Iot Vlan firewall and DMZ server

ed.doty · January 22, 2025, 8:58pm

Hi,

I have installed OpenWRT on a Linksys MX4300 and setup a Vlan for my iot and WireGuard for a connection to my son’s network. I am now just a little lost at security and configuring the firewall and setting things up to allow my Home Assistant and Nextcloud server to face outside. I can setup port forwarding and I currently using Duckdns, what I really mean is; I am not sure how to setup my network to be secure. How do I setup a DMZ, (or do I) for my HA server? How do I config so that devices on my iot vlan can connect to my HA/Nextcloud server and still be secure?

root@Router-OpenWrt:~# ubus call system board
{
        "kernel": "6.6.71",
        "hostname": "Router-OpenWrt",
        "system": "ARMv8 Processor rev 4",
        "model": "Linksys MX4300",
        "board_name": "linksys,mx4300",
        "rootfs_type": "squashfs",
        "release": {
                "distribution": "OpenWrt",
                "version": "SNAPSHOT",
                "revision": "r28589-54463f1e2e",
                "target": "qualcommax/ipq807x",
                "description": "OpenWrt SNAPSHOT r28589-54463f1e2e",
                "builddate": "1736778494"
        }
}

root@Router-OpenWrt:~# cat /etc/config/network

config interface 'loopback'
        option device 'lo'
        option proto 'static'
        option ipaddr '127.0.0.1'
        option netmask '255.0.0.0'

config globals 'globals'
        option ula_prefix 'fd85:ab85:2879::/48'

config device
        option name 'br-lan'
        option type 'bridge'
        list ports 'lan1'
        list ports 'lan2'
        list ports 'lan3'

config device
        option name 'lan1'
        option macaddr '80:69:1a:20:b8:81'

config device
        option name 'lan2'
        option macaddr '80:69:1a:20:b8:81'

config device
        option name 'lan3'
        option macaddr '80:69:1a:20:b8:81'

config interface 'lan'
        option device 'br-lan'
        option proto 'static'
        option ipaddr '192.168.1.1'
        option netmask '255.255.255.0'
        option ip6assign '60'

config interface 'wan'
        option device 'wan'
        option proto 'dhcp'
        option metric '20'

config interface 'wan6'
        option device 'wan'
        option proto 'dhcpv6'

config device
        option type 'bridge'
        option name 'br-iot'
        option bridge_empty '1'

config interface 'iot'
        option proto 'static'
        option device 'br-iot'
        option ipaddr '192.168.55.1'
        option netmask '255.255.255.0'

config interface 'WGc0'
        option proto 'wireguard'
        option private_key 'XXXXXXXXXXX'
        list dns '10.6.0.1'
        list addresses '10.6.0.2/32'
        option metric '10'

config wireguard_WGc0
        option description 'WG.conf'
        option public_key 'XXXXXXXXXXX'
        list allowed_ips '0.0.0.0/0'
        option persistent_keepalive '25'
        option endpoint_host 'XXX.XXX.73.120'
        option endpoint_port '51820'

config device
        option name 'WGc0'

root@Router-OpenWrt:~# cat /etc/config/wireless

config wifi-device 'radio0'
        option type 'mac80211'
        option path 'platform/soc@0/c000000.wifi'
        option band '5g'
        option channel '36'
        option htmode 'HE80'
        option cell_density '0'

config wifi-iface 'default_radio0'
        option device 'radio0'
        option network 'lan'
        option mode 'ap'
        option ssid 'OpenWrt'
        option encryption 'psk2'
        option key 'XXXXXXXXXXX'

config wifi-device 'radio1'
        option type 'mac80211'
        option path 'platform/soc@0/c000000.wifi+1'
        option band '2g'
        option channel '1'
        option htmode 'HE20'
        option cell_density '0'

config wifi-device 'radio2'
        option type 'mac80211'
        option path 'platform/soc@0/c000000.wifi+2'
        option band '5g'
        option channel '100'
        option htmode 'HE80'
        option cell_density '0'

config wifi-iface 'default_radio2'
        option device 'radio2'
        option network 'lan'
        option mode 'ap'
        option ssid 'not-ur-wifi'
        option encryption 'psk2'
        option key 'XXXXXXXXXXX'

config wifi-iface 'wifinet6'
        option device 'radio1'
        option mode 'ap'
        option ssid 'Not-ur-wifi'
        option encryption 'psk2'
        option network 'lan'
        option key 'XXXXXXXXXXX'
        option disabled '1'

config wifi-iface 'wifinet10'
        option device 'radio1'
        option mode 'ap'
        option ssid 'not-ur-iot'
        option encryption 'psk2'
        option network 'iot'
        option key 'XXXXXXXXXXX'

config wifi-iface 'wifinet11'
        option device 'radio0'
        option mode 'ap'
        option ssid 'not-ur-iot'
        option encryption 'psk2'
        option key 'XXXXXXXXXXX'
        option network 'iot'

config wifi-iface 'wifinet12'
        option device 'radio0'
        option mode 'ap'
        option ssid 'Not-ur-wifi'
        option encryption 'psk2'
        option key 'XXXXXXXXXXX'
        option network 'lan'

root@Router-OpenWrt:~# cat /etc/config/dhcp

config dnsmasq
        option domainneeded '1'
        option boguspriv '1'
        option filterwin2k '0'
        option localise_queries '1'
        option rebind_protection '1'
        option rebind_localhost '1'
        option local '/lan/'
        option domain 'lan'
        option expandhosts '1'
        option nonegcache '0'
        option cachesize '1000'
        option authoritative '1'
        option readethers '1'
        option leasefile '/tmp/dhcp.leases'
        option resolvfile '/tmp/resolv.conf.d/resolv.conf.auto'
        option nonwildcard '1'
        option localservice '1'
        option ednspacket_max '1232'
        option filter_aaaa '0'
        option filter_a '0'

config dhcp 'lan'
        option interface 'lan'
        option start '100'
        option limit '150'
        option leasetime '12h'
        option dhcpv4 'server'
        option dhcpv6 'server'
        option ra 'server'
        list ra_flags 'managed-config'
        list ra_flags 'other-config'

config dhcp 'wan'
        option interface 'wan'
        option ignore '1'

config odhcpd 'odhcpd'
        option maindhcp '0'
        option leasefile '/tmp/hosts/odhcpd'
        option leasetrigger '/usr/sbin/odhcpd-update'
        option loglevel '4'

config dhcp 'iot'
        option interface 'iot'
        option start '100'
        option limit '150'
        option leasetime '12h'

root@Router-OpenWrt:~# cat /etc/config/firewall

config defaults
        option input 'REJECT'
        option output 'ACCEPT'
        option forward 'REJECT'
        option synflood_protect '1'

config zone
        option name 'lan'
        list network 'lan'
        option input 'ACCEPT'
        option output 'ACCEPT'
        option forward 'ACCEPT'

config zone
        option name 'wan'
        list network 'wan'
        list network 'wan6'
        option input 'REJECT'
        option output 'ACCEPT'
        option forward 'REJECT'
        option masq '1'
        option mtu_fix '1'

config forwarding
        option src 'lan'
        option dest 'wan'

config rule
        option name 'Allow-DHCP-Renew'
        option src 'wan'
        option proto 'udp'
        option dest_port '68'
        option target 'ACCEPT'
        option family 'ipv4'

config rule
        option name 'Allow-Ping'
        option src 'wan'
        option proto 'icmp'
        option icmp_type 'echo-request'
        option family 'ipv4'
        option target 'ACCEPT'

config rule
        option name 'Allow-IGMP'
        option src 'wan'
        option proto 'igmp'
        option family 'ipv4'
        option target 'ACCEPT'

config rule
        option name 'Allow-DHCPv6'
        option src 'wan'
        option proto 'udp'
        option dest_port '546'
        option family 'ipv6'
        option target 'ACCEPT'

config rule
        option name 'Allow-MLD'
        option src 'wan'
        option proto 'icmp'
        option src_ip 'fe80::/10'
        list icmp_type '130/0'
        list icmp_type '131/0'
        list icmp_type '132/0'
        list icmp_type '143/0'
        option family 'ipv6'
        option target 'ACCEPT'

config rule
        option name 'Allow-ICMPv6-Input'
        option src 'wan'
        option proto 'icmp'
        list icmp_type 'echo-request'
        list icmp_type 'echo-reply'
        list icmp_type 'destination-unreachable'
        list icmp_type 'packet-too-big'
        list icmp_type 'time-exceeded'
        list icmp_type 'bad-header'
        list icmp_type 'unknown-header-type'
        list icmp_type 'router-solicitation'
        list icmp_type 'neighbour-solicitation'
        list icmp_type 'router-advertisement'
        list icmp_type 'neighbour-advertisement'
        option limit '1000/sec'
        option family 'ipv6'
        option target 'ACCEPT'

config rule
        option name 'Allow-ICMPv6-Forward'
        option src 'wan'
        option dest '*'
        option proto 'icmp'
        list icmp_type 'echo-request'
        list icmp_type 'echo-reply'
        list icmp_type 'destination-unreachable'
        list icmp_type 'packet-too-big'
        list icmp_type 'time-exceeded'
        list icmp_type 'bad-header'
        list icmp_type 'unknown-header-type'
        option limit '1000/sec'
        option family 'ipv6'
        option target 'ACCEPT'

config rule
        option name 'Allow-IPSec-ESP'
        option src 'wan'
        option dest 'lan'
        option proto 'esp'
        option target 'ACCEPT'

config rule
        option name 'Allow-ISAKMP'
        option src 'wan'
        option dest 'lan'
        option dest_port '500'
        option proto 'udp'
        option target 'ACCEPT'

config zone
        option name 'iot'
        option input 'REJECT'
        option output 'ACCEPT'
        option forward 'REJECT'

config forwarding
        option src 'iot'
        option dest 'wan'

config rule
        option name 'Allow-DNS-iot'
        option src 'iot'
        option dest_port '53'
        option target 'ACCEPT'

config rule
        option name 'Allow-DHCP-iot'
        list proto 'udp'
        option src 'iot'
        option dest_port '67'
        option target 'ACCEPT'

config include 'qcanssecm'
        option type 'script'
        option path '/etc/firewall.d/qca-nss-ecm'

config include 'pbr'
        option fw4_compatible '1'
        option type 'script'
        option path '/usr/share/pbr/firewall.include'

config zone
        option name 'WG_VPN'
        option input 'REJECT'
        option output 'ACCEPT'
        option forward 'REJECT'
        list network 'WGc0'
        option masq '1'
        option mtu_fix '1'

config forwarding
        option src 'lan'
        option dest 'WG_VPN'

config forwarding
        option src 'WG_VPN'
        option dest 'wan'

config forwarding
        option src 'iot'
        option dest 'lan'

config forwarding
        option src 'lan'
        option dest 'iot'

Borromini · January 22, 2025, 9:04pm

Why would you want a DMZ? You have WireGuard set up. When away from home I activate WireGuard and can connect to HA just fine.

ed.doty · January 22, 2025, 9:10pm

2 reasons, first my wife, I can easily use the VPN but setting this up for my wife and teaching her is not going to work. Second, my Nextcloud instance is used by extended family to save photos and files.