I have had a few emails asking what firewall settings people should actually be using on their home network. Fair question - there is a lot of conflicting advice out there, and most of it is either too vague ("enable your firewall") or too paranoid for a home setup. So here is what I actually run and why, whether you are using DD-WRT, a dedicated Linux box, or just the built-in firewall on your router.

Firewall settings - the basics that matter

Before touching anything specific, understand what your firewall settings need to accomplish on a home network. You want to block unsolicited inbound connections, allow outbound traffic from your LAN, and selectively permit inbound traffic only for services you are deliberately exposing. That is it. You are not running a data centre.

The default firewall settings on most consumer routers are actually not terrible - they run SPI (Stateful Packet Inspection) and block inbound by default. The problem is that people start poking holes without understanding what they are doing. Every port forward, every DMZ host, every UPnP-enabled device weakens your perimeter.

SPI vs stateless filtering

If your router or firewall supports SPI (and anything made after about 2003 should), use it. Stateful inspection tracks connection state - it knows that an inbound packet on port 54321 is a response to an outbound request your machine made, rather than an unsolicited connection attempt. This is fundamentally better than stateless filtering, which can only look at individual packets in isolation.

In iptables terms, this is the difference between:

# Stateful - correct approach
iptables -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
iptables -A INPUT -m state --state NEW -j DROP

# Stateless - weaker
iptables -A INPUT -p tcp --dport 80 -j ACCEPT
iptables -A INPUT -j DROP

The stateful rule allows return traffic for any connection your machines initiated, while dropping anything unsolicited. The stateless rule has to explicitly list every port, and it cannot distinguish between legitimate return traffic and new connection attempts.

Recommended firewall settings for DD-WRT

If you are running DD-WRT (and if you are reading this blog, there is a decent chance you are), here are the firewall settings I recommend under Administration > Firewall:

  • SPI Firewall: Enable. Non-negotiable.
  • Filter Multicast: Enable. Unless you have a specific need for multicast traffic from the WAN side, block it.
  • Filter WAN NAT Redirection: Enable. Prevents hairpin NAT attacks from the LAN.
  • Filter IDENT (port 113): Enable. Nobody needs ident from the internet in 2008. Some IRC servers used to require it, but most have moved on.
  • Block WAN Requests: Enable all sub-options - Block Anonymous WAN Requests (ICMP), Filter IDENT, Block WAN SNMP access.

Under the Security tab, the additional firewall settings are equally important:

  • Disable SIP ALG: Unless you are running VoIP, disable the SIP Application Layer Gateway. It creates more problems than it solves and opens up potential attack surface.
  • Disable UPnP: Yes, I know this is controversial. UPnP lets devices on your LAN automatically create port forwards, which is convenient for gaming and media streaming. It is also a massive security hole - any malware on your network can use UPnP to punch holes in your firewall. Disable it and create manual port forwards for the things you actually need.

Port forwarding - do it properly

If you need to expose a service (SSH to your home server, a web app, whatever), create a specific port forward rather than using the DMZ. The DMZ forwards ALL ports to a single host, which is almost never what you want.

A proper port forward in DD-WRT or iptables looks like this:

# Forward external port 2222 to internal SSH
iptables -t nat -A PREROUTING -i $(get_wanface) -p tcp \
    --dport 2222 -j DNAT --to-destination 192.168.1.10:22
iptables -A FORWARD -i $(get_wanface) -p tcp \
    --dport 22 -d 192.168.1.10 -m state --state NEW -j ACCEPT

Key points about these firewall settings for port forwarding:

  • Use a non-standard external port (2222 instead of 22) to reduce automated scanning noise
  • Forward to a specific internal IP, not a range
  • The FORWARD rule uses state NEW, meaning only new connection attempts are matched - established connections are handled by the general ESTABLISHED,RELATED rule
  • Only open the ports you actually need. Every open port is attack surface.

Common firewall settings mistakes

These are the things I see people getting wrong most often:

Enabling DMZ to "fix" connectivity issues. If your game or application is not working, the answer is a targeted port forward, not throwing your entire machine onto the internet. I have seen people put their main desktop in the DMZ because they could not be bothered to look up which ports their game needed. Mental.

Leaving UPnP enabled. I mentioned this above but it bears repeating. The Conficker worm used UPnP to propagate. So did several other pieces of malware. The convenience is not worth the risk.

Not logging dropped packets. If you are running iptables, add logging rules. You do not need to analyse the logs daily, but when something goes wrong, having the logs available is invaluable:

iptables -A INPUT -j LOG --log-prefix "FW_DROP: " \
    --log-level 4 -m limit --limit 3/min
iptables -A INPUT -j DROP

The rate limit prevents log flooding if someone runs a port scan against you.

Forgetting about outbound filtering. Most home firewall settings only address inbound traffic. If you want to go a step further, consider restricting outbound traffic to known ports (80, 443, 53, etc.) and logging anything else. This can catch malware phoning home on unusual ports. It is more effort to maintain but worthwhile if you are running a home lab with test machines.

Verifying your firewall settings

After configuring everything, test from outside your network. Ask a mate to run nmap against your WAN IP, or use an online port scanner like ShieldsUP from GRC. You should see only the ports you intentionally forwarded. Everything else should show as filtered (not closed - filtered means packets are silently dropped, which is correct).

$ nmap -sS -Pn 82.x.x.x
Starting Nmap 4.53 ( http://insecure.org )
Interesting ports on 82.x.x.x:
Not shown: 1713 filtered ports
PORT     STATE SERVICE
2222/tcp open  unknown

If you see ports you did not expect, work backwards through your rules. Check for stale port forwards, UPnP-created rules, and any ALG modules that might be doing unexpected things.

The whole point of getting your firewall settings right is to have a known, predictable security posture. You should be able to list every port that is reachable from the internet and explain why each one is open. If you cannot, your firewall settings need work.