Blog | G5 Cyber Security

Secure Hotspot Bridging

G5 Cyber Security

TL;DR

You can attach a hotspot to your existing network (bridging), but security needs careful thought. Simply sharing an internet connection doesn’t automatically make it safe. This guide covers how to do it securely, focusing on firewall rules and access control.

How to Securely Attach a Hotspot to Your Existing Network

  1. Understand the Setup: You’re essentially creating two networks – your primary home/office network and the hotspot network. The goal is to allow devices on the hotspot network access to resources on your main network, while preventing them from directly accessing or interfering with it.
    • Router 1: Your existing network router (e.g., BT Hub, Virgin Media Router).
    • Router 2: The router creating the hotspot (e.g., a travel router, or your main router in AP mode).
  2. Bridging vs. Routing: Ensure your hotspot router is configured in *bridge mode* if possible. This makes it act as an extension of your primary network rather than creating a separate one with its own IP address range. If bridge mode isn’t available, you’ll need to configure routing and firewall rules (see steps 4 & 5).
  3. Change Default Passwords: This is crucial! Change the default administrator password on *both* routers immediately.
    • Access each router’s settings page via a web browser. The address is usually something like 192.168.1.1 or 192.168.0.1 (check your router’s manual).
    • Navigate to the administration/password section and set strong, unique passwords.
  4. Firewall Configuration (if not using bridge mode): This is where you control access between networks.
    • Router 2 Firewall: Configure Router 2’s firewall to only allow specific traffic from the hotspot network to your main network. A common approach is: 
      # Example iptables rules (Linux-based router) - adjust interfaces as needed
# Allow hotspot clients to access the internet
iptables -A FORWARD -i br0 -o eth0 -j ACCEPT
# Allow hotspot clients to access Router 1's LAN network
iptables -A FORWARD -i br0 -d 192.168.1.0/24 -j ACCEPT # Replace with your main network IP range
# Drop all other traffic from the hotspot network
iptables -A FORWARD -i br0 -j DROP
    • Router 1 Firewall: Check Router 1’s firewall settings. You may need to add a rule allowing traffic *from* the IP address range used by Router 2’s hotspot network.
  5. Access Control (MAC Address Filtering): For increased security, restrict access to the hotspot based on MAC addresses.
    • Router 2: Configure Router 2’s wireless settings to only allow devices with pre-approved MAC addresses to connect. This prevents unauthorized devices from joining your hotspot network. 
      # Example (may vary depending on router interface)
Allowed MAC Addresses:
00:11:22:33:44:55
66:77:88:99:AA:BB
  6. Disable WPS: Wi-Fi Protected Setup (WPS) is often vulnerable. Disable it on both routers.
  7. Use Strong Encryption: Ensure your hotspot network uses WPA3 encryption if possible, or at least WPA2 with a strong password. Avoid WEP as it’s easily cracked.
  8. Guest Network (if available): If Router 2 supports a guest network feature, use that instead of creating a separate hotspot. Guest networks typically have built-in security features and isolation.
  9. Regularly Review Logs: Check both routers’ logs for any suspicious activity. This can help you identify potential security breaches or unauthorized access attempts.
Exit mobile version