Posted: Wed Mar 12, 2025 22:42 Post subject: [SPLIT] New Firewall Settings
Mod note: Post split from x86 build thread and duplicate post deleted from Broadcom thread because there was no need to cross-post. -kp69
From the point of view of today's network traffic - especially with simultaneous use of VPNs, online gaming, IPTV, streaming, and a staged web server - the default limits (especially 5 packets/sec for UDP and ICMP) are sometimes too low and can cause false blocking of legitimate traffic. I suggest other default values, especially since the defaults will cause problems in most cases, as I also experienced after the update from r60217, which made available in the Firewall configuration, among other things: Filter TCP-SYN floods, Filter UDP floods, Filter Ping Echo request floods:
TCP-SYN: about 300-600 packets/min.
UDP: 50-100 packets/s (especially for VPN, gaming and streaming).
ICMP (Ping): 20-50 packets/s depending on diagnostic needs.
You can start with the defaults:
Filter TCP-SYN floods: 300
Filter UDP floods: 50
Filter Ping Echo request floods: 20
- Port Scan Blocking: How is this better than just being completely stealth, especially if we have no outside ports opened. If you have ports opened, then it seems more useful.
- When having Tarpit enabled, while the ports are not actually opened, they appear to be. I would think this would potentially create more attacks, as it would make the attacker suspicious and get their friends involved, creating even more unwanted (but totally hung) traffic. Again, stealth mode just seems better, unless you have intentionally opened ports.
- This is a great addition to DD-WRT. The fine tuning will be the key to it. _________________ - Linksys EA8500: I-Gateway, WAP/VAP 5ghz only. Features: VLANs, Samba, WG, Entware - r60xxx
- Linksys EA8500: 802.11s Secondary w/VLAN Trunk over 5ghz - r60xxx
- Linksys MX4300: 802.11s Primary w/VLAN Trunk over 5ghz. 2.4ghz WAP/VAP only - r60xxx
- Linksys MX4300: (WAP/VAP (7)) Multiple VLANs over single trunk port. Entware/Samba r60xxx
- Linksys MR7350: WDS Station for extended Ethernet r60xxx
- Linksys MR7500, MX8500: None in production. Just testing. r60xxx
- OSes: Fedora 40, 10 RPis (2,3,4,5), 23 ESP8266s: Straight from Amiga to Linux in '95, never having owned a Windows PC.
- Forum member #248
Joined: 16 Nov 2015 Posts: 6899 Location: UK, London, just across the river..
Posted: Thu Mar 13, 2025 11:34 Post subject:
hmmm my R7000 is a VPN client, and ever since i installed the last build 60269 i ve no complains on it streaming, youtube, qbittorent, VPN, videos and ect...all work fine...the odd bit is activate firewall log, high high doesn't produce any output in the log... VPN on or off... I even tested port scanning VPN off or on ... it goes trough no problems...speeds are also fine....checking nvram values all new security futures enabled...as expected this leads me to believe are those working at all...or the log output function is not ok...
for the record: on R7000 Im using the new security futures default values, i do have a security policy with a few risk and ndpi functions enabled (not sure if those are working either as it shows 0 filtered packets interface any and selected IP range and few mac's)
I dont have any troubles with DNS but im using DNScypt-proxyv2 via Entware along with DNSmasq...
I dont have serial on this unit...so not much output i can provide...sry...only router logs...but they show nothing...
Im also behind another router that i believe it could be the coolprint ...
R7000 Its the only router i can test ATM as i can access it physically...im not gonna update R7800 or any other unit until im near by those units... _________________ Atheros
TP-Link WR740Nv1 ---DD-WRT 58184 WAP
TP-Link WR1043NDv2 -DD-WRT 61848 Gateway/DoT,Forced DNS,Ad-Block,Firewall,x4VLAN,VPN
TP-Link WR1043NDv2 -Gargoyle OS 1.15.x AP,DNS,QoS,Quotas
Qualcomm-Atheros
Netgear XR500 --DD-WRT 61915 Gateway/DoT,AD-Block,Forced DNS,AP&Net Isolation,x2VLAN,Vanilla
Netgear R7800 --DD-WRT 61915 Gateway/DNSCryptv2,AD-Block,Forced DNS,AP&Net Isolation,x3VLAN,Firewall,Vanilla
Netgear R9000 --DD-WRT 61848 Gateway/DoT,AD-Block,AP Isolation,Firewall,Forced DNS,x2VLAN,Vanilla
Dynalink DL-WRX36-DDWRT 61745
Broadcom
Netgear R7000 --DD-WRT 61745 Gateway/DNScrypt-proxy2/AD-Block,IPset Firewall,Forced DNS,x4VLAN,VPN
NOT USING 5Ghz ANYWHERE
------------------------------------------------------
Stubby DNS over TLS I DNSCrypt v2 by mac913
- Port Scan Blocking: How is this better than just being completely stealth, especially if we have no outside ports opened. If you have ports opened, then it seems more useful.
- When having Tarpit enabled, while the ports are not actually opened, they appear to be. I would think this would potentially create more attacks, as it would make the attacker suspicious and get their friends involved, creating even more unwanted (but totally hung) traffic. Again, stealth mode just seems better, unless you have intentionally opened ports.
- This is a great addition to DD-WRT. The fine tuning will be the key to it.
Also, one feature I'd love to see someday is something along the lines of an internal network datamining blocker for streaming media devices like all the Roku, Amazon FireTV devices. These companies are adversarial and completely rights violating of the consumer, with dozens upon dozens of completely unnecessary phoning home, sending back data of what you're watching. I'd like to see something that allows per -MAC address advanced filtering that even allows blocking of hardcoded DNS-over-HTTPS dns servers within a device. Roku, from what I can tell, completely ignores DNS redirection and DNS redirection DOT in dd-wrt. I have even purposely broke DNS on my network so that I could not browse or get any internet traffic on my PC/phone, but magically the Roku still streams whatever you want (because the manufacturer went to extreme lengths of making sure THEIR servers get used so they get to illegally datamine you).
- Port Scan Blocking: How is this better than just being completely stealth, especially if we have no outside ports opened. If you have ports opened, then it seems more useful.
- When having Tarpit enabled, while the ports are not actually opened, they appear to be. I would think this would potentially create more attacks, as it would make the attacker suspicious and get their friends involved, creating even more unwanted (but totally hung) traffic. Again, stealth mode just seems better, unless you have intentionally opened ports.
- This is a great addition to DD-WRT. The fine tuning will be the key to it.
Not sure if you noticed : its not only port scan blocking and tarpit, but the new filter TCP-SYN flood and filter UDP flood options also make the host appear as active rather than stealthed / down / inactive. Didn't experiment with filter ping flood, as when I realised that the first two flood filters make the host appear active, I disabled all three immediately.
You can reproduce it by enabling / disabling them and performing port or network scans from pentest-tools.com, for example (basic scans are free).
My 0.02 : my personal thoughts are that for the average home user with few, if any, open ports, its more valuable to keep themself stealthed to avoid drawing attention to themself. The filters can always be enabled if such a user ever becomes the target of an attack. Happy to hear counter views on why eliminating the benefit of stealth and enabling the filters should be the default for such users, though.
Joined: 18 Mar 2014 Posts: 13692 Location: Netherlands
Posted: Sat Mar 15, 2025 10:32 Post subject:
Quote:
My 0.02 : my personal thoughts are that for the average home user with few, if any, open ports, its more valuable to keep themself stealthed to avoid drawing attention to themself. The filters can always be enabled if such a user ever becomes the target of an attack. Happy to hear counter views on why eliminating the benefit of stealth and enabling the filters should be the default for such users, though.
I Agree, the new firewall settings should all be disabled by default.
I Agree, the new firewall settings should all be disabled by default.
I have been discussing this with the management.
I do believe the last release DID have these disabled by default. _________________ - Linksys EA8500: I-Gateway, WAP/VAP 5ghz only. Features: VLANs, Samba, WG, Entware - r60xxx
- Linksys EA8500: 802.11s Secondary w/VLAN Trunk over 5ghz - r60xxx
- Linksys MX4300: 802.11s Primary w/VLAN Trunk over 5ghz. 2.4ghz WAP/VAP only - r60xxx
- Linksys MX4300: (WAP/VAP (7)) Multiple VLANs over single trunk port. Entware/Samba r60xxx
- Linksys MR7350: WDS Station for extended Ethernet r60xxx
- Linksys MR7500, MX8500: None in production. Just testing. r60xxx
- OSes: Fedora 40, 10 RPis (2,3,4,5), 23 ESP8266s: Straight from Amiga to Linux in '95, never having owned a Windows PC.
- Forum member #248
This is weird. I have not been to the grc website in a very long time. With all the discussion about the new firewall features, I figured that it would be a good idea to check my router out. I had my ports probed and everything came back "stealth" but it said that I had failed the test with:
"Ping Reply: RECEIVED (FAILED) — Your system REPLIED to our Ping (ICMP Echo) requests, making it visible on the Internet. Most personal firewalls can be configured to block, drop, and ignore such ping requests in order to better hide systems from hackers. This is highly recommended since "Ping" is among the oldest and most common methods used to locate systems prior to further exploitation."
I have "Anonymous WAN requests (ping)" enabled. WTH? Any ideas?
Edit: I am using a VPN, is it possible that reply is coming from the VPN server? _________________ Linksys MX4300 802.11s Primary
Linksys MX4300 802.11s Secondary 1
Linksys MX4300 802.11s Secondary 2
Edit: I am using a VPN, is it possible that reply is coming from the VPN server?
GRC would be testing the VPN IP. If you want a real test, shutdown the VPN first. _________________ - Linksys EA8500: I-Gateway, WAP/VAP 5ghz only. Features: VLANs, Samba, WG, Entware - r60xxx
- Linksys EA8500: 802.11s Secondary w/VLAN Trunk over 5ghz - r60xxx
- Linksys MX4300: 802.11s Primary w/VLAN Trunk over 5ghz. 2.4ghz WAP/VAP only - r60xxx
- Linksys MX4300: (WAP/VAP (7)) Multiple VLANs over single trunk port. Entware/Samba r60xxx
- Linksys MR7350: WDS Station for extended Ethernet r60xxx
- Linksys MR7500, MX8500: None in production. Just testing. r60xxx
- OSes: Fedora 40, 10 RPis (2,3,4,5), 23 ESP8266s: Straight from Amiga to Linux in '95, never having owned a Windows PC.
- Forum member #248
Thank you for your input. I suspected that it was the VPN. _________________ Linksys MX4300 802.11s Primary
Linksys MX4300 802.11s Secondary 1
Linksys MX4300 802.11s Secondary 2
