Please forgive me for what may be a newbie question.
The firmware for my device is fully updated at currently 3.105, and the OpenWRT version on it is 18.06.1. Yet the current (old-stable) version of OpenWRT is 18.06.9, because there have been many security updates since 18.06.1.
So does that mean that my device is not securely updated? Is 3.105 secure even though the OpenWRT version it is out of date? Or maybe those security updates up through 18.06.09 are somehow actually included in 3.105 despite it showing 18.06.01?
I apologize if this question has already been answered elsewhere. I could not find it directly addressed. Thank you.
But this does not seem true, as according to the OpenWrt team there are 7 CVEs with dnsmasq:
Although dnsmasq is used in all GL iNet routers, there have been no patches released by the GL-iNet team for any product running the latest 3.105 or earlier firmware, and there is no pinned posting about the security issue with a list of possible work-arounds. We are all at risk, and NO ONE is getting any support on this security issue. The only thing we can do is wait until the 3.20x code is released and probably deal with a bunch of new bugs so we can get this critical issue fixed.
@eric: Oh wow, the response you linked is very similar to my question. Not sure how I missed that.
So basically, GL-iNet is saying that if a security issue is important enough, that they’ll patch it themselves. But you are saying that there are some vulnerabilities that Gl-iNet thinks are not important enough to patch, like the dnsmasq stuff.
It seems so very difficult to find a maker of retail-grade routers that will continue to provide timely security updates to their devices for the whole life of the device. Does such a company even exist? Anyway looks like I should definitely prefer whichever devices are well-supported by OpenWRT, since that seems to only way to get real security patches. And that I should abandon the idea of the native Gl-iNet firmwares.
The dnsmasq issues can be mitigated via config. We covered that in this thread:
Please use the search for such issues, it was discussed on the same day the issue was discovered, many weeks ago.
@eric Please update your post, it’s misleading when you didn’t use the forum search.
@Eli@TreeDogNight
All the routers are in the process of being updated to 19.0x, in the 3.201 firmware. You can use the latest snapshots if you are in a rush to upgrade, but notice the UI still has some issues. The base system has been upgraded, which is the first priority at the moment, next will be the UI:
@Johnex : My point was the only way to know about the dnsmasq issue is to search the forum, as this issue is not pinned to the top of the forum, and the public bug database was taken away awhile ago. There should be a security page, like the one on the OpenWrt forum, to keep all of us informed about known issues, especially security issues.
As there is no easy way to search this forum for all the known security issues with the different version of firmwares that GL iNet has released, such as the two issues I brought up in my post, the only way right now to find them is to read all the forum posts. That is a lot to expect out of a new router owner who may be under the impression that known security issues are quickly fixed or documented.
Most router owners get an Asus or something off the shelf that is easy to use. OpenWRT has a learning curve. Most off the shelf routers have kernels from many years ago, and you don’t see updates as fast as GL.
Unfortunately if you want the latest OpenWRT, you need to use Vanilla OpenWRT without the GL UI, since it takes time to test and upgrade all the routers. Users can check their version in Luci, it will always say what OpenWRT you are running, regardless of how many updates, snapshots and patches GL releases on top.
Turris is able to update faster as they only have 2 routers based on the same processor family. Their routers also cost many times more than GL routers. You also want to probably look at their EULA, as they send a lot of data back to their servers for processing for a lot of their features.
If someone has installed latest OpenWRT, could you please comment on how is the user experience without GL UI?
Is it difficult to install and update OS, set up and connect VPN, and set up internet access by CL or in LUCI? This is supposed to be used without another UI.
I have run both the OpenWrt 19.07.6 released code and some of the snapshot builds for the upcoming OpenWrt 21.xx code (real bleeding edge stuff) on different GL iNet routers. The OpenWrt GUI LUCI has a steep learning curve, but if you want to do something special with your GL iNet hardware, like adding a second long range external WIFI radio using a USB adapter, it is the only way I have found to do it. The OpenWrt firmware is much smaller then the GL iNet firmware, as you only install the packages you are using. With the OpenWrt firmware you can target the firmware to the problem you are trying to solve. This gives your router a smaller attack vector, as there are less packages installed that may have security issues.
I have about a half dozen different GL iNet routers, doing all different functions for myself and family. Depending on the function, I am either running the GL iNet 3.105 firmware with work-arounds for the dnsmasq bug, or OpenWrt 19.07.6. It is much easier to setup the GL iNet GUI to configure things, as long as you don’t need to play outside the box, and you are willing to work around known bugs. This means reading this forum religiously, as it is the only way to find out about new bugs.
If you want to have the most control and the quickest access to patches for security bugs, go with OpenWrt. It is not that hard to do a simple setup of a GL iNet router with OpenWrt and LUCI. There are several youtube videos showing how to do the initial setup. I have used the GL iNet firmware update page to load the OpenWrt firmware, and I have used the OpenWrt update tool to re-install GL iNet firmware, without having to use uboot. It may not be recommended, but it works and lets me test out both sets of firmware. Try OpenWrt and see how you like it! You can always go back.
If I am using the GL iNet router as a travel router, where I may need to change a bunch of stuff to get it to work with some hotel WIFI, captive login and firewall, I normally use the GL iNet firmware, as its faster to make these changes on the fly, and to reconfigure the VPN client. If I need to do anything special, outside of what the GI iNet team documents, I use the OpenWrt firmware.
Thank you all for your help. Especially @eric. I now better understand the limitations of my Gl-iNet device. This part is a little bit heart-breaking:
“As there is no easy way to search this forum for all the known security issues with the different version of firmwares that GL iNet has released, such as the two issues I brought up in my post, the only way right now to find them is to read all the forum posts. That is a lot to expect out of a new router owner who may be under the impression that known security issues are quickly fixed or documented.”
But I also understand Johnex’s point that most other brands of consumer routers are even less secure than Gl-iNet’s. That is surely true.
I cannot spend hours a week reading through GL-iNet’s forums hoping to catch whatever security issues arise from outdated packages (and then studying the issue, and then to take whatever necessary corrective actions). It seems to me then, that regardless of the brand of router, it will cost me the least time OVERALL if I simply install OpenWRT at the beginning, and to keep that timely updated, so that I do not have to familiarize myself over and over with security issues. This despite the fact that OpenWRT/luci’s initial setup time is much more difficult than GL-iNet’s. I don’t want OpenWRT for its extra power and customizability; rather I simply want it for its timely security updates.
@TreeDogNight Just one more issue to think about if you go the OpenWrt route. Some GL-iNet routers are much better supported by the current stable released 19.07.x OpenWrt firmware, like my GL-AR300M16, and some routers, like my GL.iNet Microuter-N300, the only available OpenWrt firmware is in the daily development snapshot builds which are the test builds for the future 21.xx OpenWrt release. I’m not comfortable running development firmware in production, so at this time, I’m limited on which GL iNet products I will run the OpenWrt firmware on. The GL iNet team does not provide a lot of information on which products run the OpenWrt code best and which are not well supported. You have to read through a bunch of forum posts, both in this forum and in the OpenWrt forum to figure this out.
@eric@treedognight Newbie here, too (newbie to GL-iNet, but professionally in the IT bidness) and glad I found this recent thread because I had the same questions about the security of the GL-iNet devices.
Looks like I’ll be loading up a recent stable version of OpenWRT as well. Continuing to use OpenWRT 18.06.1 from Aug of 2018 seems downright…negligent. [1] Roughly 2.5 years of security updates is a loooong time to wait.
I admit the GL-iNet GUI is nice and easy to use, but the OpenWRT GUI isn’t that bad (if you are dedicated enough to already be on this forum, that is). For reference to others who may find this thread, it is located (from the GL-iNet GUI) from “More Settings” then “Advanced,” or directly:
[1] Recently grabbed a Mango v2 (GL-MT300N-V2) because it was bewildering to go through their extensive product line, where IMHO there are too many variants that differ by a very small number of features, so I just purchased the Mango for $20 to play around with. Waiting for availability of the Beryl GL-MT1300 to do this “for real” and rip out the almost equally security-negligent other products currently in the household.
The latest firmware 3.105 that I have comes with a 19. To be fair, it’s not that bad, at least compared to other router companies.
Note that these older versions are probably supported by OpenWRT and might receive security updates. So if glinet uses 18.06 but takes and compiles it recently it’s still fine.
Be aware that one of the things that Gl.Inet do with the MT300N-V2 (and the Beryl) is use Mediatek proprietary drivers. OpenWRT native will use open source drivers. Gl.Inet has used the proprietary drivers for “efficiency” reasons and as such you MAY get performance hits on native OpenWRT depending on your requirements.
