Security for a to internet exposed Yun

Official Hardware Classic Yún
1

Hi all,

At the moment I have my yun exposed to the internet through port forwarding on my router. Although this is working fine, I have, and seen others that agree, a feeling that is leaves my yun and possibly also my lan-network vulnerable to attacks from outside. The aim is to add a little security (I'm thinking of a firewall here, or some sort of other thing that I have not heard about) to either my yun, router or both. However I am a complete noob to all this so any help is really appreciated!!!

Some conditions ideally taken into account:

  • I would like to access my default homepage which is served on the yun to be accessible everywhere
  • I want to use my default router which I got from my provider and not install some (expensive) firewall/router option
  • I imagine that I want to access my yun from certain devices only who belong to me or immediate family
  • At the moment I have a noip (free) account to keep track of my public ip-address

Like I said, I am a complete noob at all of this so even setting up a simple firewall rule would require some tutorial. I've looked at the openWRT page and found some examples of how to set this or that but for me it is just as clear as I explain it now here to you guys.

Hope someone can help!

2

@Arjan,
are you still working on this issue?
Jesse

3

Yes and no.

Yes, because it isn't finished.

No, because I don't know how to proceed and can't find the time to really dig into firewalls etc.

4

I'm not sure on your Yun what can be done, but some basic security ideas. I assume you are only forwarding the web service (port 80) from your Yun to the outside world, not your entire IP address of the device? that is first step of reducing exposure, only forward one port, not full IP. second thing I would do if this is just for your personal use - is change the web service port to be forward. most "bad stuff" that is looking for weak web services looks on port 80, 443, or 8080. change your port forwarding such that it forwards your yuns port 80 to an external high port, like 32000 (or basically, any high under under 65535). you are still vulnerable, but "off the radar" or most automated programs looking to attack weaker web servers. the down side - when point your web browser home, you must type http://yourIPaddress:32000 (or what ever high port. )

5

I assume you are only forwarding the web service (port 80) from your Yun to the outside world, not your entire IP address of the device?

(..)

change your port forwarding such that it forwards your yuns port 80 to an external high port, like 32000 (or basically, any high under under 65535).

What I have done now (and so far) is forward a high number port to port 80 on internal ip-address 192.168.1.13 (Yuns ip-address). So I think only my webservice is subjected to the 'horror' from the outside world. I'm not sure how to check though.

the down side - when point your web browser home, you must type http://yourIPaddress:32000

So be it. I had to use a portnumber anyway because there are more devices that want to use port 80. I had the Yun on 8080 but that is now changed as said above :slight_smile: Thanks for the tips!

Any more tips/ideas anyone?