ISP hacked OPNSense Router

[peterwkc]

Dear all, I had installed opnsense quite long time ago but recently my LAN cannot browse internet. Most probably my ISP has hacked my router. (Dont' argue this). 

Im looking method to harden my OPNSense router. Please suggest. Thanks.

Harden OPNSense Methods:
1. Disable SSH services
2. Disable root user in web gui option
3. WiFI based on MAC Address only
4. Installed Suricata IPS
5. Disable boot into single user mode to prevent hacker change password
6. How to enable sudo?

[Patrick M. Hausen]

Most probably my ISP has hacked my router. (Dont' argue this). 

Ridiculous assumption but you do you.

1. Disable SSH services

Disabled by default.

2. Disable root user in web gui option

You need at least one user with full administrative access. As long as you have that, of course you can disable the root login.

3. WiFI based on MAC Address only

Must be implemented at your access point and I fail to see how this would protect against threats from the outside like your ISP.

4. Installed Suricata IPS

No idea, I do not believe in IPS.

5. Disable boot into single user mode to prevent hacker change password

Needs physcial access to the box. If that is the case the "hacker" can always boot from an external boot medium.
Best encrypt your hard disk - I told you how to do that in your other thread.

Downside: OPNsense won't boot after an update or a power failure unless you enter the GELI password at the console.

6. How to enable sudo?

System > Settings > Administration > Authentication > Sudo

HTH,
Patrick

[meyergru]

Basically, IFF that happened, then it was one of these problems, in descending order of likelihood:

1. You exposed SSH and/or the web UI to WAN and your password was easily guessable. If you must do this at all, you should enable 2FA to prevent it or protect access by a VPN.

2. One of your SSH keys could be accessed by the ISP, e.g. because you also stored it on a hosted server there or in an unencrypted backup.

3. OpnSense has a vulnerability in the web UI that can be used to bypass the usual authentication.

I am not arguing that your box was not hacked, but either way:

a. I would doubt that it was your ISP that did it.
b. Your proposed measures would do little to nothing to prevent that from happening in the future.


P.S.: Point b. from above includes full-broadsided attacks on an unknown enemy like this. Once your OpnSense runs, it must be fully decoded, so disk encryption won't help, either.

You should first try to gather intelligence about if, how, who and what was attacked to find effective measures against it. Excuse me for using this german proverb, but do not fall for: "Operative Hektik ersetzt geistige Windstille".

[bimbar]

First, if you think some device of yours has been penetrated by an attacker, reinstall it cleanly.

[chemlud]

,,,: "Operative Hektik ersetzt geistige Windstille".

Operative Hektik verdeckt geistige Windstille. ;-)

[fakebizprez]

4. Installed Suricata IPS

No idea, I do not believe in IPS.

Expand on this please...

Not because I want to debate, but I think you're brilliant, and I've been going back & forth on the decision to implement this in our network.

[peterwkc]

I found article to hardened OPNsense box.

https://www.zenarmor.com/docs/network-security-tutorials/opnsense-security-and-hardening-best-practice-guide#:~:text=Hardening%20the%20firewall%20entails%20putting,are%20all%20part%20of%20this.

[Patrick M. Hausen]

I found article to hardened OPNsense box.

Most of these are just a matter of course or won't help with your suspected case.

For example SSH is disabled in a default installation of OPNsense.

To repeat myself: even if you grossly neglect password best practices and do not change the root password for the UI, a newly installed OPNsense cannot be "hacked" over the Internet.

There is no attack surface! None! No services reachable on WAN, all ports blocked. Period.

If your OPNsense was hacked then because you knowingly and intentionally configured *something* that opened it up. And most so called "hacks" are just password guesses.

So did you open your Firewall to the Internet or did you not? That's the question that needs to be answered. Not to blame you but to decide what to change in the future.

Unless you do an assessment of what exactly happend, all the measures you are swapping around in various threads will not help. Reminds me of the user "someone" who claimed he needed to reinstall their OPNsense every couple of days because the moment he hooked it up to the Internet it got "hacked". Ridiculous, really.

[bimbar]

4. Installed Suricata IPS

No idea, I do not believe in IPS.

Expand on this please...

Not because I want to debate, but I think you're brilliant, and I've been going back & forth on the decision to implement this in our network.

This is well worth discussing, but maybe in a different thread. I, btw, also don't believe in most of the things IPS is supposed to do.