Nighthawk guest network seems to be oversharing, even when set not to - firmware issue?

[Opern]

Hi,

I have a Nighthawk 7000V2 (fully patched to firmware V1.0.0.53_1.0.2) and I appear to have run into a security bug, with regards to network isolation of devices on the guest network, which should be relatively easy to replicate on other Nighthawk 7000V2 routers.

After hearing about the fact that some "internet of things" devices, Smart TVs and the like can have weak security, and can often have exploits that can be hacked, and also even sneakily gather information about your network to use for whatever purposes, as part of their terms and conditions, I decided to try and isolate these sort of devices. As as far as I'm concerned, all they really need is internet access, and that's all they should have. On my old router I could set a network isolation setting to isolate all wireless devices, with no requirement to talk to or even know about other devices on my network, and that's what I wanted to do with the Nighthawk 7000V2.

But I came a little unstuck with the Nighthawk, as there didn't seem to be an isolation option in the wifi settings. But, after a bit of googling, I discovered that if I set up a wifi guest network, I could isolate devices on this instead. And this seems a more elegant solution than just restricting all wifi devices (although a blanket isolation option would also be nice!). Great! Problem solved...or so I thought.

So I set up the guest network, and set up different SSIDs (I decided to set up both 2.4Ghz and 5Ghz) and set different passwords for it. As of course the main purpose of this guest network was to network isolate anything I connected to it, and only allow it internet access, I left both check boxes on both the 2.4Ghz and 5Ghz for "Allow guests to see each other and access my local network" as the default, unchecked.

I then decided to test out the guest network by connecting up one PC to the regular wifi and SSID, and connect up a PC running Linux to the guest network and run nmap on this linux PC connected to the guest network...

Bad news. Things didn't seem as they should be, as I could see the other PC and the MAC address of it's wifi. The isolation is not working, plain and simple. In fact if I connect anything else to the network, I can see them and their MAC addresses, too.

Also if I connect both PCs to the guest network, the other PC's still just as visible.

One oddity I did note, though, is the over-sharing bug only occurs when I run as superuser, using sudo. I'm not sure what's making this difference, but I suspect that this security feature is coming from my PC's linux install, and I don't really feel this should make any difference as to whether the Nighthawk reveals it's network, as any compromised device on the network could choose to present itself as under the eqivalent of superuser control, surely? Like I say, though, I think it's probably my linux install that's doing the descriminating.

So this is what I'm running at the linux command line if anyone has a linux setup and wants to replicate what I'm seeing. You might have to use apt-get or the like to install nmap, of course:

sudo nmap -sP 192.168.0.0/24

To me this looks like a clear bug to me and security hole in the firmware, right? I can't really see what else can explain it.

Other points I should make:

When I discovered the problem, I decided to patch the Nighthawk with the latest firmware to see if that would fix the problem. Nope, still there. So as stated, the Nighthawk is patched to the latest firmware edition, version V1.0.0.53_1.0.2. It hasn't fixed the issue.

I've also checked back with my old router for a comparison, using the same PCs, and the visibility of my other PC appears and disappears when I turn the wifi network isolation on and off. So, it really doesn't look like I'm doing anything wrong.

Like I say, it should be easily replicatable.

So, any chance of a firmware patch, if other people can replicate what I'm seeing and confirm the bug?

[Netduma_Jack]

(Moving this topic to the Nighthawk forum)

[schumaku]

Sorry @Netduma_Jack  - wrong section again. Based on the firmware version and the 7000v2 hint, it's about a D7000 v2 - a DSL router. -> Cable Modems, Routers And DSL Modems please 8-) 

[antinode]

> [...] my old router [...]

   Not a very detailed description of anything.

> [...] I could see the other PC and the MAC address of it's wifi. The
> isolation is not working, plain and simple. [...]

   Everything's complicated, not "plain and simple".  Netgear's
guest-network implementation seems to comprise some firewall-like rules,
not some kind of complete (physical) isolation.  I don't know what
"nmap" does, but if it's something like "ping" (ICMP), then those rules
might have no effect.  On the other hand, if you try to use TCP/UDP to
move any significant data, then you may see much less success.

> [...] only occurs when I run as superuser, using sudo. [...]

   Some network operations (broadcast, for example) might be allowed
only for a privileged user.  That'd be an OS restriction, not anything
to do with the network itself.

> To me this looks like a clear bug to me and security hole in the
> firmware, right? [...]

   That depends on your expectations.  Have you tried any real-world
tests, like, say, file sharing, or accessing a local web server, or
anything which would actually transfer data between a guest client and a
non-guest client?

[schumaku]

Well, Netgear is badly suffering with maintaining the Rxxxx router firmware - Cxxxx and Dxxxx are suffering much more. I don't wonder a second if there are much more issues...

[w3wilkes]

Perhaps Netgear will do their typical... Declare the device EOL and walk away like they do with most of their very expensive consumer devices. If it's still under warantee, you should return it for something else.

[schumaku]

I had a related discussion with Netgear's @johngm (he is in charge for the business products, not for this consumer stuff) a while ago. It's known that the Netgear consumer deivces allow to dicover to some extent systems between the normal WLAN/LAN and the wireless guest network - e.g. on the MAC/ARP level. However, practically there is no access possible. They promised to enhance this behaviour for the Orbi Pro, but stick with it for the consumer stuff like Orbi, Nighthawks, & Co. Not sure if this is what triggered the @Opern initial post. So either case, there is no perfect, dedicated VLAN like isolation between the guest and the standrd LAN/WLAN.

[Opern]

Thanks for the replies. Apologies for getting back a little late.

[Opern]

Thanks for the reply.

I confess I haven't tried moving data between the guest network connections. Mainly because I felt the fact that they can even see each other is not what I was wanting or expecting, and probably enough of an issue on its own.

My expectations would be that guest network clients wouldn't be able to see anything of the rest of my network apart from the router, and wouldn't be able to see other guest network connections, either, as that's how my old router (a much cheaper, 300Mbps single-band effort) works when isolation is turned on, but with the Nighthawk they can pretty much see everything, even if they possibly can't connect to them. So I'm feeling a little like I've paid more for a downgrade, in this regards, at least.

I think the fact that they can see each other also leaves the door more open for a potential security exploit to take advantage of that.

Well, I guess the check box "Allow guests to see each other and access my local network" in routers configuration, if left unchecked, might be open to interpretation as to how that would be implemented. My expectation would be, if left unchecked, is I'd expect the guest network connections to neither be able to see each other, or be able to access my local network. I think most people would also interpret it that way.

As they definitely CAN see each other, I'm definitely calling it as a bug in my book.

Thanks.

[Opern]

@w3wilkes thanks, I feel I might need to try that.

(last reply was to @ antinode, BTW. Not sure that was obvious, as my replies aren't quoting other posts. Sorry, not familiar with this forum software).

[Opern]

---

@schumaku wrote:

I had a related discussion with Netgear's @johngm (he is in charge for the business products, not for this consumer stuff) a while ago. It's known that the Netgear consumer deivces allow to dicover to some extent systems between the normal WLAN/LAN and the wireless guest network - e.g. on the MAC/ARP level. However, practically there is no access possible. They promised to enhance this behaviour for the Orbi Pro, but stick with it for the consumer stuff like Orbi, Nighthawks, & Co. Not sure if this is what triggered the @Opern initial post. So either case, there is no perfect, dedicated VLAN like isolation between the guest and the standrd LAN/WLAN.

---

Ah spotted the quote button.

Hmm, that's not good / what I wanted.

I can't help but feel it's to some extent a bug, what I'm seeing, though, mainly based on how the check box in the router configuration is worded. It says to me I at least should not be seeing other guest network connections if the check box is unchecked. And IMO, that guest network connections shouldn't be seeing anything but the router.

So I still hope someone at Netgear is paying attention to this and they can issue a firmware update.

Thanks.

[schumaku]

---

@Opern wrote:

Hmm, that's not good / what I wanted.

---

Understood.

---

@Opern wrote:

I can't help but feel it's to some extent a bug, what I'm seeing, though, mainly based on how the check box in the router configuration is worded. It says to me I at least should not be seeing other guest network connections if the check box is unchecked. And IMO, that guest network connections shouldn't be seeing anything but the router.

---

Well, Netgear does not agree - I was told I'm to much SMB and corporate IT oriented when having pushed towards a complete isolation including adding real VLAN support on the LAN ports. Netgear is convinced the current solution is sufficient for consumer devices.  

---

@Opern wrote:

So I still hope someone at Netgear is paying attention to this and they can issue a firmware update.

---

I fear that's very unlikely. These are features to be pushed on the "Idea Exchange for Home", some entries exist (among some others correctly nagging about other related shortcomings of the guest WiFi administration - like long time dropping all wireless connection).

Check and vote up these:

• Feature request: provide true network segmentation for guest wifi
• Guest network isolation (+VLAN in AP mode!)

Regards,

-Kurt