4 ms·

How does everyone feel about the security of OpenWRT? vs Tomato? What about say configuring my own OpenBSD server to act as a router? I am out of my intellectu

How does everyone feel about the security of OpenWRT? vs Tomato? What about say configuring my own OpenBSD server to act as a router? I am out of my intellectual depth here but I feel like that would be more secure than Linux in general if we are going for max security. As governments and private equity groups continue to buy out whatever hosting provider, VPN, Registrar, etc they can find...I feel like Open Source is a pretty soft target in the grand scheme of things. I am trying to become somewhat ruthless in analyzing my dependencies when it comes to software. NOTE: another commenter mentioned a TP-Link product. Those devices are absolutely insecure to the core of their firmware for the time being. 7 days ago I discovered their completely open production Elasticsearch API server for their entire camera and IOT platform in the United States. It has now been remediated but that event puts under suspicion anything else the company deals with via the TP-Link brand out of Shenzhen.

jt_snacks 7y ago
Any of the major distributions focused on simplicity and routing that also receive regular security updates should meet your needs. A Google Wifi setup (with it's automatic updates) is probably better for privacy and security than the TP-Link. Better still would be pfsense, vyatta. Personally, I use an ER-X running a minor vyatta fork and it's rock solid.
mongol 7y ago
Interesting idea. I briefly searched for Ansible + OpenBSD + router and found some interesting links. Need to look into it. I was thinking to do this with Linux but for this purpose, OpenBSD could be better? But it was very long ago I last used OpenBSD.
- 1MachineElf 7y ago
  I was able to accomplish this with OpenBSD in 2016 by simply using the official docs. With Linux you'd be googling around for WireGuard, etc.
josteink 7y ago
> another commenter mentioned a TP-Link product. That may have been me. > Those devices are absolutely insecure to the core of their firmware for the time being. Which is why you replace that firmware with OpenWRT, right?
chousuke 7y ago
I can recommend building your own OpenBSD router. Installing OpenBSD is easy, and once you have it installed the base system contains everything you need to set up a router along with excellent documentation for everything. OpenBSD people also take security seriously, so if you stick with the base system, you'll be fine. That said, you'd be fine on Linux too, depending on the distribution; it's not like Linux-based systems are somehow fundamentally insecure. I really can't stress enough how good the documentation is; in the Linux world I'm used to googling and wikis and whatnot because most man pages for the components of a distro are either nonexistent or incomplete, but with OpenBSD, you'll do fine with just man and apropos. It's considered a bug if the documentation is missing something. OpenBSD is a fantastic OS for learning about all kinds of UNIX and networking stuff if you're not opposed to spending some time reading good quality documentation.
- ac29 7y ago
  Any recommendations for hardware to run an OpenBSD router on? Support for ARM and MIPS devices seems pretty limited, leaving x86 stuff like Protectli or PC-Engines (which are both pretty expensive for what you get).
  - __turbobrew__ 7y ago
    PCEngines is the way to go from what I have seen. I installed OpenBSD on an APU2C4 and it has been rock solid for the last year and a bit. In terms of cost you will be hard pressed to find a x86 SOC with 4 I tel NICs and a serial port at a cheaper price.
    - ac29 7y ago
      I'd imagine its plenty enough for a home internet router, but it stings a bit to pay ~$150 for a system with a 2013 CPU (and a very low end one, at that).
      - kjs3 7y ago
        OpenBSD will run fine in this role on sub-US$50 refurb Core 2 PC or a sub-$100 Atom box if power is an issue. Even a P2/P3 can keep up with anything but the highest end broadband.
Nextgrid 7y ago
TP-Link is not alone in this. Pretty much any consumer-grade network equipment is built down to a price, with zero budget remaining for the actual firmware. If you can't use OpenWrt then buy enterprise-grade equipment. Personally I'm using a combination of a Mikrotik router at the edge and then consumer-grade powerline access points with OpenWrt (not strictly needed for security as they're behind the firewall already, this was more for functionality to support 802.11r for Wi-Fi).
- glogla 7y ago
  Does Mikrotik still require the windows-only utility for configuration? I remember it was a thing.
  - Nextgrid 7y ago
    They have a web UI and a CLI (SSH/Telnet/Serial). I've never used the "Winbox" UI though it is very much still a thing apparently.
yborg 7y ago
I have a TP-Link device and am glad to see an alternative to the stock firmware since all of the consumer brands have been found to have gaping security issues over the years - at these price points and because consumers don't know/care about it, security is not a priority for most vendors. All that said, I'm not sure how misconfigured TP-Link infrastructure would lead one to declare all their device firmware is bad.
dTal 7y ago
>I am trying to become somewhat ruthless in analyzing my dependencies when it comes to software This strikes me as both very difficult and very wise, in the way that choosing to run Linux on your desktop was 20 years ago.
tapper82 7y ago
security of OpenWRT vs Tomato? OpenWrt has a up-to-date Kernel. We try and be as safe as we can from first boot. We make you set your password to get up and running so no crappy passwords from the start. wifi is turnd off on boot so you don't get a unsafe wifi network with no security. The firewall is set up with a small rule set to be as safe as it can. The webinterface can be installed with https We have lots of packages to be even safer. BCP38, addblock, banip, dnscrypt, several proxy servers and dns over https. I would not run Tomato? on a router in 2020 it runs with old Kernels and old packages. Disclaimer: I am not a OpenWrt dev I just help out around the place like on Twitter forums PS if any one needs help pleas come to the forums we will help out as best as we can. Some people think that OpenWrt has devs that are not very tolerant. I can tell you that this is not true. there was a bug in LUCI the webinterface that made it hard to use with my screen reader I asked about it on irc and it was fixt in 3 hours.
- GEEMAIL1801 7y ago
  I'm using DD-WRT at home. I understand that the embedded Linux that it runs can become more of a full featured version by adding and properly formatting a hard drive to the router. I haven't been able to do this yet and I think it would be great if there were an image available that could be written to the disk for this purpose.
glogla 7y ago
I'm curious what attack surface typical "wifi-router" has? From the internet, nothing should be exposed - or maybe OpenVPN port or ssh? From outside, usually you would see WPA2-PSK network. I know there are some attacks on WPA2, but I don't know if they're practical. I also know that WPS (that PIN thing) is very insecure, but that is hopefully disabled on most networks. From inside the network, things get more difficult, because the router has to have a lot of services exposed - DNS, DHCP, whatever the thing that supports UPnP is, the admin web interface, ssh, etc. This makes me think, that unless the manufacturer sneaks in a backdoor, things should be relatively secure from outside (both internet and physically). Am I missing something?
kjs3 7y ago
I've been using straight OpenBSD as a router/FW for years. It has served well, has been particularly stable & easy to maintain and runs well on relatively modest hardware. A couple of notes: - It's so much easier if you keep it simple as possible. If it's your router/FW, don't run your web server, file server, streaming media server, etc. on it. I mean, you can, but that's just a lot of things that can go wrong. - PF, the firewall in OpenBSD, is usually configured via CLI + conf txt files. The syntax is shall we say terse, but it's well documented and there are lots of examples. Yes, I know there are some 'PF GUIs' out there; I've never tried them on OpenBSD and don't know anyone who has. If that's a deal-breaker, then maybe look at pfSense (FreeBSD based). - Pay close attention to the hardware compatibility list; not all WLAN chipsets are well supported. - Read the documentation. Seriously. The community is at best 'difficult'; if you drop into their world asking questions that are in the doco expect active hostility. And OpenBSD is not Linux despite the superficial similarities. Don't expect everything to work like it does on Linux.

jt_snacks 7y ago

Any of the major distributions focused on simplicity and routing that also receive regular security updates should meet your needs. A Google Wifi setup (with it's automatic updates) is probably better for privacy and security than the TP-Link. Better still would be pfsense, vyatta. Personally, I use an ER-X running a minor vyatta fork and it's rock solid.

mongol 7y ago

Interesting idea. I briefly searched for Ansible + OpenBSD + router and found some interesting links. Need to look into it. I was thinking to do this with Linux but for this purpose, OpenBSD could be better? But it was very long ago I last used OpenBSD.

1MachineElf 7y ago
I was able to accomplish this with OpenBSD in 2016 by simply using the official docs. With Linux you'd be googling around for WireGuard, etc.

josteink 7y ago

> another commenter mentioned a TP-Link product. That may have been me. > Those devices are absolutely insecure to the core of their firmware for the time being. Which is why you replace that firmware with OpenWRT, right?

chousuke 7y ago

I can recommend building your own OpenBSD router. Installing OpenBSD is easy, and once you have it installed the base system contains everything you need to set up a router along with excellent documentation for everything. OpenBSD people also take security seriously, so if you stick with the base system, you'll be fine. That said, you'd be fine on Linux too, depending on the distribution; it's not like Linux-based systems are somehow fundamentally insecure. I really can't stress enough how good the documentation is; in the Linux world I'm used to googling and wikis and whatnot because most man pages for the components of a distro are either nonexistent or incomplete, but with OpenBSD, you'll do fine with just man and apropos. It's considered a bug if the documentation is missing something. OpenBSD is a fantastic OS for learning about all kinds of UNIX and networking stuff if you're not opposed to spending some time reading good quality documentation.

ac29 7y ago
Any recommendations for hardware to run an OpenBSD router on? Support for ARM and MIPS devices seems pretty limited, leaving x86 stuff like Protectli or PC-Engines (which are both pretty expensive for what you get).
- __turbobrew__ 7y ago
  PCEngines is the way to go from what I have seen. I installed OpenBSD on an APU2C4 and it has been rock solid for the last year and a bit. In terms of cost you will be hard pressed to find a x86 SOC with 4 I tel NICs and a serial port at a cheaper price.
  - ac29 7y ago
    I'd imagine its plenty enough for a home internet router, but it stings a bit to pay ~$150 for a system with a 2013 CPU (and a very low end one, at that).
    - kjs3 7y ago
      OpenBSD will run fine in this role on sub-US$50 refurb Core 2 PC or a sub-$100 Atom box if power is an issue. Even a P2/P3 can keep up with anything but the highest end broadband.

Nextgrid 7y ago

TP-Link is not alone in this. Pretty much any consumer-grade network equipment is built down to a price, with zero budget remaining for the actual firmware. If you can't use OpenWrt then buy enterprise-grade equipment. Personally I'm using a combination of a Mikrotik router at the edge and then consumer-grade powerline access points with OpenWrt (not strictly needed for security as they're behind the firewall already, this was more for functionality to support 802.11r for Wi-Fi).

glogla 7y ago
Does Mikrotik still require the windows-only utility for configuration? I remember it was a thing.
- Nextgrid 7y ago
  They have a web UI and a CLI (SSH/Telnet/Serial). I've never used the "Winbox" UI though it is very much still a thing apparently.

yborg 7y ago

I have a TP-Link device and am glad to see an alternative to the stock firmware since all of the consumer brands have been found to have gaping security issues over the years - at these price points and because consumers don't know/care about it, security is not a priority for most vendors. All that said, I'm not sure how misconfigured TP-Link infrastructure would lead one to declare all their device firmware is bad.

dTal 7y ago

>I am trying to become somewhat ruthless in analyzing my dependencies when it comes to software This strikes me as both very difficult and very wise, in the way that choosing to run Linux on your desktop was 20 years ago.

tapper82 7y ago

security of OpenWRT vs Tomato? OpenWrt has a up-to-date Kernel. We try and be as safe as we can from first boot. We make you set your password to get up and running so no crappy passwords from the start. wifi is turnd off on boot so you don't get a unsafe wifi network with no security. The firewall is set up with a small rule set to be as safe as it can. The webinterface can be installed with https We have lots of packages to be even safer. BCP38, addblock, banip, dnscrypt, several proxy servers and dns over https. I would not run Tomato? on a router in 2020 it runs with old Kernels and old packages. Disclaimer: I am not a OpenWrt dev I just help out around the place like on Twitter forums PS if any one needs help pleas come to the forums we will help out as best as we can. Some people think that OpenWrt has devs that are not very tolerant. I can tell you that this is not true. there was a bug in LUCI the webinterface that made it hard to use with my screen reader I asked about it on irc and it was fixt in 3 hours.

GEEMAIL1801 7y ago
I'm using DD-WRT at home. I understand that the embedded Linux that it runs can become more of a full featured version by adding and properly formatting a hard drive to the router. I haven't been able to do this yet and I think it would be great if there were an image available that could be written to the disk for this purpose.

glogla 7y ago

I'm curious what attack surface typical "wifi-router" has? From the internet, nothing should be exposed - or maybe OpenVPN port or ssh? From outside, usually you would see WPA2-PSK network. I know there are some attacks on WPA2, but I don't know if they're practical. I also know that WPS (that PIN thing) is very insecure, but that is hopefully disabled on most networks. From inside the network, things get more difficult, because the router has to have a lot of services exposed - DNS, DHCP, whatever the thing that supports UPnP is, the admin web interface, ssh, etc. This makes me think, that unless the manufacturer sneaks in a backdoor, things should be relatively secure from outside (both internet and physically). Am I missing something?

kjs3 7y ago

I've been using straight OpenBSD as a router/FW for years. It has served well, has been particularly stable & easy to maintain and runs well on relatively modest hardware. A couple of notes: - It's so much easier if you keep it simple as possible. If it's your router/FW, don't run your web server, file server, streaming media server, etc. on it. I mean, you can, but that's just a lot of things that can go wrong. - PF, the firewall in OpenBSD, is usually configured via CLI + conf txt files. The syntax is shall we say terse, but it's well documented and there are lots of examples. Yes, I know there are some 'PF GUIs' out there; I've never tried them on OpenBSD and don't know anyone who has. If that's a deal-breaker, then maybe look at pfSense (FreeBSD based). - Pay close attention to the hardware compatibility list; not all WLAN chipsets are well supported. - Read the documentation. Seriously. The community is at best 'difficult'; if you drop into their world asking questions that are in the doco expect active hostility. And OpenBSD is not Linux despite the superficial similarities. Don't expect everything to work like it does on Linux.