I've got what I suspect is pretty close to the "standard" nerd home setup these days - I've got a Windows PC or two, a media PC hooked up to my TV, and a pair of iPhones, all sitting behind a wireless router/NAT/DSL Modem. No server and no Domain, just classic windows peer-to-peer networking.

Since this is a home network there isn't anything much more valuable than Doctor Who episodes and word processor documents on the systems. In a best case scenario, we wouldn't have any security at all so my wife and I could move files and such around without hassle, but we'd really just as well not have any black hats decide to p0wn the system.

Currently, we've got the full security turned on with the wireless - and that's about it. The default accounts on the windows boxen are Administrator level accounts without passwords. Shared folders on the network are fully shared without needing any credentials.

So, the question is, how much do I really need at home? Can I turn off the Windows Firewall? Can I turn on remote desktop given that the accounts all have a password of <enter>?

To put it succinctly, for home use, do I really need anything stronger than just a WPA2 wireless router password and a hardware NAT?

  • A prime question for superuser.com when it opens! – Copas Jun 9 '09 at 20:38
  • @Copas - True! Still, we'll get the pumps primed here at serverfault, I suppose. Mostly, I wanted to see what the rest of the professional IT crowd actually had at home. – Electrons_Ahoy Jun 9 '09 at 22:24
  • 1
    I will allow it for now under the banner of sysadmins / IT pros relating their home setups.. – Jeff Atwood Jun 9 '09 at 22:45

Once upon a time, I was walking by my poor little Linksys router on a Sunday afternoon, and noticed that the activity lights were blinking like mad. Since no one in the house was actively using a PC at the time, I thought it merited some investigation.

Network setup at that time: DSL Modem -> Linksys wireless router with WEP key and Mac filtering -> 2 Windows XP boxes without remote desktop enabled, and a poor, long-suffering PII-333 running FreeBSD sitting in the DMZ.

Further review of the logs on the FreeBSD system indicated that I was being portscanned rather enthusiastically from about 12 different IPs from two different country codes.

Bonus headache points: the one friend I gave a shell account to, so that he could SSH in from his workplace? Yeah, he used a bad password. Silly me.

Steps I took at the time: - Stopped broadcasting the SSID for the wireless - Implemented MAC filtering at the wireless router I use the wireless so infrequently, and from only one device that this made sense for me.

  • Turned wireless off by default ... it's not that much more effort to kick one of the kids off a WinXP desktop and enable the wireless on the AP via the admin interface before I retreat to the couch with the laptop.

  • Told myself repeatedly that stuff doesn't need to live in the DMZ without a Good Reason

Who knew it was that easy to open ports on my Linksys so that I could properly enjoy a game of Team Fortress? READ YOUR ROUTER'S DOCUMENTATION.

  • Moved SSH to a non-default port on my UNIX box

I'm still seeing at least two portscans per day on my home DSL connection, and friends in the neighborhood who have same provider have also indicated they're seeing portscans on a regular basis. Thanks to laziness, they're only scanning commonly used ports.

  • Moved to using SSH keys instead of passwords on the UNIX box. If they find my SSH port, they need my SSH key.

Steps I'm planning to do when I get time: - Set up a pfsense-based firewall/router again. Previous one had a HD failure, and I put the linksys back into service as the router.


My thoughts ...

1- DSL Router: standard NAT, turn off external access to web admin, turn off Universal Plug-n-Play, use ShieldsUp to make sure that you are locked down.

2- Wireless: If you use wireless then encrypt with WPA2. Don't bother hiding the SSID; that is useless comfort. Use MAC-address locking if you won't add devices often. I have friends and the kids friends over a lot, so I don't.

3- External Access: I would use a VPN rather than just boring firewall holes for SSH or other remote access. Some consumer routers have them (or see my note about the Astaro below).

4- Passwords: I would put relatively strong passwords on the systems, even if they are all the same thing or all known by the family.

5- Admin-level: Come on now .. surely you know better! I would avoid running at Admin-level for regular use, even if everyone knows the password.

6- Backups: What are you securing? You indicated that all you have to lose is some media. I would challenge that. Do you do your finances? Do you have family pictures? You need to have backup handled .. see this question for a discussion on home backups.

If you want to have some fun and get even more secure and granular, get the (free for home use) Astaro Security Gateway software and put it on an old PC with two NICs.

  • The most important data in the world is my wife's digital pictures. OK, maybe my boss' wife's digital pictures! – BillN Jun 9 '09 at 22:59

It's a "superuser.com" question, but the same principles apply to a home network w/ respect to least-privilege, keeping backups, etc.

Remember that all the programs you run (either on purpose, or when a bug causes arbitrary code to be executed on your computer) gets whatever rights you have. That might make you think about using non-privileged user accounts.

If you care about keeping your data when you accidently run a worm, trojan horse, etc, you might also consider keeping offline backups. The trojan can smash all the files your least-privileged user account has access to, but it can't touch files on a disconnected hard disk drive sitting on a shelf (or better, in some other building that won't burn / blow away / flood when your house does).

Perhaps you don't have any data you care about being made public, but give a thought to what the thieves are going to get when they steal your computers. You might re-think using encryption with strong passphrases for at least some of your files.


I would leave on the windows firewalls and add exceptions as necessary. Have multiple layers of security. Do you upgrade your modem/router firmware regularly?

remote desktop is okay to open, but for sure use authentication.

Cheers, -Mathew


Your setup is very similar to mine. Only differences is I leave firewalls on (with exceptions added) and I add MAC address filtering to the WPA2 wireless security.

  • @Brad I also disable broadcast on my wireless router. It's just one more step toward securing the environment. I also run a domain on my home network with Windows Server 2k3 just for fun with login scripts, enterprise anti-virus, etc. – JFV Jun 9 '09 at 21:21

I don't run a firewall on any of my home computers, even though they have fully routable IP addresses, mostly because I have a firewall in front of them, which only lets in the smallest amount of traffic necessary.

I don't encrypt my wireless either, because it's on a separate subnet to my main network and is mac-address locked to access the Internet.

It's a matter of how happy you are with your protection and how much damage anyone could cause. How important is your data? Is it backed up? How much work would it be to recover it?

  • MAC Address spoofing is trivial – Matt Rogish Jun 9 '09 at 23:32
  • 1
    yes, MAC Address spoofing is trivial ... to a tiny proportion of the population. All you've got is some Internet access. I'm happy with that risk. – David Pashley Jun 10 '09 at 0:15

Not the answer you're looking for? Browse other questions tagged or ask your own question.