Security#
Seven jobs. The first two are the ones that go wrong most often, and the last one is the list to work through before a box takes traffic from the internet.
| Guide | The job |
|---|---|
| Publish a service: forward, accept, and hairpin | A port forward that works from outside and from the LAN |
| A default-drop ruleset that admits what you meant | What the installer wrote, what it does not cover, and how to extend it |
| Use groups instead of literals | Named sets of addresses, networks, ports and interfaces that rules reference |
| Turn on Suricata IDS | Detection, natively, with alerts on the page |
| Put the engine in the packet path | Inline IPS with NFQUEUE, and the two fail-open layers |
| Request a certificate from an ACME server | A certificate the router requests and renews itself, from System → Certificates |
| Harden a router that faces the internet | Ten changes in rough order of value |
The two facts to have in your head first#
The agent binds every interface. The shipped systemd unit passes --addr 0.0.0.0:8443,
so the management UI listens on the WAN as well as the LAN. Nothing but the firewall keeps
it off the internet. There is no listen-address setting short of editing the unit file,
which an image upgrade replaces. See
Harden a router that faces the internet.
IPv6 is configurable everywhere and observable on its own page. You can write IPv6
rules and the installer's firewall checkbox writes an IPv6 ruleset; Network → IPv6
shows v6 addresses, the NDP table, the v6 forwarding table and the ip6 firewall counters,
and warns when a router has a v4 ruleset and no v6 one. The Static routes page shows both
forwarding tables; the neighbour tables still read show arp, and the uplink model has no
v6 concept.
What is not here#
- UPnP for IPv6. UPnP and NAT-PMP port mapping is on the UPnP page, off until an administrator turns it on and chooses the client subnets that may ask; IPv6 pinholes are refused. Anything that should not depend on a device asking needs a port forward.
- The raw kernel ruleset. Firewall hit counters are joined from the router's own firewall statistics, and Advanced mode's nftables tab shows the router's rendering of one rule set at a time; nothing shows every table the kernel holds.