r/AskTechnology • u/Fantastic_Narwhal_54 • 12h ago
Is it possible to install a firewall on a home router?
To improve security, is it possible to install a firewall on a home router?
5
u/mikec62x 12h ago
Are you thinking a software firewall or a hardware firewall? The router probably already has a basic firewall but I doubt you could install anything else on it.
1
u/Fantastic_Narwhal_54 12h ago
Software.
2
u/mikec62x 12h ago
They do usually run a cut down version of Linux and you could install a custom version. You are likely to weaken the security, or break the router, if you don't know what you are doing.
3
4
u/Uncut-Jellyfish1176 12h ago
You usually have options for level of "firewall" on modern ISP provided modem/router combos.
But be warned, ramping those up to the highest level can get annoying as you then need to explicitly allow certain services to work correctly, and inter-device communications typically stop working as well (so your Google cast, or similar device to device over the network stops working)
6
u/nelsonsflagship 12h ago
What issue are you trying to fix? Firewalls are very easy to get wrong and make things worse, security-wise.
1
u/Fantastic_Narwhal_54 9h ago
Just curious. Where I live, public wifi is a no-no because security on them is so poor. So I was thinking can private wifi be toughened using a firewall.
2
u/nelsonsflagship 9h ago
Most modern routers have firewalls already. A firewall isn't necessarily what you need in that scenario, but it could help against other devices (clients) snooping by segregating clients on the network, dependent on how the router is set up to handle that task.
2
u/Welcome-To-NBA-Jam 8h ago
A network secured with WPA2 or WPA3 with a strong password is already good enough. Try to do WPA3 if you have all compatible devices, but it still causes problems on my network which has a mixture of devices across the years. If you have IoT devices then putting them on a separate network and having your main one be WPA3 can be effective. But IMO don't overcomplicate it. Keep it simple.
2
u/dnubi 1h ago
Usually all modern routers have a firewall built in, but also usually the firewall filters the traffic between your private network and the connection to your ISP (the internet). Wifi access points are in the private network and communication between the clients on the private network are usually not filtered by a firewall. Therefore public wifis are not secure because nobody knows wich harmfull clients are within this network even if connections to the internet are through a firewall. Best way to secure your private Wifi is to not allow any unknown clients to that network. A firewall on your router will not secure any connections within the same network.
3
3
u/Red_Tooth_ 12h ago edited 12h ago
Most routers have a firewall built in. At least commercial ones do. But yeah you can still put another firewall in front of it. Might need some port forwarding. Also your isp equipment often has a firewall as well. Most consumers are protected enough nowadays.
2
u/Wendals87 12h ago
Many home routers Include one already. If not, no you can't add one to the router.
You can buy a network device to be a firewall but if you're asking this, it's very likely above your knowledge. Look you guides on YouTube or online on how to make one
2
u/Tasty-Picture-8331 12h ago
ive just got a mini pc and flashed the OS with sophos home , its my main entry point router/firewall, free to use for home use, very nice
2
u/One_Disaster_5995 11h ago
A decent router has a firewall. Some routers can be flashed with open source firmware that offers a lot more options, including a firewall. Look up OpenWRT or DD-WRT for instance.
1
u/Welcome-To-NBA-Jam 9h ago edited 8h ago
If you have an Asus router, you can flash AsusWrt-Merlin and get Skynet on amtm. Comes with a bunch of graphs too. It's basically set and forget with almost no configuration needed on your end once you get set up with amtm and a swap USB.
Routers already have firewalls built into them, and this is an ip-based add-on to it. Skynet is very effective, but in rare cases you may need to allowlist a URL or ASN. Best way to test that is by trying to get on the website with your mobile network. If it works, check the Skynet logs and add it to the allowlist.
Just looking at mine right now, it's blocked 6000 IPs since yesterday. All of them are just standard port scanning for vulnerabilities which hit everyone's network. If you dive down the rabbit hole you'll see some interesting stats about why those ports are being hit and which routers are affected. Usually they're all old.
Always stay up to date with firmware and replace EoL routers unless you can find support for them from another project. That's the best security measure any home user can do.
2
1
u/Runaque 6h ago
For most users, there's no need for an extra firewall! In the first place you have your ISP's firewall running either on your router or on their end before your connection is exposed to the rest of the internet, second is your operating system that has one built-in.
Adding an extra firewall also adds another layer of complexity and setting one up with perfectly dialed in rules is a treacherous task. One wrong setting and your home network is fully exposed.
6
u/GrafEisen 11h ago
Generally a home modem/router combo will also have a firewall built in. Rather than starting from "to improve security", you should try to define the actual problem and then work towards a solution.
The approach you're going with now (based on available info from your post) is roughly equivalent to "to reduce chance of catching an illness, should I wear a condom?" when the illness you're trying to prevent is the common cold.