General security checklist (advise needed)

[maholio]

Hi!

I am running my home router.

Can you please advise any settings or plugins or firewall rules to make it more secure without having head ache?

[admon]

Here is a general checklist:

Luci brute force protection

This is a topic that cannot be answered in general terms, as it has many dependencies. It depends on the size of the company, the purpose, the number of employees and the technology used. Basically, you can say that deactivating Wi-Fi (or disconnecting the network so that Wi-Fi can only be used for surfing and has no access to internal systems) is a proven standard method for securing the internal network. Otherwise, it also belongs in this category: Use a firewall (no, OpenWrt is usually n…

“more secure” always depends on what “more” means and what you are doing with the device itself.
It’s pretty secure out of the box.

[xize11]

to be honest the router itself is already very secure by default, is there room for more security?, yes could be, is it mandatory? no.

a classic NAT firewall is designed to talk only one way, from source/local to outside and never from outside to source, except when they talk back on the same line as a reaction to your local devices communication.

• now it can be discussed when you want to close icmp port from the outside so that people cannot ping your router externally.

• you can also choose to disable ssh, if you are afraid a infected device might break in locally.

• maybe add layers of isolation within your topology with vlan?

• maybe look into things like nextdns or adguardhome to protect more against malicious sites?

more than often it are the end devices which need protection, and there need be strong passwords set.

[maholio]

@admon

Here is a general checklist:

What is firewall if not the one in OpenWRT? I have only Android devices, no desktops, no iPhones.

@xize11

close icmp port from

How to do so?

@xize11

disable ssh

Is there any toggle? I didn’t see it

@xize11

maybe add layers of isolation

You mean Guest network? Done

@xize11

nextdns

Done

[xize11]

@maholio

@xize11

close icmp port from

How to do so?

I believe it’s under System → Security then scroll down where it says Allow ping make sure it is unchecked, you can do this aswell for ssh.

for ssh you can also take another step to ensure its also disabled for local use:

go to System → Advanced Settings → login again → Click on System tab → Administration → SSH Access and click on delete.

if the Security option is not there in the menu then let me know this depends on the firmware it can also be done via the advanced settings.

[admon]

@maholio

What is firewall if not the one in OpenWRT? I have only Android devices, no desktops, no iPhones.

If you are just using it for your home network (like only android devices) you are fine.
But since you asked for a general checklist - yep, a modern firewall with application detection is part of good security

[maholio]

@xize11

System → Security then scroll down where it says Allow ping make sure it is unchecked, you can do this aswell for ssh

Just checked I don’t see something like that

Can I see screenshot?

@xize11

know this depends on the firmware

Latest one. It shows me that it is up to date.

BTW checked on Mudi and Opal. No such settings…

@admon

modern firewall with application

Do you know something for Android?

[xize11]

ah then these routers are older

in that case you have to enter advanced settings → login → click on network tab → firewall → traffic rules, then the first rules are the ones you may want to disable.

here is a screenshot, note that I use OpenWrt with a custom theme (not the gl firmware):

IGMP you may want to disable, but only if you wish to not forward igmp from upstream this can break iptv, for Allow ping I actually show it disabled on the screenshot you may want to, but in my case I have enabled it due to the reasoning of using tracert (debugging purposes) but that does automaticly also means you are reachable from the outside for pinging.