Firewall

How secure is your firewall?

Introduction

For your home or small office network, the firewall is probably the single most important piece of hardware.

Note! For the remainder of this post I’ll use the term firewall. I know a firewall and a router is not the same thing, but for homes and small offices it’s almost always the same device)

It’s your first defense against attacks from the Internet, and it usually provides necessary services like DHCP, NAT and probably DNS forwarding.

If your firewall is compromised then a MITM attack is trivial. All devices inside are open to all sorts of attack and manipulation.

So, how secure is your firewall? 

Most firewalls today never get updates. And an alarming number of devices have backdoors installed fresh from the factory (by the manufacturers themselves).

Like this TP-link device with remote execution in root context, without any authentication. It’s on the LAN side, but if even one device inside your network is briefly compromised, it would be easy to maintain a persistent presence.

Link: http://sekurak.pl/tp-link-httptftp-backdoor

Or quite a few of Netgear and linksys (even a few Cisco). This backdoor gives you full access to the router. You can even reset the password to log in as a authenticated admin.

http://arstechnica.com/security/2014/01/backdoor-in-wireless-dsl-routers-lets-attacker-reset-router-get-admin

It got patched, but it turns out that it’s still there:

http://arstechnica.com/security/2014/04/easter-egg-dsl-router-patch-merely-hides-backdoor-instead-of-closing-it

If that is not enough, some firewalls even have features that doesn’t even require any hacking to gain access.

Asus’ AiCloud feature on higher end consumer devices gave everyone on the Internet full access to your router.

http://www.securityfocus.com/archive/1/526942

For a good summary of this issue, take a look at this Ars Technica article

http://arstechnica.com/security/2014/02/dear-asus-router-user-youve-been-pwned-thanks-to-easily-exploited-flaw

Configuration on a home or soho-firewall is usually performed via a Web interface. This means that the firewall is exposing a webserver to the Lan side.

A webserver that is rarely updated is frankly a bit worrying. Especially considering the damage that could be done if your firewall is compromised.

 

What to do about it?

I strongly recommend that you build your own firewall.

Firewall hardware is cheap and you can use any old computer, but it’s preferable to buy hardware with low power requirements. This will result in less or no noise, smaller device and less generated heat.

I would also recommend to deny access to the web configuration of your firewall, also from LAN side.  To do this you need to have 3 network interfaces. 1 for WAN, 1 for LAN and 1 for access to the Web configuration of the device. Of course, this is not a good idea if you regularly need to access your firewall configuration. Most people rarely do, so having a dedicated network port to do configuration is not a big problem

I tried to do this on a Cisco Small Business firewall like the ISA 550 and it just ignores any rules to drop packets from LAN to port 80/443 (web) on any interface.

Building your own firewall will give back control.

Hardware

An Alix board or an Atom board is recommended (links below).

You need at least two network adapters (but I would recommend 3, so you can dedicate one interface for configuration purposes).

Software

Distributions like pfsense, dd-wrt and ipcop are easy to configure and you’ll have access to regular updates.

I’ve been using pfSense on an Alix board for years, and it’s rock stable. It manages 50mbit without any issue at all.

But iif you need even more throughput, or more features like IDS or VPN, then you’ll need a board with better performance.

Give it a go!

Hardware inks: 

  • Alix boards at http://www.pcengines.ch
  • One with 3 LAN ports http://www.pcengines.ch/alix2d13.htm
  • Or the more powerfull APU series: http://www.pcengines.ch/apu.htm
  • A powerfull Atom board: http://www.asrockrack.com/general/productdetail.asp?Model=C2550D4I

Software links:

Tutorials/getting started links:

PFsense custom DHCPD configuration

pfSense is my prefered router/firewall distro. It’s rock solid and has tons of features.
You can run pfSense on any PC, but if you want to keep the power and heat down to a minimum you can use an Alix board (http://www.pcengines.ch/alix.htm) APU2 board (https://www.pcengines.ch/apu2.htm) or similar. Alix boards are no long supported, but APU2 works fine.

One of the few things you can’t do in pfSense is modify your dhcpd.conf file directly.
For the vast majority of deployments, the built in control you have will be more than enough. It supports multiple vlans, and custom options. But…
If you need something special, like running a DHCP Server for several IP subnets over Layer 3 switches, then you need a different approach. Or maybe you just like to maintain a single file instead of using the GUI interface.

This is not a common requirement for a network, but it does happen.
I had a test-lab with a few Layer 3 switches and several subnets. I wanted to have an easy one-file configuration for the entire network using only the low-power pfSense router. So I had to figure out a way to do that.

There is no dhcpd.conf file you can edit in pfsense because it’s generated on each boot using the config.xml file (managed by all the settings in the GUI). The problem is that if you want any special settings in your dhcpd.conf file, it might not be supported by the config.xml markup and/or the GUI.

The solution is pretty simple. Just stop the DHCP daemon after boot, replace the dhcpd.conf file and restart the daemon.

DHCP daemon starts in a chrooted environment in /var/dhcpd, so all files are located with this folder as a parent.

If you don’t have a monitor on your router, you can enable SSH or use a serial console cable.
It’s also possible to do almost everything using the Diagnostics -> Edit File menu item in the GUI. To create a file, just enter the full path and click Save.

ScreenClip

This solution requires two files.

1) 
The first one is a script, like this:

#/bin/bash
killall -3 dhcpd
cp /var/dhcpd/etc/dhcpd.override /var/dhcpd/etc/dhcpd.conf
/usr/local/sbin/dhcpd -user dhcpd -group _dhcp -chroot /var/dhcpd -cf /etc/dhcpd.conf -pf /var/run/dhcpd.pid le1 le0

Save it as: /usr/local/etc/rc.d/dhcpdoverride.sh

pfSense will run any script in this folder (/urs/local/etc/rc.d/) after it has started. The only requirements is the execute flag and that the file ends with .sh
So you’ll need to run this command as well:

chmod +x /usr/local/etc/rc.d/dhcpdoverride.sh

IMPORTANT NOTE!
The last command in this file may be different from system to system. Notice that one or more interfaces are being listed at the end. It’s easy to get the exact command of your system if you have done the initial configuration in GUI (included the interfaces you’ll be using).

Just run this command:

ps axww | grep dhcpd

The output should look something like this:

[2.1.3-RELEASE][root@pfSense.localdomain]/var(35): ps axww | grep dhcpd
38392  ??  Ss     0:00.04 /usr/local/sbin/dhcpd -user dhcpd -group _dhcp -chroot /var/dhcpd -cf /etc/dhcpd.conf -pf /var/run/dhcpd.pid le1 le0

I’m using two interfaces with DCHPD, so two interfaces are listed at the end.

2)
The second file is your own dhcpd.conf file.
If you have a file already then just save it as:
/var/dhcpd/etc/dhcpd.conf.override

If you don’t have a file already made, you can do the initial configuration in the GUI and just copy the file that is created. Then you have a good starting point.

After you have done your initial configuration in the GUI you can copy it like this:

cp /var/dhcpd/etc/dhcpd.conf /var/dhcpd/etc/dhcpd.conf.override

OR, using the GUI, like this

Go to Using Diagnostics -> Edit file:
open /var/dhcpd/etc/dhcpd.conf
then edit the filepath to /var/dhcpd/etc/dhcpd.conf.override and click Save

And that’s all!

Now you can edit dhcpd.conf.override with IP subnets, or anything you like.
An example of dhcpd.conf with multiple subnets:

option domain-name "localdomain";
default-lease-time 7200;
max-lease-time 86400;
log-facility local7;
ddns-update-style none;
authoritative;

#Subnet Alpha
subnet 10.50.150.0 netmask 255.255.255.0 {
  pool {
    range 10.50.150.100 10.50.150.200;
  }
  option routers 10.50.150.3;
  option domain-name-servers 10.50.150.3;
}

#Subnet Delta
subnet 10.18.200.0 netmask 255.255.255.0 {
  pool {
    range 10.18.200.100 10.18.200.200;
  }
  option routers 10.18.200.2;
  option domain-name-servers 10.50.150.3;# ex. a static IP address for a printer

  host HPPrinter { # example of a static IP address for a device
    hardware ethernet xx:xx:xx:xx:xx:xx; # replace the MAC address
    fixed-address 10.18.200.10;
    option host-name "HPLaserJet";
  }
}

NOTE!
You’ll need to replace the xx:xx:xx…  with the actual MAC address of your device.
And also;
If you are doing this to create subnets, you will also need to enable DHCP relay on your switch or routers between these subnets.

 

You can edit the override file from WebGui using the edit file menu.