11–14 of 14 posts
- SELinux Enabled - Sysctl tuning applied - Inbound/Outbound/Forward iptables rules enabled - ipset iptables rules enabled - iptables intercept rules to route all ntp/dns over VPN to VPS nodes. - Unbound DNS overriding many spammy domains - tinc vpn enabled to multiple VPS nodes. -- Each VPS node load balancing to multiple datacenter open resolvers that are NOT OpenDNS or Google. - ip route blackhole about 20k bad ne…
It's a good list. I just hate those things now. I worked as a wireless router firmware developer for a while and as a result... I don't use them anymore. The whole industry is just producing unfixable tire-fires. Different level of caring, but if security is important to you, put cable/dsl/fiber ntu in bridge mode. Get a pcengines apu (or your favourite sbc), install your favourite os (ubuntu or debian for me). Don't…
Is this setup (the linux APU in bridge mode) so that the NTU could get hacked but your internal network would still be secure behind the APU?
What protects the APU from getting hacked like a traditional router would? Just easier to secure yourself?
Did you just purchase wireless access points separately? Did you buy a seperate switch?
I've wanted to do something like this for awhile but I wasn't sure what all was involved, or if it was that much more secure.
- SELinux Enabled - Sysctl tuning applied - Inbound/Outbound/Forward iptables rules enabled - ipset iptables rules enabled - iptables intercept rules to route all ntp/dns over VPN to VPS nodes. - Unbound DNS overriding many spammy domains - tinc vpn enabled to multiple VPS nodes. -- Each VPS node load balancing to multiple datacenter open resolvers that are NOT OpenDNS or Google. - ip route blackhole about 20k bad ne…
including hardware and specific OS used?
It's a good list. I just hate those things now. I worked as a wireless router firmware developer for a while and as a result... I don't use them anymore. The whole industry is just producing unfixable tire-fires. Different level of caring, but if security is important to you, put cable/dsl/fiber ntu in bridge mode. Get a pcengines apu (or your favourite sbc), install your favourite os (ubuntu or debian for me). Don't…
Can you expand on this a little bit? What does it buy you? Is this setup (the linux APU in bridge mode) so that the NTU could get hacked but your internal network would still be secure behind the APU? What protects the APU from getting hacked like a traditional router would? Just easier to secure yourself? Did you just purchase wireless access points separately? Did you buy a seperate switch? I've wanted to do someth…
It doesn't mean that it's the best. An x86/x64 ssh bug hurts everyone. But it means that everyone in the world gets fucked, more or less, and you don't have to worry as much.
Relying on random companies to secure your gateway puts you in the hands of random companies who not only do not care but also do not make theor own stuff and now lack the basic competence to do so.