The Network Layer

Your Device Firewall Has a Blind Spot

• Device firewalls see what your device thinks it's doing
  • They see the process, the destination, the port — they ask you to allow or deny
  • A rule you got wrong, an app that connected before the firewall loaded — the device won't tell you
• They see nothing from devices that can't run software
  • Your smart TV, printer, thermostat, game console — none of those have Little Snitch installed
  • Your guest's laptop, phone, or laptop — not your device, not your firewall, fully visible to you
• The network sees all of it — always
  • Every packet that leaves your LAN passes through one chokepoint: the router
  • One monitor at that chokepoint covers every device, no agents required, all the time
• Endpoint visibility vs network visibility — different questions
  • Endpoint: "did this app try to connect?" — reported by the device itself
  • Network: "what actually left?" — observed by something the device can't influence or hide from
• The network layer is also where you can block globally
  • DNS blocklists cut off entire categories of tracking for every device simultaneously
  • IP blocklists drop known malware infrastructure before any device completes a TCP handshake
• Your ISP router is not neutral
  • Consumer ISP routers report connected devices, DNS queries, and usage patterns upstream
  • Replace it with something you control — OPNsense — and the chokepoint becomes yours
• What you build here is independent of every device on your network
  • Works on smart TVs, IoT, guests, VMs, containers — anything that passes through the router

The Setup — Come Join My WiFi

[ Your Devices ]
  [ Guest Devices ]     ← "Everyone jump on my OpenWRT WiFi"
  [ IoT / Smart TV ]
         |
         |  (all traffic)
         ▼
  [ OpenWRT Access Point ]
         |
         |  (everything funneled here)
         ▼
  [ OPNsense Router / Firewall ]
    ├── ntopng        ← see everything
    ├── Suricata      ← flag the bad stuff
    ├── Unbound DNS   ← block at DNS level
    └── IP Aliases    ← block by IP list
         |
         ▼
  [ Your ISP / The Internet ]

• OpenWRT — the access point: manages WiFi radios, SSIDs, and VLANs at the edge
• OPNsense — the router and firewall: all policy, all monitoring, all security lives here
• ntopng — flow analyzer living inside OPNsense, sees every conversation across every device
• Suricata — IDS/IPS watching all traffic against known bad signatures and JA3 fingerprints
• Unbound DNS — the resolver that can block entire domains before they resolve to an IP
• IP blocklists — drop packets to/from known bad infrastructure at the firewall level, below DNS
• You don't need all of this at once — each layer adds visibility or protection independently

OPNsense and OpenWRT — The Two-Device Stack

ntopng — Network Traffic Monitoring

Reading ntopng — What to Actually Look For

Suricata — Intrusion Detection and Prevention

DNS Blocklists — Block It Before It Resolves

IP Blocklists — Drop the Packet at the Border

The Layered Defense Stack

• Each layer catches what the others miss — no single tool sees everything
• Stack them in order: device → DNS → IP → IDS → visibility
• Start with just OPNsense + DNS blocklists — that alone covers every device with zero per-device work
• Add Suricata in IDS mode next — tune for a week before switching anything to IPS/drop mode
• Add ntopng last — it's the visibility layer that shows you whether the blocking is working

What the Network Layer Catches That Devices Don't

• Your smart TV's full data diet — with no agent installed
  • Samsung, LG, Roku, Fire TV all phone home on a schedule regardless of any device-side setting
  • ACR (Automatic Content Recognition) fingerprints what you're watching and reports it to ad networks
  • DNS blocklist kills this for every TV on your network simultaneously — no configuration on the TV
• The connection that happened before the device firewall loaded
  • On boot, some apps connect before per-app firewalls initialize — the network sees it regardless
• Every device that joins your network — including guests
  • ntopng shows every device, every connection, including the ones you invited to the workshop
  • You have approximately zero privacy right now. Mwahahaha.
• IoT devices with no user-facing controls whatsoever
  • Smart plugs, bulbs, thermostats, printers — all calling somewhere, nothing you can configure
  • Many contact Chinese cloud infrastructure by default — DNS and IP blocklists cut this off silently
• Suricata catches the things that look normal but aren't
  • HTTPS traffic to a known malware C2 server on port 443 — looks like web traffic, JA3 says otherwise
  • DNS exfiltration: data encoded in subdomain strings — a2f3b1c9d.exfil.attacker.com — Suricata has rules
• The bigger picture — two different views
  • Device tools show what your devices think they're doing
  • Network tools show what's actually happening — you want both views simultaneously

Resources

Further Reading

• OPNsense documentation: docs.opnsense.org
• ntopng user guide: ntop.org/guides/ntopng
• Suricata rules writing: suricata.readthedocs.io
• Emerging Threats ruleset changelog — good reading for what is active in the wild right now