Ask for recommendation: HTTP file server for OpenWrt 22.03.5

[asmwarrior]

@iplaywithtoys

L2TP on its own offers no security. It's a tunnel, nothing more. If you're going to use L2TP then make sure you've got some layer of encryption, such as IPsec, on top of it. There are some niche use cases for using L2TP without encryption, but yours isn't one of those.

If you're going to use a VPN to permit only your chosen users to connect, I would suggest something like WireGuard (easy to set up, and lightweight; it's pretty fast when in use), Tailscale (WireGuard with a fancy GUI and some clever hacks to make it easier for the user to set up a WG mesh), or OpenVPN (uses certificates so is slightly more difficult to set up).

Or, if you've already got IPsec in place on top of L2TP, and it works for you, then feel free to stick with it. The important bit is that you employ some protection; the specific flavour of protection isn't as important as that it does what it's supposed to do.

Hi, thanks. I have already have L2TP/IPSec server running and working in my openwrt router. In-fact, I'm not using the two ways(WireGuard or OpenVPN) you mentioned. Instead, I use Softether VPN server. The setup is also not complex(see How to tweak the firewall of OpenWrt 22.03 to support Softether VPN server - Installing and Using OpenWrt / Network and Wireless Configuration - OpenWrt Forum and L2TP vpn client report 720 Error when try to connect SoftEther VPN on OpenWrt), in-fact, it is quite easy. I have seen the OpenWrt wiki doesn't have a page for the Softether VPN server, but I don't have the right to edit the wiki. I have try to applied a wiki account several weeks ago, but failed(reply got deleted automatically). Today have tried again. (see here: Applying for OpenWrt wiki account)

@iplaywithtoys

@asmwarrior

is it safe to only have a read-only file http server running on the router which can be accessed by internet?

The answer, as with all things I.T. related, is "it depends".

And what it depends on is how securely-configured it is and whether or not there are any vulnerabilities in the software on the router.

Personally, I would advise against doing so. I prefer single-function devices, for simplicity. The more things a device has to do, the more things that can go wrong and the more risk there is of one component introducing a vulnerability.

Instead, set up a different device to run the HTTP server and leave the router to route. That's it's job.

The above is only advice, which you are free to accept, adapt, or ignore as you see fit. Ultimately, it's your device and your network, so it's your choice how to proceed.

OK, thanks. I will consider your advice.