Is dd-wrt generally more secure than manufacturer's firmware?

Question

I have been advised to use dd-wrt, for richness of features and heightened security.

The argument about security is that major manufacturers don't care much about the firmware, release with a lot of bugs and those become widely known. Consequently, just knowing the router model confers knowledge of many vulnerabilities to an would-be attacker.

Is this generally true? When looking for a secure home edge router, should I filter out the models that are not supported by dd-wrt?

Answer 1

Most manufacturer's firmwares for routers are actually built around the same open source software as open source alternative like dd-wrt. The real security distinction is not between a "manufacturer" and an "open source" firmwares; it is between a maintained firmware against one that is not. A crucial element for security is how promptly fixes for discovered security holes are designed, published, and installed.

If you take a router, install dd-wrt on it, and then forget all about it and just let it run without ever installing fixes, then your security won't be better than if you had left the manufacturer's firmware in place. The bright point of dd-wrt is not that it is "more secure", but that it makes it easier to install updates, and that is what security comes from. You still have to do it, though.

Answer 2

Well, for knowing if a dd-wrt firmware router is more secure than its original firmware, proper security measurement tests should be done, and I believe that nobody has done those tests, so I am going to throw some thoughts:

1. We should first consider which brand, because some of them already have dd-wrt like in their systems, like Fon, and others like Cisco spend quite a money in their routers security, so I believe some brands will be worse and some others will be better.
2. Routers security will depend strongly in the configuration, if you have a lot of options and you don't know how to properly configure them you may make a mess, on the other hand a preconfigured router with good security measurements may prevent normal users from mess with the security even with a "worse" firmware.
3. DD-wrt is an open system and this have serious advantages against proprietary firm wares: bugs are spotted and solved quicker. But this means nothing if the user doesn't upgrade the system.

To sum up, depending on the user, security may have little to nothing to do with the firmware of the router itself but with the user choices and the management of router itself (upgrading, configuring...)

Answer 3

Some quick thoughts:

1. Manufacturer usually are slow in releasing patches or vulnerability fixes.
2. DD-WRT provides additional security features such as iptables
3. Add-on features to monitor the traffics and utilization
4. Easier to configure preferred network setups/segregation

So... ya DD-WRT is more secured

Answer 4

I have used dd-wrt for my TP Link 3G router. In my experience what I can tell is many manufactures do not release security patches. And manufactures also give up products when next hardware version has arrived the market.

DD-WRT forums have developers and community which will enhance the experience using the hardware product (Bug Reporting, Issues reporting).

But remember it may hard to revert back to original factory ROM. You may end up with a bricked device.

However in security sense, new versions with patches will be there frequently. And root access will be there. And you can do what you want.

Answer 5

It depends on the original firmware you are replacing, however it could be more secure than many "consumer" router firmwares because it does not support WPS at all (which is a known security risk)