Important Device Security Guidelines & Settings for Proroute Routers

This guide covers the essential security settings for Proroute routers. It applies to all models. Some features were modified (Brute-force protection, IP whitelisting) and some introduced (Auth log) in Firmware updates across models at the end of 2025, and early 2026.

First login and password security

All Proroute routers manufactured from June 2024 onwards ship with unique credentials for both the WebUI and Wi-Fi, printed on the device label.

On first successful login to the WebUI, you will be prompted to set a new password. This password applies to:

• WebUI user admin
• SSH user router

Password requirements

The enforced minimum policy is:

Recommendation: Setting a strong password, such as at least 16+ characters is strongly advised. Especially if the router has exposure to the public internet. 

Update to the latest firmware

Ensure your router is running the latest firmware version to receive the most recent security patches and feature updates.

Download firmware for your router model from: Proroute Firmware Selector.

Limit administrative access & security hardening

Location in WebUI: Network > Firewall > Security

Administrative access to the router is available via three protocols:

Note: TELNET is disabled by default and not configurable via the WebUI.

Deny WAN access

Do not expose the WebUI or SSH to the public internet.

The Wide Area Network (WAN) refers to the public internet in most deployments. A mobile interface connected via SIM card is a WAN connection. For each protocol (SSH, HTTPS, HTTP), ensure "Access from WAN" is set to "Deny". If set to "Allow", any device on the internet can attempt to connect to your router, which is a security risk. 

Remote management (if required)

The suggested method for remote management is a VPN. A VPN provides encryption, authentication, and network isolation — administrative interfaces can be made accessible over the VPN, whilst denying access from the public internet.

If a VPN is not possible for the deployment and WAN access is required, then the below guidelines should be considered:

WAN IP blocking & brute-force protection

Brute-force protection automatically blocks IP addresses that exceed a threshold of failed login attempts. By default, brute-force protection is enabled for all three protocols (SSH, HTTPS, HTTP).

Default settings (Configurable)

Login attempts and lockout events are recorded in the Auth Log at Status > Event Log > Auth Log.

IP whitelisting

Location in WebUI: Network > Firewall > Security

The Remote Access IP Whitelist restricts WAN administrative access to trusted IP addresses or ranges only. When enabled, all other source IPs are blocked by the firewall from communicating with the device, and therefore the WebUI and CLI.

Configuration

1. Tick Enable Whitelist — an input field will appear
2. Enter allowed IP addresses or ranges (one per line):
   • Single IP: 203.0.113.45
   • CIDR range: 192.168.10.0/24
3. Click Save and Apply

Important: The whitelist applies to all protocols (HTTP, HTTPS, SSH). Additionally when port forward rules are configured, only the IP addresses in the whitelist can use them — ports will not be reachable from IPs not on the whitelist. Ensure your own public IP used for administration is listed before enabling to avoid locking yourself out.

Event log & Auth log

Location in WebUI: Status > Event Log > Auth Log (top tab)

The Auth log records all access attempts — successful and unsuccessful — to authenticate and gain access to the WebUI (HTTPS/HTTP) and CLI (SSH). It is a useful tool for auditing security related to connection attempts to the device. 

This is saved to Flash storage, so is persistent after a reboot. It is rotated once it gets too long. 

Log entries include

Important: If the router has a fixed public IP address via SIM, it is directly reachable from the entire internet. Reviewing the auth log regularly is critical in this scenario to detect connection attempt patterns from malicious sources.

Security checklist