Important Device Security Guidelines & Settings

This guide covers the essential security settings for Proroute routers. It applies to all models. Some features (auth log, brute-force protection, IP whitelisting) were introduced in H685 4G firmware v3.2.355+ and are being rolled out to other models in subsequent firmware updates.

First login and password security

All Proroute routers manufactured from June 2024 onwards ship with unique credentials for both the WebUI and Wi-Fi, printed on the device label.

On first successful login to the WebUI, you will be prompted to set a new password. This password applies to:

• WebUI user admin
• SSH user router

Password requirements

The enforced minimum policy is:

Recommendation: Use a password of at least 12 characters. 16+ characters is strongly advised if the router is directly accessible from the public internet.

Update to the latest firmware

Ensure your router is running the latest firmware version to receive the most recent security patches and feature updates.

Download firmware for your router model from: Proroute Firmware Selector.

Limit administrative access & security hardening

Location in WebUI: Network > Firewall > Security

Administrative access to the router is available via three protocols:

Note: TELNET is disabled by default and not configurable via the WebUI.

Deny WAN access

Do not expose the WebUI or SSH to the public internet.

The Wide Area Network (WAN) refers to the public internet in most deployments. A mobile interface connected via SIM card is a WAN connection. For each protocol (SSH, HTTPS, HTTP), ensure "Access from WAN" is set to "Deny". If set to "Allow", any device on the internet can attempt to connect to your router.

Remote management (if required)

The preferred method for remote management is a VPN. A VPN provides encryption, authentication, and network isolation — administrative interfaces are never directly exposed to the internet.

If a VPN is not possible and WAN access is required:

WAN IP blocking & brute-force protection

Brute-force protection automatically blocks IP addresses that exceed a threshold of failed login attempts. By default, brute-force protection is enabled for all three protocols (SSH, HTTPS, HTTP).

Default settings

Login attempts and lockout events are recorded in the Auth Log at Status > Event Log > Auth Log.

IP whitelisting

Location in WebUI: Network > Firewall > Security

The Remote Access IP Whitelist restricts WAN administrative access to trusted IP addresses or ranges only. When enabled, all other source IPs are blocked from the WebUI and CLI.

Configuration

1. Tick Enable Whitelist — an input field will appear
2. Enter allowed IP addresses or ranges (one per line):
   • Single IP: 203.0.113.45
   • CIDR range: 192.168.10.0/24
3. Click Save and Apply

Important: The whitelist applies to all protocols (HTTP, HTTPS, SSH) and also governs port forwarding rules — ports will not be reachable from IPs not on the whitelist. Ensure your own public IP is listed before enabling to avoid locking yourself out.

Event logging & auth log

Location in WebUI: Status > Event Log > Auth Log

The auth log records all access attempts — successful and unsuccessful — to the WebUI (HTTPS) and CLI (SSH).

Log entries include

Important: If the router has a fixed public IP address via SIM, it is directly reachable from the entire internet. Reviewing the auth log regularly is critical in this scenario to detect brute-force attempts and unauthorised access.

Security checklist