Ditching the default router
Install a dedicated firewall appliance
Whenever the ISP comes out to your house to connect you to the internet, they’ll often provide you with your own local wireless network to make it easy to connect everything. It couldn’t be easier. If you’re lucky, you can even pay an additional fee to have everything integrated with AI so it can map out your home and sense when you’re walking around. Honestly, I’m sure there are some legitimate uses for that kind of technology, but for it to be the de facto standard for so many home networks is insanity to me, but I digress.
Even if you purchase your own off-the-shelf router to sit between your ISP’s modem/ONT and the rest of your home network, there’s still a lot to be desired. Most stock firmware leaves much of the actual network configuration behind paywalls or most often completely missing. Even if you own it, it’s not yours.
If you can’t really control the network and how it behaves then you don’t really own it. You’ve just been given permission to use it the way the manufacturer wants you to.
Luckily, there are many open-source router firmware offerings (DD-WRT, OpenWRT, FreshTomato, etc) that expose many more settings for you to do as you please. Just make sure to get a router with a chipset that’s compatible with the firmware you settle on if that’s the route you plan to take (pun intended).
If security is your biggest concern though, it would be wise to consider something a little bit more robust than simple router firmware. Not that router firmware is at all “simple”, but there are solutions that can handle much more. A router and firewall appliance both have the same job of routing traffic at the network edge, but they both approach the problem from a different place. Technically, a firewall appliance is still a router, but it’s also so much more.
While a router wants to let everything through by default, a firewall wants to stop everything by default. With a firewall, you have to write explicit allow rules for different traffic that you want to let through. Rather than hiding features behind marketing and sleek–but ultimately limited–UIs like consumer routers, a dedicated firewall appliance allows granular control of it everything from routing.
Namely, I’m talking about OPNsense here. Admittedly, it’s not for everyone, but if you’re technically savvy, interested in networking, and security oriented, it is hands down the best open-source firewall solution you’re going to find. It’s not compelling because of one great feature, though. It’s great because it combines dozens of networking and security tools into one capable package.
complex segmented routing
One of the major benefits of using a firewall appliance like OPNsense is the ability to stop treating your home as one giant trusted network. Your doorbell and dishwasher have no business connecting to your laptop or phone that has sensitive information on it. Your printer doesn’t need unrestricted access to your network either. For the most part, it only needs to accept print jobs. Most devices on our networks don’t need near the access that we grant them. OPNsense allows you to set up an arbitrary number of isolated networks using VLANs/subnets and decide exactly what traffic is allowed between them using specific firewall rules.
VPN
A good number of consumer routers have to ability to function as a vpn client or server, but the options are generally limited in my experience. Generally, you can only run either a vpn server or a vpn client at any given time. OPNsense, on the other hand, has so many options that it may even seem daunting to new users. i Don’t worry though, the documentation is spectacular.
With OPNsense, you can set up a vpn to access your home network remotely while simultaneously routing all traffic through a remote vpn provider like Nord or Proton. It even allows you to set up multiple peers that have various levels of access to your network. Want to only access your main vlan? It can do that. Want to set up another peer that has administrative access? Yep. You can do that too.
Native IDS/IPS
Network intrusion detection and prevention is a major component of building up a good security posture. OPNsense has Suricata built in. This allows you to implement rule sets that can either notify you of issues (detection mode) or outright block potentially malicious traffic (prevention mode). Just know that if you configure it as an IPS, there exists the potential to break your network. Make sure your rules are fine-tuned in detection mode before switching over to prevention mode.
Unbound DNS
I can’t say enough good things about Unbound. Setting up your own local DNS server is so much more powerful than many people realize. A DNS (Domain Name System) server is your network’s way of translating a domain name (like palmersec.com) into an IP address so your computer knows where it’s actually connecting to. Think of it as the difference between knowing of a location as your friend’s house and actually knowing the street address of said friend’s house.
The beauty of running your own DNS server is that you control
exactly which sites get resolved and which sites don’t. DNS block
lists are easy to implement in OPNsense. There are many different
blocklists available that are updated as domains are discovered to
be malicious (or even just spammy). Additionally, you can even block
known ad servers for a cleaner experience on the web. One of my
favorite aspects of running my own DNS is that I have the power to
write custom local domain names. Instead of typing my firewall’s IP
every time I want to access the web interface, I could just type
something simple like opnsense.home.arpa. Lastly,
running your own DNS server helps provide better privacy since your
ISP and major tech company’s no longer hold a record of every
website you request. Sounds like a win-win to me!
To be continued..
I’ll likely be coming back here and adding more details to this article at a later date (as time allows–I’m a busy guy). Stay tuned!
NOTE
The one thing I would concede about OPNsense is that it’s not at the forefront with modern wireless implementations, but the addition of something like OpenWRT on a dumb AP is a trivial addition to an otherwise stacked home network, but that’s out of scope for this post.