Security#

Seven jobs. The first two are the ones that go wrong most often, and the last one is the list to work through before a box takes traffic from the internet.

Guide	The job
Publish a service: forward, accept, and hairpin	A port forward that works from outside and from the LAN
A default-drop ruleset that admits what you meant	What the installer wrote, what it does not cover, and how to extend it
Use groups instead of literals	Named sets of addresses, networks, ports and interfaces that rules reference
Turn on Suricata IDS	Detection, natively, with alerts on the page
Put the engine in the packet path	Inline IPS with NFQUEUE, and the two fail-open layers
Issue a certificate and bind it to the web UI	ACME, so a certificate warning means something again
Harden a router that faces the internet	Ten changes in rough order of value

The two facts to have in your head first#

The agent binds every interface. The shipped systemd unit passes --addr 0.0.0.0:8443, so the management UI listens on the WAN as well as the LAN. Nothing but the firewall keeps it off the internet. There is no listen-address setting short of editing the unit file, which an image upgrade replaces. That is why Harden a router that faces the internet starts where it does.

IPv6 is configurable but not observable. You can write IPv6 rules and the installer's firewall checkbox writes an IPv6 ruleset. What you cannot do is inspect the result: there is no IPv6 route view and the uplink model has no IPv6 concept. Write the rules; do not expect the pages to show you their effect.

What is not here#

UPnP and NAT-PMP. There is no UPnP answer on a Wheelhouse router. The Companions page reports the gap. Anything that relied on it needs a port forward.
A 1:1 NAT editor. The nat static table reads rules made elsewhere, but its editor is switched off: committing nat static through this platform build's HTTP API stops the API process, while the CLI accepts the same lines. 1:1 NAT has the detail, and the console is where those rules get made.
An nftables ruleset inspector. Firewall hit counters are joined from the router's own firewall statistics; there is no per-object nftables view.

Checked against docs/security.md · ui/src/pages/Firewall.tsx · ui/src/pages/Nat.tsx · agent/ids.go