Small guide how to harden your OpenWRT. I am using drop instead of reject to reduce CPU load.
via UCI
- Allow critical ports:
config rule
option src 'lan'
option dest_port '80,443,22'
option proto 'tcp'
option target 'ACCEPT'
- Limit SSH Access:
config rule
option src 'lan'
option src_ip '192.168.1.0/24'
option dest_port '22'
option proto 'tcp'
option target 'ACCEPT'
config rule
option src 'lan'
option dest_port '22'
option proto 'tcp'
option target 'DROP'
- Deny anything else:
config default_policy
option input 'DROP'
- Block Port Scans:
config rule
option src 'lan'
option dest_port '!22,80,443'
option proto 'tcp'
option target 'DROP'
- Block SYN Flood Attacks:
config rule
option src 'lan'
option proto 'tcp'
option tcpflags 'SYN'
option limit '1/s'
option limit_burst '3'
option target 'ACCEPT'
config rule
option src 'lan'
option proto 'tcp'
option tcpflags 'SYN'
option target 'DROP'
- Block ICMP (Ping) Requests:
config rule
option src 'lan'
option proto 'icmp'
option icmp_type 'echo-request,timestamp-request,address-mask-request'
option target 'DROP'
- Block portmapper:
config rule
option src 'lan'
option dest_port '111'
option proto 'tcp'
option target 'DROP'
config rule
option src 'lan'
option dest_port '111'
option proto 'udp'
option target 'DROP'
- Allow legitimate to reduce errors:
config rule
option src 'lan'
option proto 'tcp'
option ctstate 'ESTABLISHED,RELATED'
option target 'ACCEPT'
- Block NetBIOS:
config rule
option src 'lan'
option dest_port '137-139'
option proto 'tcp'
option target 'DROP'
config rule
option src 'lan'
option dest_port '137-139'
option proto 'udp'
option target 'DROP'
- Block SMB (Server Message Block):
config rule
option src 'lan'
option dest_port '445'
option proto 'tcp'
option target 'DROP'
- Block Telnet:
config rule
option src 'lan'
option dest_port '23'
option proto 'tcp'
option target 'DROP'
- Block DNS Tunneling:
config rule
option src 'lan'
option sport '53'
option proto 'udp'
option target 'DROP'
- Block ICMP Redirects:
config rule
option src 'lan'
option proto 'icmp'
option icmp_type 'redirect'
option target 'DROP'
- Block useless IP connections:
config rule
option src 'lan'
option src_ip '192.168.1.0/24'
option dest_ip '192.168.1.0/24'
option target 'ACCEPT'
config default_policy
option input 'DROP'
- Block Large Packets:
config rule
option src 'lan'
option proto 'tcp'
option tcpflags 'SYN'
option tcpmss '1:1024'
option target 'DROP'
- Block New Connections Without SYN:
config rule
option src 'lan'
option proto 'tcp'
option tcpflags '!SYN'
option ctstate 'NEW'
option target 'DROP'
- Block New Connections Without ACK:
config rule
option src 'lan'
option proto 'tcp'
option tcpflags '!SYN'
option ctstate 'NEW'
option target 'DROP'
After adding these rules to /etc/config/firewall, you can apply the changes by restarting the firewall service or rebooting your OpenWrt device.
via IPtables
Easy way:
- Allow critical ports:
iptables -A INPUT -p tcp --dport 80 -j ACCEPT
iptables -A INPUT -p tcp --dport 443 -j ACCEPT
iptables -A INPUT -p tcp --dport 22 -j ACCEPT
- Limit SSH Access
iptables -A INPUT -p tcp --dport 22 -s 192.168.1.0/24 -j ACCEPT
iptables -A INPUT -p tcp --dport 22 -j DROP
- Deny anything else
iptables -A INPUT -j DROP
Expert way
- Block Port Scans
Port scans are used by bad actors to find open ports and services on your network. This rules can mitigate risk.
iptables -A INPUT -p tcp --match multiport ! --dports 22,80,443 -j DROP
This rule drops all incoming TCP traffic that does not match the ports you've specified (in example: SSH, HTTP, HTTPS).
- Limit SSH Access
Consider limiting it to specific IP addresses or ranges to prevent brute force attacks.
iptables -A INPUT -p tcp --dport 22 -s 192.168.1.0/24 -j ACCEPT
iptables -A INPUT -p tcp --dport 22 -j DROP
Replace 192.168.1.0/24 with the IP range you wish to allow.
- Block SYN Flood Attacks
SYN flood attacks aim to consume server resources by sending a large number of SYN requests.
iptables -A INPUT -p tcp --syn -m limit --limit 1/s --limit-burst 3 -j ACCEPT
iptables -A INPUT -p tcp --syn -j DROP
This rule allows a maximum of 3 SYN packets per second, dropping any additional packets. This should be enough for regular usage.
- Block ICMP (Ping) Requests
ICMP requests can be used for reconnaissance or to map your network. Also they can be used for DDOS. Blocking them can help reduce this risks.
iptables -A INPUT -p icmp --icmp-type echo-request -j DROP
iptables -A INPUT -p icmp --icmp-type timestamp-request -j DROP
iptables -A INPUT -p icmp --icmp-type address-mask-request -j DROP
- Block portmapper
It is not typically needed for most home networks.
iptables -A INPUT -p tcp --dport 111 -j DROP
iptables -A INPUT -p udp --dport 111 -j DROP
- Allow legitimate to reduce errors
iptables -A INPUT -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT
- Save and Apply Rules
iptables-save > /etc/iptables.up.rules
- Block NetBIOS
NetBIOS used in Windows environments for file sharing and printer sharing. Most of you never used it.
iptables -A INPUT -p tcp --dport 137:139 -j DROP
iptables -A INPUT -p udp --dport 137:139 -j DROP
- Block SMB (Server Message Block)
SMB is used for file sharing and printer sharing. Blocking it can prevent unauthorized access to shared resources. Can cause problems with LAN printers.
iptables -A INPUT -p tcp --dport 445 -j DROP
- Block Telnet
Telnet is just insecure protocol. Hardly recommend to block.
iptables -A INPUT -p tcp --dport 23 -j DROP
- Block DNS Tunneling
DNS tunneling can be used to bypass firewalls
iptables -A INPUT -p udp --sport 53 -j DROP
- Block ICMP Redirects
ICMP redirects can be used to redirect traffic to malicious servers. This prevents MITM attacks.
iptables -A INPUT -p icmp --icmp-type redirect -j DROP
- Block useless IP connections
iptables -A INPUT -s 192.168.1.0/24 -d 192.168.1.0/24 -j ACCEPT
iptables -A INPUT -j DROP
- Block Large Packets
Against DOS and DDOS
iptables -A INPUT -p tcp --tcp-flags SYN,RST SYN -m tcpmss --mss 1:1024 -j DROP
- Block New Connections Without SYN
This will help to reduce attack vector
iptables -A INPUT -p tcp ! --syn -m conntrack --ctstate NEW -j DROP
- Block New Connections Without ACK
Blocking new connections that do not start with an ACK packet can help prevent certain types of attacks.
iptables -A INPUT -p tcp ! --syn -m conntrack --ctstate NEW -j DROP
Save them:
iptables-save > /etc/iptables.up.rules
And apply them on boot by adding the following to /etc/rc.local:
/sbin/iptables-restore < /etc/iptables.up.rules
