Set Up OpenWRT for Effortless, Secure Remote Access to All Your Devices — No VPN Needed
Integrating Flomesh ZTM with OpenWRT routers enhances network security and functionality, enabling secure access to internal services without the complexity of traditional VPNs or firewall setups.
Flomesh ZTM (Zero Trust Mesh) is an open-source, privacy-first decentralized networking solution that enables secure, seamless connectivity across various networks. It allows you to enforce Zero Trust security across your infrastructure, ensuring that only authenticated and authorized devices can communicate within your network. By integrating Flomesh ZTM with OpenWRT routers, you can significantly enhance your network’s security and functionality, enabling secure access to internal services without the complexity of traditional VPNs or firewall setups.
This guide will walk you through how to set up the Flomesh ZTM agent on OpenWRT and connect it securely to a Flomesh ZTM Hub. The ZTM Hub can either be deployed on AWS using a pre-configured AMI or installed manually on your own machine.
Why Use Flomesh ZTM with OpenWRT?
OpenWRT, a highly flexible and customizable open-source router firmware, provides the ideal foundation for integrating Flomesh ZTM. By combining these two technologies, you get several key benefits:
- Secure Remote Access: ZTM enables secure, encrypted communication for devices behind NATs or firewalls, allowing remote access to internal services without exposing them directly to the internet.
- Zero Trust Security: ZTM ensures that every device, user, and application is verified before any connection is allowed, significantly enhancing your network’s security posture.
- Service Discovery and Load Balancing: ZTM automatically discovers services in your network and balances the load, making your infrastructure more efficient and resilient.
- TLS-Encrypted Communication: All traffic between devices is encrypted, ensuring privacy and integrity of data across the network.
- Simplified Network Management: ZTM eliminates the need for complex VPN configurations or port forwarding, making it easier to manage remote access securely.
Step-by-Step Guide: Setting Up ZTM on OpenWRT
1. Install the ZTM Package on OpenWRT
To integrate Flomesh ZTM with your OpenWRT device, follow these steps to install the ZTM agent:
- Download the ZTM Package:
- Visit the Flomesh OpenWRT ZTM Releases page to download the appropriate package for your OpenWRT device.
- Transfer the Package to OpenWRT:
- Use SCP, FTP, or any file transfer method to copy the package to your OpenWRT device.
- Install the Package:
- SSH into your OpenWRT device and use either opkg or apk (depending on your system) to install the package.
- For opkg:
- opkg install /path/to/ztm-package.ipk
- For apk:
- apk add --allow-untrusted /path/to/ztm-package.apk
- Replace /path/to/ztm-package.ipk with the actual path of the downloaded package.
- Start the ZTM Service:
- To start the ZTM agent, use the following command:
- /etc/init.d/ztm_agent.init start
- Enable ZTM Service on Boot:
- To ensure that the ZTM agent starts automatically on boot, run:
- /etc/init.d/ztm_agent.init enable
2. Connect the ZTM Agent to the ZTM Hub
After successfully installing the ZTM agent on your OpenWRT device, it’s time to connect it to a Flomesh ZTM Hub. The ZTM Hub can be set up on AWS using the Flomesh ZTM AMI or installed on your own machine.
Option 1: Setting Up the ZTM Hub on AWS (Using the Flomesh AMI)
- Launch the ZTM Hub AMI on AWS:
- Go to the Flomesh ZTM AMI on AWS Marketplace and launch the AMI. Follow the instructions to configure and launch your instance.
- You’ll need to choose the correct instance type, configure security groups, and select an SSH key pair.
- Retrieve the ZTM Root Permit:
- Upon the first boot of your instance, a ztm-permit.json file will be generated in the /root/.ztm directory. This permit file is required to connect your ZTM agent to the ZTM Hub.
- SSH into the instance and retrieve the permit file:
- cat /root/.ztm/ztm-permit.json
- Save the Permit File:
- Copy the contents of the ztm-permit.json file. You will need this file when configuring the ZTM agent on OpenWRT.
Option 2: Setting Up the ZTM Hub Locally
If you prefer to set up the ZTM Hub on your own machine or server instead of using AWS, you can follow the official Flomesh ZTM documentation to install the ZTM Hub on a local instance (Linux, Docker, etc.).
3. Configure the ZTM Agent on OpenWRT
Now that you have the ZTM Hub set up (either on AWS or locally), it’s time to connect your OpenWRT device to it:
- Obtain the ztm-permit.json File:
- Copy the ztm-permit.json file you retrieved earlier from the ZTM Hub instance.
- Configure the ZTM Agent:
- On your OpenWRT device, configure the ZTM agent to use the ztm-permit.json file to authenticate and connect to the ZTM Hub. Replace localhost:7777 with the IP address of your OpenWRT device.
- The command should look like this:
- ztm join MESH_NAME --as EP_NAME --permit /path/to/ztm-permit.json
- MESH_NAME: This is the name of the mesh you want to join locally. It can be any name you choose.
- EP_NAME: This is the name of your endpoint that will be visible to other endpoints in the mesh.
- /path/to/ztm-permit.json: This is the path to the permit file you retrieved earlier.
Common Use Cases with ZTM on OpenWRT
With Flomesh ZTM integrated into your OpenWRT router, you can now securely access internal services, set up proxies, and enable secure remote connections:
- Secure Internal Services:
- Expose services like web servers or file-sharing tools to the outside world securely, without requiring complex port forwarding or VPN setups.
- Set Up a Secure Proxy:
- Use ZTM to route traffic securely between external clients and internal services, without exposing those services directly to the internet.
- Remote Desktop Access:
- Configure ZTM to access remote desktop services securely within your network, allowing you to manage devices remotely.
- Point-to-Site VPN Alternative:
- Although ZTM isn’t a direct replacement for traditional VPNs, it offers a lightweight and secure alternative to accessing internal resources without needing a full VPN setup.
Using Your ZTM Mesh
After connecting your OpenWRT devices to the ZTM Hub, you can manage your mesh effectively:
- Tunnel: Establish secure TCP/UDP tunnels between endpoints.
- Proxy: A SOCKS/HTTP forward proxy that routes traffic from one endpoint to another.
- Script: Execute PipyJS scripts remotely on an endpoint.
- Terminal: Remote access to the shell on an endpoint.
You can interact with your mesh via both CLI and GUI:
- If you prefer GUI, open your browser and point it to http://<OpenWRT-IP>:7777. You can join a mesh, find other endpoints, and manage applications directly from the browser. Almost all functionalities ZTM provides are available through both the CLI and the GUI.
Repeat the procedure for every endpoint you want to add to your mesh. Once completed, you’ll be able to manage your mesh via either the terminal or browser from any endpoint in the mesh.
To view and manage your mesh, use the following commands:
- Check mesh status:
- ztm get mesh
- List all endpoints:
- ztm get ep
Additional Resources
For advanced configurations and additional details, refer to the official ZTM Wiki. The wiki provides extensive documentation on setting up proxies, accessing remote desktops, and more.
By using Flomesh ZTM with OpenWRT, you can effortlessly integrate Zero Trust security across your network, providing secure access to internal services without the overhead of traditional VPN solutions. This combination is ideal for home labs, small businesses, or anyone looking to enhance their network security with minimal complexity.
<hr /><p>Set Up OpenWRT for Effortless, Secure Remote Access to All Your Devices — No VPN Needed was originally published in Flomesh on Medium, where people are continuing the conversation by highlighting and responding to this story.</p>