4

Like a lot of people I have a simple consumer grade router at home. The setup is pretty standard:

Ethernet from the cable modem --> router's WAN

Given the poor track record of consumer routers in terms of security I decided it would be safer to put the router behind a firewall. In my case I used a spare PC and setup a dedicated pfSense box. The new config is:

Ethernet from cable modem --> pfSense --> router connected to pfSense LAN.

(Router gets IP via DHCP from pfSense LAN)

My thinking is that pfSense is more actively updated then my router's firmware so it should have less bugs and vulnerabilities. It also offers more control than my router.

My question is, assuming a properly configured pfSense, does the addition of pfSense add any additional security from outside attacks? I understand that the firewall does nothing to mitigate "user error" attacks like downloading malware, plugging in infected USB drive, etc.

Thanks.

Improve this question
9
  • 3
    pfSense is already a combined NAT router+firewall by default, so why would you connect the consumer router at all if you're using pfSense? It'll work but to me that seems redundant and you'll also create a double NAT which isn't really good networking practice unless you have a specific reason to do so. It would be better to just connect your pfSense LAN interface to a switch, connect your other computers to the switch, and ditch the consumer router entirely. – tlng05 Jun 4 '15 at 21:16
  • I need the WLAN from the consumer router. Unfortunately only two of my devices can be hardwired and I can't afford the hardware to integrate wifi into pfSense. While it is a double NAT, that is what it is. Maybe that weakens the case for the addition of pfSense. – TCal Jun 4 '15 at 21:21
  • 2
    If you don't want to buy a dedicated access point, you can more or less "demote" your existing consumer router into just an access point so that it does not perform any routing, firewall, or DHCP duties. See this doc: doc.pfsense.org/index.php/… – tlng05 Jun 4 '15 at 21:28
  • You can also just bridge the wireless interface - depending on the brand. – KDEx Jun 4 '15 at 21:33
  • 1
    Yes, you can still plug your hardwired devices into the consumer router's LAN ports. Your router's LAN ports essentially act as a switch. – tlng05 Jun 4 '15 at 21:53
1

After reading a bit into the documentation this seems like a nice bit of additional security for a home network. You have a basic firewall package with basic networking features. In your case it is free, and can be a nice side project. Some things you will want to configure:

Firewall rules

Make sure you actually configure firewall rules to fit your situation. There are plenty of guides, take your pick.

NetFlow

I notice that iftop and bandwithd are both available packages to install. I would recommend these. If you notice you're home network is sending out tons of data at 3 am, there may be a problem. These tools can help you identify those issues.

IPS/IDS

Snort and Suricata are also both available packages. I'd recommend picking one and installing a simple interface to view alerts (snorby is simple, and nice).

If you have the time, and inclination these steps will be good first steps towards securing your home network. Have fun.

Improve this answer
4
  • What's your opinion of the double NAT? Is it a security issue or merely bad practice? – TCal Jun 4 '15 at 21:44
  • @TCal bad practice, may/maynot lead to some networking issues depending on what you do on your home network. Your home router likely has an option to turn NAT off, on mine its done by putting the wireless interface into bridge mode. – KDEx Jun 4 '15 at 21:46
  • Hm, that may work. I see my router can do wireless bridging. I'll have to look into. It's good to know that if I don't get around to it for a while then it's not the end of the world. – TCal Jun 4 '15 at 21:56
  • After looking around I've yet to find a good guide on how to best establish firewall rules. Everything I've found is either too simple (technet.microsoft.com/en-us/security/hh144813.aspx) or too complex (cisco.com/web/about/security/intelligence/…). Any suggestions? – TCal Jun 7 '15 at 0:28
0

That's an excellent way to improve your home network security. Whether you use pfSense, or a competitor's software (which there are a number of free or openSource alternatives) you will have better security than what's provided by a consumer router. The focus of the consumer router is to get your devices on the internet, they provide some minimal security as well, at a low cost. Many consumer router manufacturers only provide updates while the router is still being produced. However, just because you have a C60 router which is still being sold, doesn't mean they are still doing updates. You may have C60 revision 2 produced in 2017, and they are producing C60 revision 5 in 2019. Well, that revision 2 probably got it's final update in 2017, and has discovered vulnerabilities by now. Remember those manufacturers have a lot of models, with a lot of revisions, which means updates for everything costs a lot of money; which is why only the most recent get updates.

You are correct that pfSense will be updated more frequently and for long term. The focus is on security in this case, offering better protection and faster updates. Being OpenSource, often times fixes for vulnerabilities come faster and at a lower cost to the company. Often in OpenSource the fixes are shared between providers of similar service, further reducing operating cost for the company. Benefit of OpenSource to the company is reduced operating cost, but also benefits you with a free service. While they can offer a product/service free to you, I suggest you contribute, because providing service to you does cost them money.

Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.