🛡️ CyberMind.FR — Infographic
SecuBox Lifecycle
From bare hardware to full mesh protection — every step of the SecuBox deployment pipeline, explained with emojis.
🔌
01
🔌
PLUG — Hardware Init
Physical Layer
Everything starts with the router hardware. Supported targets include ESPRESSObin, MochaBin, NanoPi, GL.iNet, and more across 16 architectures (aarch64, ARM, MIPS, x86-64…). Power on, connect UART for debug via PiDebugger, and you're ready.
🖥️
Choose Target Board
ESPRESSObin V7 🔥
MochaBin 10G 🍫
NanoPi R4S 📟
RPi4 🍓
GL.iNet 🌐
⚡
Power + Serial
12V DC → board
UART → PiDebugger
minicom 115200 8N1
🐛 Debug ready
🌍
Network Topology
WAN ← ISP 🏠
LAN → clients 💻
eth0/eth1 mapping
VLAN config prep
🏗️
16 Arch Targets
aarch64_cortex-a53
arm_cortex-a9
mipsel_24kc
x86_64 🖥️
📥
02
📥
CLONE — Fetch OpenWrt + SecuBox
Build System
Clone the official OpenWrt source and the SecuBox overlay repository. The build system compiles a custom firmware image with all 38 modules pre-configured, verified by PKG_HASH signatures.
🐙
git clone
openwrt/openwrt.git 📂
gkerma/secubox-openwrt 🛡️
feeds.conf setup
./scripts/feeds update
⚙️
make menuconfig
Target: armvirt 🎯
Subtarget: 64-bit
SecuBox packages ✅
LuCI + RPCD ✅
🔨
Compile
make -j$(nproc) 🚀
Cross-compile toolchain
PKG_HASH verify ✔️
Signed manifests 🔐
💾
Flash Firmware
sysupgrade.bin → 📡
dd / TFTP / web UI
First boot = vanilla
Ready for overlay 🧩
git clone → feeds update → menuconfig → make → firmware.bin → flash 💾
🧩
03
🧩
OVERLAY — SecuBox Identity
Configuration
The SecuBox local overlay transforms vanilla OpenWrt into a security powerhouse. Custom UCI defaults, LuCI apps, RPCD backends, and the secubox-ctl CLI — all layered on without modifying upstream code.
📁
/etc/secubox/
overlay.d/ configs 📋
UCI defaults applied
Network modes set
Identity injected 🆔
🎛️
secubox-ctl
enable / disable 🔘
status / sync 🔄
rollback / diag 🩺
Module lifecycle mgr
🌐
5 Network Modes
🔍 Sniffer (passive)
👁️ Passive monitor
📡 Access Point
🔗 Relay + WireGuard
🛡️ Router + Proxy
OpenWrt vanilla + SecuBox overlay + secubox-ctl = 🛡️ Armed Router
🌀
04
🌀
VORTEX DNS — Prevention Shield
×47 Multiplier
Vortex DNS is SecuBox's first line of defense — blocking threats at the DNS level BEFORE any connection is established. By sinking malicious domains, it stops malware, phishing, and C2 callbacks at the cheapest possible network layer. The ×47 vitality multiplier means each DNS rule prevents 47× more damage than a reactive firewall rule.
🌀
DNS
Block before connect
→
🧱
Firewall
Filter malicious IPs
→
🔍
WAF
Inspect requests
→
📡
Mesh
Share alerts P2P
→
✅
CLEAN
Safe traffic only
🚫
DNS Sinkhole
Malware domains → 🕳️
Phishing URLs → 🕳️
C2 callbacks → 🕳️
Ad trackers → 🕳️
📋
Blocklists Fusion
CrowdSec CTI feeds 🧠
Community lists 👥
Custom rules 📝
Auto-updated ⏰
⚡
Zero-Latency
Local DNS resolver 🏠
Cache = instant ⚡
No round-trip delay
Microsecond decisions
📊
Analytics
Blocked queries log 📉
Top threat domains 🎯
Per-client stats 👤
LuCI dashboard 📺
×47
Vortex DNS
pure prevention
×111
WAF Layer
request inspection
×N²
Mesh P2P
collective coverage
🌀 DNS × 🧱 FW × 🔍 WAF × 📡 Mesh × 📊 Monitor = SecuBox Defense
📦
05
📦
SERVICES — 38 Module Stack
Embedding
SecuBox embeds 38 modules across 9 categories directly into the router — each with its own LuCI dashboard, RPCD backend, UCI config, and procd service management. No external dependencies, no cloud required.
🔍Netifyd DPIsecurity · inspect
🌀Vortex DNSsecurity · dns
🧱nftables FWsecurity · firewall
🔑Auth Guardiansecurity · auth
👤Client Guardiannetwork · NAC
📊Netdatamonitor · metrics
🎬Media Flowmonitor · streams
🚦Traffic Shapernetwork · QoS
💾CDN Cachenetwork · proxy
🌐VHost Managerinfra · 19 templates
📶Bandwidth Mgrnetwork · 8 levels
🏠System Hubcore · unified
📡IoT Guardiot · isolation
38 modules · 9 categories · 31 active services · 0 cloud dependencies ☁️❌
📡
06
📡
MESH — MaaS Federation
×N² Network Effect
The final step: each SecuBox node joins the P2P mesh network via WireGuard tunnels, sharing threat intelligence and CrowdSec decisions in real-time. Every new node makes the entire fleet stronger — protection scales as N².
🔗
WireGuard Mesh
Auto-peering 🤝
Key rotation 🔑
Trust scoring ⭐
did:plc identity
🧠
Shared Intel
CrowdSec decisions 📤
Threat feeds sync 🔄
Blocklist fusion 📋
Real-time alerts 🚨
🚀
MaaS Deploy
Master → fleet push 📡
Config sync 🔄
Service landing pages
gk2.secubox.in 🌍
🔒
ANSSI Cert Path
CSPN certification 🏅
ENISA compliance ✅
Audit trail 📜
Sovereign security 🇫🇷
N nodes × N peers = N² protection 🛡️ — MaaS as a Service by CyberMind.FR