Home routers typically block unsolicited connections from the internet, but Gregory Gibson, an IT specialist and technical writer, emphasizes the importance of setting up additional firewall rules to secure home networks. These rules are designed to guard against internal threats and ensure that only trusted devices have access to the internet. This article details three essential firewall rules that Gregory uses to secure his home network.
Rule 1: IoT Devices Can Use the Internet, but Nothing Else
When setting up a home network, it is crucial to isolate devices that are not trusted. Gregory Gibson uses his edge network OpenWRT VM router, a Windows 11 VM acting as an IoT device, and a real Starlink internet connection to demonstrate how these rules work. The first rule removes trust without breaking the services devices actually need. Gregory isolates the IoT interface in a separate firewall zone, setting Input to reject, Output to Accept, and Forward to reject. This ensures that the IoT devices can use the internet but cannot reach the router or the trusted LAN.
To fix the issue of services like DHCP and DNS being blocked, Gregory adds two exceptions under Network -> Firewall -> Traffic Rules. These exceptions allow the IoT devices to communicate with the router on specific ports. After saving and applying the changes, Gregory confirms that the IoT network can still access DHCP, router DNS, and web access.
Rule 2: Block Private Addresses on the WAN Side
The second rule focuses on isolating the IoT subnet from the trusted LAN. Gregory Gibson demonstrates this by testing the Windows VM, which still succeeds in accessing private addresses on the WAN side. He adds a new traffic rule under Network -> Firewall -> Traffic Rules that rejects any traffic to the WAN. This ensures that the IoT devices cannot access the WAN interface, preventing them from probing upstream administration pages.
Rule 3: Secure the Router
The third rule is to secure the router itself. Gregory Gibson backs up the configuration of his OpenWRT router and keeps the LuCI web interface open from a trusted wired device. This ensures that he can recover from accidental blockages, such as DHCP or DNS, or loss of admin access.
OpenWRT: An Open-Source Router Operating System
OpenWRT is an open-source router operating system that replaces stock firmware with a more flexible, configurable networking platform. It adds deeper control over routing, firewall rules, DHCP, DNS, traffic shaping, VPNs, and package-based features.
By implementing these three firewall rules, Gregory Gibson helps ensure that home networks remain secure and protected against internal threats. These rules are essential for securing home networks and should be considered by anyone setting up a home IT project or self-hosted server.
Comments