Harden a router you own and record every forward with its reason

short · 45 min · Objective 2.1

Task

Work through the hardening list on equipment you own, and produce the handover record that makes the configuration survivable. The record is the deliverable: a port forward with no explanation gets left in place forever because nobody dares remove it.

Steps

  1. Record the starting state in lab/harden/before.csv with header setting,value,risk covering the administrator credentials, firmware version and support status, remote management, the quick-setup feature, and automatic port opening.
  2. Make the changes you decide are appropriate, and record each in lab/harden/changes.csv with header setting,from,to,why,rollback.
  3. List every port forward in lab/harden/forwards.csv with header port,points_at,why_it_exists,still_needed,alternative. If there are none, record that with a single row saying so.
  4. Record the addressing in lab/harden/network.csv with header item,value covering the subnet, the address range handed out, and every reserved address with what it belongs to.
  5. Write lab/harden/handover.md as the document you would leave for the next technician: what was changed, why, where the credentials are stored, and what must not be turned back on.

Verify

awk -F, 'NR>1 && NF>=3 {n++} END {print n" starting setting(s)"}' lab/harden/before.csv
awk -F, 'NR>1 && NF>=5 {n++} END {print n" change(s) with a rollback"}' lab/harden/changes.csv
awk -F, 'NR>1 && NF>=5 {n++} END {print n" forward(s) assessed"}' lab/harden/forwards.csv
awk -F, 'NR>1 && NF>=2 {n++} END {print n" network item(s)"}' lab/harden/network.csv
grep -Eic 'credential|stored|password manager' lab/harden/handover.md
grep -Eic 'not be turned back on|must stay|do not re-enable' lab/harden/handover.md

Five starting settings, every change with a rollback, and a handover naming both where credentials live and what must stay off. A change with no rollback column is a change nobody can reverse.

Notes

The firmware support question is the one with a real answer people avoid. A router whose vendor has stopped issuing updates is permanently vulnerable, and recommending replacement is honest rather than commercial.

This is an independent study companion for CompTIA A+ Core 2 220-1202 and is not produced by or endorsed by CompTIA.