OpenWrt

kKnvpqQr40E6zzgh

Hey,

This is a bit off topic but I'm wondering if people here use OpenWrt and what's the general opinion on it?

Youri

kKnvpqQr40E6zzgh I use it a lot, takes some times to configure it well. I think its the os for router with the biggest documentation and community

OPENWRT

Very Good 🐙

kKnvpqQr40E6zzgh

OPENWRT
Do you use the openwrt one router?

OPENWRT

kKnvpqQr40E6zzgh

I use a mix of different devices: mainly GL.iNet, OpenWRT-compatible routers, and other ones, but I don't have the OpenWRT ONE in my collection

kKnvpqQr40E6zzgh

Alright, do you have hardening tips for it? Should I disable SSH or change the default SSH port etc?

ejns

kKnvpqQr40E6zzgh SSH: I recommend configuring it for LAN-only. Unless you really need to SSH into it from outside of your network, disable SSH via WAN.

manugraph

I found it a bit overwhelming at first. There's definitely some learning curve to it. And I always had a little fear that I do something completely stupid like opening up my LAN to the WAN :D
Back then, I flashed it onto a Netgear X6 R8000.

In the meantime I got another router/5G-Modem from Teltonika (ALTOS CAP700) which is driven by the OpenWRT-fork RutOS and I like its interface a lot more.

Regarding SSH: Only enable it if you really need it to keep things simple. Due to the secure principle of SSH it shouldn't be an urgent security issue, though.
Changing the port is just "Security through Obscurity" although you might reduce the total amount of attacks on the specific port by standardized bots.

Personally, my only remote connection to my LAN is a VPN / Tailscale. From there I can access all my systems "locally" and don't have to open anything else to the public. So SSH is also only availably locally.

Pupswoof117

Gl inet I use.

TrustExecutor

OpenWrt is very good. It is a very lean distribution using linux+musl libc+busybox along with Alpine's apk package manager. It is designed to be run on tiny systems. Many people say it is only for tiny systems but it runs very well on x86 too, and with the new owut (OpenWrt Upgrade Tool) tool it is very easy to upgrade your OS. Lots of people also complain about the GUI but in my opinion it is easy and straight forward to use. There are lots of packages and if you want you can set it up to use very advanced features normally found in enterprise environments.

If you want to build it yourself the build system is easy to set up and you can deactivate some other functionality kernel modules and install only exactly what you need to further reduce attack surface.