List of tips for a secure network

Installing and Using OpenWrt Network and Wireless Configuration
1

Good afternoon, I recently installed OpenWrt on my router and am amazed at what this community has accomplished.

I have some questions regarding the best configuration to have a secure network. I will quote the list of steps I have in mind.

  • Install OpenWrt and configure local network and wifi with WPA3 password.
  • Install Wireguard in OpenWrt and configure clients together with DDNS for connection from outside to my home network.
  • Configure PiHole?
  • Hire a public VPN like mullvad and configure it with my router to improve privacy?

The documentation is very good but also very extensive, do you recommend the last 2 points I have indicated? What else do you consider essential to configure in OpenWrt to improve security and privacy?

Thank you very much for your help

2

VPN doesn't really provide any additional privacy, and you can't run a pihole on bare Openwrt.

1 Like
3

Well, the secure thing is to keep firewall closed and not allow any incoming connections.

Sounds like you are actually looking for tips to weaken security, (but as little as possible...)

1 Like
4

I could mount pohole on my nas, what I don't know is if it could affect my whole network or only the nas traffic.

5

Why do you think I seem to be looking for tips to weaken the security of my network? Because of the public VPN query?

6

Because you say this:

Like I said above, the secure thing is to not open any services to be accessible from wan.

1 Like
7

Depends on the setting you make, on your router.

1 Like
8

The objective is that the only service accessible from the Internet will be through wireguard. From what I have documented it seems to be the best solution.

Being totally isolated is not practical...

1 Like
9

Yes, it's very convenient. When travelling I can check my cameras to make sure everything's good and that certain processes that need to be running at home are still running.

I dislike dynamic DNS because you attract more hacking attempts -- but those happen all the time anyway. It's the most standard way to reliably discover your current home IP address when you're away; it's just annoying that it's public. I don't need it because I have an always-on connection to a VPN provider, so I can simply find my current home IP address by logging into the client area of their website.

1 Like
10

Thank you for your contribution.

So a more secure alternative to dynamic dns would be to sign up with a VPN provider like millvad? Which one have you signed up with?

11

I'm not sure I'd put too much weight on the claim that a dynamic DNS will attract more hacking attempts. Just being online will attract attempts, that's the point of securing your network.

1 Like
12

Yeah, they don't scan by FQDN, but IP.

1 Like
14

Other recommendations for a secure network: get a managed switch and create VLANs:

  • LAN: Full access, for trusted devices that basically belong to you and need to access both internet and local resources
  • DMZ/Guest, for devices that need internet access but have no reason to access any other system or device on your network. This includes streamers unless you also use them to access your local NAS. (My suggestion is that you use a local server to provide access to local media, and only use streamers for remote providers.)
  • Private/Local only: no internet access, for devices that you need access to but which will only cause trouble if they access the internet, like printers and cameras -- assuming you're not using cloud storage for them -- and if you are, you have a trojan in your house and essentially have NO privacy or security and this whole topic is moot. Unless OTOH you put them in the DMZ and only access them via the cloud.

Edit: In addition, if you or anyone in your house teleworks, especially if using an employer-provided computer, either create a VLAN for each teleworker, or at minimum put them in the DMZ. Your telework rig should have no connectivity with your home network whatsoever.

1 Like
15

Thank you very much for your recommendations, I will set up a DMZ for my smart TV and game consoles.

Luckily I have no cameras or any similar devices on my network, I know they are very dangerous.

For teleworking I use a wifi mifi provided to me at my work :slight_smile: