2

I was excited to setup an IDS/FireWall with my new Raspberry Pi on a standard home network. Reading threats to SSH and Linux, now I am not so sure. Setup by an experienced amateur I'm now concerned that it would turn an otherwise innocuous network into a DDoS and hacking target.

Yet ignorance is not always bliss, and I have no idea if my OS level firewalls are useful, and would like a practical means to protect and detect on my network.

For a home network is it better to rely on basic, pre-configured security and OS/ISP firewalls, or is there benefit to implementing advanced security via online guides/answers?

I think the worst case scenario is the machine is hijacked and instead of being a defense turns into a self-made MITM attack... is that accurate and/or are there more dire concerns (immediate - not dependent on the MITM concern)?

closed as primarily opinion-based by Polynomial, Tobi Nary, Neil Smithline, Matthew, Xander May 3 '16 at 20:09

Many good questions generate some degree of opinion based on expert experience, but answers to this question will tend to be almost entirely based on opinions, rather than facts, references, or specific expertise. If this question can be reworded to fit the rules in the help center, please edit the question.

  • 1
    I would recomment using a lightweight distro such as Archlinux so that you don't have any services running by default and you know exactly what can get exploited. Protecting against SSH bruteforce is easy (disable password auth and use keys) and besides that, just keep the system up to date and you've already got a more secure system than the majority of consumer-grade routers. Also, avoid services that run a web interface and claim to make system administration easy (such as cPanel or Webmin) as they have an enormous attack surface. – André Borie May 3 '16 at 7:39
  • @AndréBorie I had difficulty without another Linux machine getting ArchLinux so I was going to uninstall items from Ubuntu Mate... may spring for another SD as this sounds more secure and reliable. Thanks! – Dave May 3 '16 at 15:02
  • To be honest I would recommend going with a standard x86 machine instead of an ARM one if you're learning. Grab yourself an old PC, put two network interfaces in there (plus a Wifi card if you want an access point) and done. That's what got me into Linux and system administration back when I was younger. – André Borie May 3 '16 at 16:00
2

Yes, Please do it . It is still better than a network without any firewall. looking at the link, this is a simple network firewall with DHCP, DNS and SNORT. It does not decrypt your SSL traffic because it is not a Proxy. the Main function of this firewall is to protect your LAN from attacks (including some commonly known DDoS attacks as well).

as far as I know, the Linux network stack is pretty solid and there are some factory made routers running Linux as well.

SSH is called the poor man's VPN and is quite secure. use RSA with a key size of atleast 2048 bits or more(4096 bits even, if Pi can handle it) so that you don't get brute-forced. also, as the guide says, try signing the Host and User key with Certificates to make SSH more secure by enforcing Validation. Also SSH is not a requirement, you can have it turned off, if you don't want to connect to the firewall remotely.

For a home network is it better to rely on basic, pre-configured security and OS/ISP firewalls, or is there benefit to implementing advanced security via online guides/answers?

There is always a benefit to implementing advanced security, like this firewall will detect tools like nmap used to survey the network, apart from filtering network traffic.

if you are just going to copy/paste whatever configuration is on that link without understanding why its done, then you are making a compromise there. another thing to be aware of, is that you might end-up blocking legitimate traffic, as most firewalls DENY ALL traffic by default. so, this is really a question for yourself on how much time and effort you are willing to spend on tweaking the firewall without affecting functionality.

I think the worst case scenario is the machine is hijacked and instead of being a defense turns into a self-made MITM attack... is that accurate and/or are there more dire concerns (immediate - not dependent on the MITM concern)?

This firewall works in the network layer(mainly) of the OSI reference model. however most threats occur in the Application Layer and some of them can be quite dire. In a MITM senario, all unencrypted Text passing through the firewall can be read, however this firewall cannot decrypt SSL(HTTPS). So a compromised Laptop can be a much more dire situation than this compromised firewall.

  • Sounds good, thanks for the validation and explanation! – Dave May 3 '16 at 15:01

Not the answer you're looking for? Browse other questions tagged or ask your own question.