Securing Home Network using 3rd Party Firmware / Access Points

Question

I've been having some trouble on my home network and thought that having a router as an AP would help fix these attacks. At first it did, but now it seems the attackers have gotten through. For all I know, it COULD be a pesky script not necessarily an "Attacker" - just using that term as a general descriptor of a rogue device or worm on my network.

The most obvious signs of outside activity are inbound DHCP connection attempts when using OpenVPN with certain IPs and DNS being switched to an Indonesian server when using certain ports. Some questions along with a basic map of my connection below (using Ethernet):

[MODEM/ROUTER] -> [ROUTER/AP] -> [My Computer]

• Would using OpenVPN on my router vs computer help deter these types of attacks?

• Is there any benefit to using two routers vs one to help prevent traffic getting through? Does layering access points help in this situation? I was under the impression a DMZ would help isolate my machine from others... but it could be that I just dont have the DMZ setup strict enough.

• Would setting up pFSense on a spare computer be more secure vs. using 3rd party firmware on a router? (e.g. Tomato, Gargoyle, OpenWRT, DD-WRT) I figured packages such as DNSCrypt/DNSMasq would help fix the DNS issues described above. I'm not quite sure how to harden DHCP beyond setting it as authoritative, etc.

Answer 1

stackexchange is only suited to one question at a time - you've asked more than one where the title matches a small one at the end, but the rest is 'how do i stop getting dhcp traffic when i'm on a vpn?' by my interpretation.

The answer for that question is to have a firewall on whatever you connect - be it a single host or a router.

There's no objectively good way to assess whether 3rd party firmware is better or worse, since the details matter, but these are moot and only pretty loosely related to your first question. Out of the things you've suggested pfsense is probably the best setup, but only if properly configured, which I kind of get the impression you may not find easy.

Answer 2

It is impossible to tell whether running OpenVPN on one host as compared to on another would make it easier or more difficult for someone to carry out an attack. My hunch is that it wouldn't make any significant amount of difference either way, and that if someone is getting in that way, you're going to have a problem regardless of where the VPN endpoint is located. On the router might actually make things worse in some situations, since the attacker would then potentially have access to all your network traffic, not just that on a specific host, and my experience is that routers aren't monitored in the way end user systems are. (You might be the exception to that rule of thumb, but, no offense, I'm not counting on it.)

In consumer routers, "DMZ" is typically used to mean something along the lines of "a single host that has no firewall protection and lives on the local network segment". That is not an actual network demilitarized zone. Rather, broadly speaking, a proper DMZ is a network segment separate from and without significant trust relations to both the LAN and the WAN. This can be accomplished using two firewalls, or a Y split from one firewall that supports multiple separate LAN segments. The important part either way is that the DMZ must be treated as untrusted by hosts on the inside LAN, but must be offered some amount of protection against bad traffic from the WAN. Wikipedia has a decent writeup on DMZ in computer networking including topology examples complete with illustrative pictures.

As for setting up pfSense, the more important aspect would probably be to separate concerns between systems. While pfSense is extremely powerful, that power comes at the price of complexity, and you pretty much need to have a decent grasp of IP networking to be able to use it to its full potential. If you don't know what you're doing, and start fiddling with its settings, it's quite easy to end up with a configuration that leaves you worse off than you would be with just a plain consumer router or two.

One obvious advantage of running pfSense, compared to third-party firmware on a consumer router, is that pfSense has the backing of a commercial company offering products and services built around it (Netgate), which third-party firmware might not have. This provides much better guarantees that it won't suddenly disappear (or support for your platform will be silently pulled) when some other new and shiny thing comes along. For some people, that alone can be a major reason to choose one over another.