server to provide legitimate IP addresses.

Example

1. Traditional
   1. Device → Router → ISP’s DNS server (via UDP)
2. Cloudflare 1.1.1.1 (DNS over HTTPS, or DoH) can satisfy both.
   1. Device → Router → 1.1.1.1 DNS server (via HTTPS)
3. Trusted VPN can provide encrypted tunnel for 1., but may or may not provide its own DNS servers.
   1. Device → Router → VPN server (via WireGuard) → ISP’s DNS server (via UDP)
   2. Device → Router → VPN + VPN’s DNS server (via WireGuard) (Ideal Scenario)

If the router sets a malicious DNS server address, the 3.a approach is still not safe. The 3.a scenario is similar to Apple devices using iCloud Private Relay without DoH.

</aside>

<aside> 📎

About Privacy

Example

1. Device
   • Make a DoH request via WireGuard passage
     • To: DoH provider’s IP
     • Content: Domain name
2. Router (LAN Gateway)
   • From: LAN Private IP
   • To: VPN server’s IP (Instead of DoH provider’s IP)
   • Content: X (VPN + HTTPS encrypts it)
3. Internet Service Provider (ISP)
   • From: Router Public IP
   • To: VPN server’s IP (Instead of DoH provider’s IP)
   • Content: X (VPN + HTTPS encrypts it)
4. VPN Server
   • From: Router Public IP
   • To: DoH provider’s IP
   • Content: X (HTTPS encrypts it)
5. DoH Provider
   • From: VPN server’s IP (Instead of Router Public IP)
   • Content: Domain name

Even though we only use DoH without a VPN, it is still beneficial. The request content is encrypted, so the ISP cannot know the actual domain. The next actual request is harder to analyze the purpose, as an IP can be used in different services. For instance, connecting to 142.250.190.14, it might guess you’re using a Google service, but it won’t know if it’s Gmail, Google Search, or another product.

</aside>

Devices

LAN devices can connect to each other using their private IP with allowance:

• Router Firewall
• Router’s Guest Networks
• Devices’
  • Operating System Firewall
  • Local Services (SSH)

This works because all LAN devices are on the same subnet. If devices are on different subnets, they need router configuration or belong to the same VLAN.