I got a pretty great openwrt router, I want to set it up as privacy respecting as possible.
I am aiming to set it up offline as much as posssible before giving it network access.
I have always used ISP provided units so this is new. It comes with adguard and such but I am thinking about a fresh install to be safe?
Create guest networks with AP isolation for IOT and guests. Switch to a good DNS such as Quad9 or NextDNS, enable Wireguard for all devices on your network. Set a strong admin password and disable remote/WAN access to your router.
Check out the list of extra packages available on their website, you’ll get ideas for all types of cool stuff you can do.
You can set it up on your local network without outside access given to your router.
This can be helpful to block devices like your “dumb TV” through the firewall. You can block them via their MAC address.
You can do this by allowing it to connect and looking at the list of network devices. You should see it’s Mac address there. Copy that for any device you don’t want connecting later (later meaning before you give your router outside access). You’ll create a blocklist in the firewall around those devices. This is helpful to prevent them from ever connecting, even if you forget and plug your TV Ethernet back in.
Get the macs before you factory reset and/or flash a clean openwrt image. If flash a fresh copy. No reason to have that doubt in your head on a used device.
DNS (adgaurd) is a good thing to have set. I’m not an expert on the best options, but forcing a specific DNS through the router is good to setup. Mine is called “DNS Director” I think but I’m using the Asus flavor of wrt which is a bit different.
It forces DNS for all devices on the network, devices can request a different DNS (like Google) even if you have adgaurd setup, this ensures this doesn’t happen. You have to lookup the equivalent for openwrt.
But, if you don’t want your ISP monitoring your network traffic destinations you’ll want to setup a VPN on the router and all devices will be routed through the VPN.
Noting that a VPN is essentially (from a privacy standpoint) just trading your ISP for a different provider that can log your network traffic. So, keep that in mind when choosing one. My rule of thumb, is that if the VPN is being advertised on YouTube channels as ad reads, don’t fucking touch it. Paying with crypto or anonymously is essentially pointless. The VPN knows your IP. If they are logging and not reliable they are going to know who you are if you’re using the VPN as a home solution. You are trading a definite evil in your ISP for another that is potentially better. A lot of people have a false sense of security with a VPN. So I just wanted to say this.
You’re gonna have to do your own work setting it up and learning the individual steps. But, this should at least be some vocabulary and basics to point you in the right direction.
I know everyone is trying to block their TVs and shit this week.
Also, get rid of Ring on your network or any robo vacuums or whatever. Those are security nightmares.
Yeah we are on the same wavelength. I have to set up vlans for home assistant but then I need that to include my phone so I can use the app.
HA has a remote service but I heard it leaves something open to the wider world.
I want to VPN back to my home when using mobile data so I can get the benefit of the VPN and adguard etc.
I will be using mullvad and a second one where I need a static IP, nord or proton by the looks of it.
I havent figured out the vlan and vpn hierarchy yet.
I presume there is fingerprinting with what type of router you have so I am trying to approach this in such a way that minimal units get to know the router before it becomes the live router
This can be helpful to block devices like your “dumb TV” through the firewall. You can block them via their MAC address.
this is brilliant!!! it’s like a poor man’s vlan.
i’ve been needing something to replace my pfsense router and this seems to fit the bill; thank you!
this is brilliant!!! it’s like a poor man’s vlan.
I mean, OpenWRT literally supports VLAN switching.
Yeah. Probably the better approach. But I was just doing this for a friend that didn’t have a router with vlan. Was the approach in my brain. And once the MAC is blocked it’s idiot proof. No chance of someone plugging in Ethernet to the TV.
im stuck using old non-openwrt hardware for the time being, which is why i reacted like i did. lol
A good thing to setup are VLANS. I would at minimum creatie a VLAN for untrested devices like iot stuff.
You can setup a firewall so you can access the insecure devices but they cant access your trusted network them self.
This gives a good base to expand on.
Perfect, its HA I want to set up first and foremost ad remote access for my app
Cake aqm and doh+dnssec
I think that dnssec link is broke.
Also vlans for devices that aren’t trusted. Mac filtering is for sorting and automatically appropriately provisioning the good boy things you want on the network, a derek zoolander vlan for untrustworthy devices that need their requests selectively dropped is for everything you hate.
Thanks. Fixed the link.
