Building a Secure Home Network Using OpenWRT Firewall

Hello there, satej here, in todays blog we are going to see how we can add an extra layer of security to our local network using OpenWRT firewall!

If you are not familiar with OpenWRT, we recommend you to go check there official website where you can learn more about them, it is basically an open source linux/unix based firmware ready for flashing into SBC (Single Board Computers) or SOC (System on Chip)

So it is more preciously used in embedded devices for several purposes and mainly for security, we can also flash the image in the home router (if compatible)

I have already experimented and used OpenWRT by flashing the image into home router, if you haven't read that blog, it is recommended to go through it once here, where we demonstrated the installation step by step.

1. Basic Overview of LuCI Web Interface

Follow the official documentation for installation part which is not so complicated. after that installation part you can access the LuCi Web Interface in your browser where you get a login page, when you access it first time you can simply just click on the login button without entering password and you're in.

It's recommended to set up a secure password as soon as you logged in if in case you are using such firmware in real or production networks after the fresh install.

Note:- As can be seen in the above screenshot that the ip address is 192.168.56.2 is configured to use with VirtualBox Host Only settings so if you are trying to install and configure openwrt in virtual box then just create a Host only network and set the eth0 interface to use that one and disable other interfaces. and once you booted up then just flushed out the br-lan interface old IP address using ip addr command and set the IP address from the host only network mask (DHCP should be disable for static IP)

After accessing the dashboard you see the set up password option click on that and set up a strong password which ask you when you try to login next time.

Hit the save button and the changes will be applied immediately!!!

Now the dashboard or overview page will show you that what is the status of the firewall which includes basic system information, model, kernel, uptime, etc.

In the status menu there are several options where we can see the firewall which shows the inbound and outbound rules. currently there are none because we haven't configure yet. which is really helpful later on when we define several rules, this becomes easy for us to monitor them.

Then we have system log and kernel log where we can see the logs after the vm booting more particularly our openwrt firmware.

Then we have option to view processes which are active currently and have options to terminate, kill and hang up. terminating or killing system process may lead to system crash and unexpected shutdowns.

The most interesting feature i ever seen is the realtime graph which shows load, bandwidth and connections all in real time which is something wonderful for such open source project. so if you are monitoring your network you can easily analyze the behavior and spot any suspicious spikes or unusual patterns.

Connections tab also allows us to enabling the DNS look ups which will show us that the hostname and the type of or the name of the protocol, below is the another screenshot by enabling DNS lookup you can compare that one with the above one.

Also the transfer rate is showing in the screenshot which shows how much network packets are transferring.

Till now we have seen the overview of the dashboard or we can say status of our router or firewall. There are other important options for configuration and setting which we will explore further.

2. Configuring Firewall Zones

To configure firewall rules we need to navigate to Network submenu -> Firewall where we can see that zone settings where we can configure firewall zones to either allow packet forward, drop or accept (If you don't know what are the zones or not much familiar with it here is something which is recommended for you)

So consider a scenario where we have a main router (Wireless home router in this case) or a gateway which is for routing our local network traffic to the ISP network so whatever comes back to the gateway are again forwarded to the respected devices in the local network.

This is fine in case of using normal work like browsing, watching movies, using phone for games and all. But if in case we have a home server where few of the services are getting exposed on the internet, so whatever traffic comes from gateway will directly reach out to the server, which gives a little space for threat actors if they want to attack home server.

To defend against such scenario and exposing services securely we configure a firewall in between of our gateway and home server so the traffic will come to gateway -> firewall -> home server. firewall will block any unnecessary traffic which is potentially harmful for server and also we just open couple of ports which server wants to serve on the internet and rest of the ports kept close.

Now we have two zones lan -> wan where the default action is accept for input, output and zone forward. but the other one which is wan -> reject as we can see above, we can simply edit the second policy and allow an ssh connection in third policy for ourself to securely access our linux server which is behind the firewall so it's like allowing only ssh connection in zone like DMZ.

Checked the option for lan zone for forward to destination and click save button. then it will show you now the zone is wan -> lan. rest of the settings like input and output has to be default (reject and accept)

We created a DMZ (Demilitarized Zone) for our linux server which can allow us to separate it logically from LAN so the rest of the devices in the LAN should be untouched.

So we just click on the save button and we are done. Then we are having two zones one is lan -> wan where everything is accept and have the DMZ -> wan where again everything is accept.

Note:- In this scenario we have deleted wan -> lan because it was no longer needed but if in case you may want it, just keep it as it is.

At this part we are good to go so let's save & apply. Now we are done configuring basic zones settings for our OpenWRT Firewall.

3. Defining Firewall Rules

After configuring zones we have to configure traffic rules so that we can access internal server for the ssh securely over the firewall.

So for that just click on the Add button and you can see several options for configuring your firewall rule.

Now in this case i already have setup my virtual machine with necessary settings so in real network you have to enter the IP address of your real linux server in the destination IP address. You can refer the general settings as below.

Click on save button and our first rule has been created which can only allow SSH traffic from any zone to DMZ.

You can configure advanced settings for specific source mac address or enable logging (you can explore more settings in advance settings tab) also there is option for time restriction so the rule can be effective for a specific timeframe.

Note:- For simplicity i haven't cover exact topology here in detail but i will give a blueprint of what kind of network we are building so that you can understand that our OpenWRT firewall should be between local network and DMZ so that all the traffic goes through the firewall.

4. Testing Connection from Host

Now our network is ready and above is the topology that how we are going to reach our linux server so that we can try to ping the server directly from our host machine.

As we can see ping requests are timed out means it never reaches to it's destination because of firewall blocking it.

To make this successful we need to add a route of a internal network of a virtualbox on the windows machine with administrator command prompt.

Now we can try to access the server with SSH, because we configured the rule before we can able to access it.

As we can see above we can able to access the ssh even when we can't directly reach the internal server via icmp but with allow ssh rule we can, similarly we can specify and make deny rules so that any specific type of traffic we can block.

5. Extra Features of OpenWRT

OpenWRT is a fantastic open source project and it has it's own dedicated packages readily available we can simply install it on our device to make use of it.

Now for this demonstration i will keep things simple cause i have limited memory allotted to my VM, if you have more memory you can feel free to install extra packages according to the need.

First let's try it via CLI (Command line interface) so to do so we have to login to the openwrt firewall via SSH (This is the greatest and the best feature we have so that we have root access and can do literally anything on the device, it is more effecient when you have dedicated physical device like home router)

After accessing the cli try opkg/apk update to update your packages list from latest repository, As you can see there is written a note that openwrt recently switched to the apk package manager means if you have or using latest image use the apk command to update/install/delete your packages if you have an older image then opkg command will work for you.

We updated packages with apk update command now let's try to install sftp server. Now in this case we already have SSH so we can use SCP (Secure Copy) to transfer files but we want to make it like FTP server with encryption 🥲

So let's install SFTP server with apk, to do so use apk search command first to see the exact name of the package, so that we will get all the packages which has sftp in it's name.

As highlighted above we have to choose this one so let's now copy it's name without the version to install that package to the firewall using apk. so the command will become apk add openssh-sftp-server

We have sftp server installed now we can test it using our cmd to see whether is it working or not.

Bingo now we have sftp server running on openwrt firewall, so we can easily upload/put and download/get files. let's check if it is working we will put a text file of hello world because of less memory allocation you can upload some big files if you have more storage.

So as you can see above, we can able to put or upload files there, similarly we can download and get with one command. So means you can install any package you want which is available or compatible.

Now we take a look at how to install package over Luci Web interface, which is much easier than cli because you can actually see available package names and install them with one click!

For that matter you need to go on the System submenu -> Software here you can see all the packages, We search for the package arping and we get the package named iputils-arping in results and we can see the Install button at rightmost, so we just click on it and the package will be installed.

Click on the install button, there is also an option for overwriting the existing package like have the same name and if conflicting then we can overwrite it simply. Also it shows how much storage it requires to install so if in case you have low on storage it is recommended to make minimal installation of packages.

After clicking the install button package was installed and we get the verbose output of whatever the command got executed in the backend.

We have install the package successfully we can test it by executing arping command on command line. And as we can see we can able to use the arping command now.

Similarly we can install lot more packages with it and gain more granular control over our firewall, like basic editors like nano is not installed by default so we can install it just like normal linux packages. Also packages like nmap can be installed to scan some internal hosts and open ports.

6. Conclusion

This blog shows that how useful OpenWRT is in the network security and especially in the home network to enhance security using dedicated firewall. Another best approach is to install it on the embedded devices like Raspberry Pi which can make it more useul and handy.

OpenWRT has lot more feature which we can't cover in this blog but when we were experimenting another fantastic idea is to automate some security task on linux server by using the firewall, To do this we have created bash script which have already define all the necessary tasks and the firewall has a job to invoke the script using cron, one more is the server itself captured a full image of the firewall with all the settings and take a backup to the secondary server and whenever the firewall gets misconfigured the restore point has created and we just pull the latest backup copy and restore the firewall which makes it some kind of fail safe or we can say rollback to it's previous state.

Agh…. it was a lot more stufff!!!

Let me know if you found this article helpful and if you gain some new knowledge share it with your friends (More specifically with Sec Folks) and reach me out on my LinkedIn if you need any help or have any suggestions!

Break IT to Build IT!