Can NTL see past a router?

[jellybaby]

My neighbour has been having problems with her connection, so she rang NTL up and they told her to check her firewall. Now she isn't running a firewall because she is using a Belkin wireless router. She explained this to them and they said that she can't be because he was in her computer.

Is this possible ????

I wouldn't think so, unless the router is very poorly set-up.

[jellybaby]

Exactly what I thought...just got me thinking so thought I'd get some reassurance

[MovedGoalPosts]

If the router doesn't have a firewall integrated to it, it would be very possible for somebody to view the LAN side of the network. However it would then depend on the computer configuration whether the outsider can see anything on the PC. Whether the support guy knows how to do it, I dunno.

Most modern routers do have some firewall integrated. Check the manual to see if this is configured or not.

[jellybaby]

Will pop round after work to have a look.

Thanks

Generally routers tend ot hav NAT (network address translation) this mean you have to manually set the router up for each application that is sending and receiving things.

So in effect to set up FTP, you would set Your extgernal IP address port 21 to the internal IP address port 21.

Without this in theory they wouldnt be able to access.

Also if NTL were "in" the users computer without any kind of agreement I should imagine they would be in breach of data protection and the computer misuse act.

What I have found to be the case when NTL are trying to say its my PC at fault is that they have connected to the Modem, which is on the "live" side of the router and is visible over the internet.


I was once asked to remove all security on my PC so NTL could see what the problem was, needless to say they were told that there was about as much chance of snow in hell as me shutting down all security on my system for them.
I changed nothing, powered modem down for an hour, came back and lo and behold everyhting was fine on my faulty PC.

[andybarker]

As Timewarrior said, because of the requirement of NAT if you have a router (after all, that is why it is called a router - it routes things using NAT / PAT) nothing could get into your LAN without the router being set up to forward specific ports to specific LAN IPs.

When a router says it has a firewall, this tends to mean things like handling DOS attacks, port scans, etc. These tend to be on the higher end routers.

However, because a router uses NAT it inherantly acts as a firewall to any packets coming in from the internet where there is no rule to forward that packet (how would the router know where to send a packet coming in when it comes in on an unconfigured port?)

[Ignition]

Originally Posted by Rob C

If the router doesn't have a firewall integrated to it, it would be very possible for somebody to view the LAN side of the network.

*Only* if the LAN side had public IP addresses not RFC1918 addresses which all ntl customers will have. So from that point of view it's impossible for someone to see the LAN side of the router. It is possible to see if there are PCs behind the NAT and how many but not to connect to any of them. Simply the router won't know which PC to send the traffic to.

[nffc]

... and I love the typical ISP TS logic of "oh well, I can ping your modem from Delhi so there MUST be a problem with your PC, go speak to the manufacturer" approach... not only is it 9/10s inaccurate (I love the "winsock fob") but it convinces the poor n00bs there's a problem with their PC. Really, as the ISPs take money off them for the service (internet access) which then they refuse to acknowledge a problem with, let alone sort, is utterly ludicrous.

We've had reports of one ISP's line (who will remain secret- but it's not ntl) who told someone to contact the manufacturer because "it's cheaper for them to sort it than us" - what a fob, and it wasn't even discrete!

[tweetiepooh]

I have a Belkin Pre-N wireless (3 ariels) and it most certainly has a firewall. It will respond to pings unless you tell it not too. The firewall is SPI (stateful packet inspection) and NAT (no PAT unfortunately). You can turn off firewall, especially if set router to Access Point mode where firewall is off implicitly.

I think many of the Belkin stuff is similar.

[Ignition]

Originally Posted by tweetiepooh

I have a Belkin Pre-N wireless (3 ariels) and it most certainly has a firewall. It will respond to pings unless you tell it not too. The firewall is SPI (stateful packet inspection) and NAT (no PAT unfortunately). You can turn off firewall, especially if set router to Access Point mode where firewall is off implicitly.

I think many of the Belkin stuff is similar.

Nah it's ok most of these actually use NAPT and just call it NAT for short (NAPT = network and port address translation)

Pure NAT would keep the same port going in as out such as router DMZ where packets keep the same port all the way through

[BBKing]

oh well, I can ping your modem from Delhi so there MUST be a problem with your PC

Not totally true - the modem isn't pinged from Delhi. Guildford actually. It does try pinging both the modem and the connected IP, but can't tell whether that's a PC or router, nor can it tell whether it's offline or firewalled.

[nffc]

Originally Posted by BBKing

Not totally true - the modem isn't pinged from Delhi. Guildford actually. It does try pinging both the modem and the connected IP, but can't tell whether that's a PC or router, nor can it tell whether it's offline or firewalled.

Point still stands; all it proves is that they can see the modem.

[Hom3r]

Is it the router being pinged or the proxy?

My router has ping blocked, but site checks detect ping on port 80 (HTTP)

I hate routers with a passion. I used to have one for my lad to access the internet in his bedroom, I've since turned it off and ordered another broadband connection from NTL.