Help Securing Home Server reddit / selfhosted ---------------------------------------------------------------------- boop_xyz · 2023-09-28 17:24 Hi, I’ve been wanting a to invest in a home server for hosting development projects but also game servers. My main concern though is that my network will be vulnerable to attacks and my ISP would kick my ass, so I did some research for protections and one option was a VLAN, however I have no idea how to set one up and was wondering if I could get some guidance to keep my home network safe. Thanks! ---------------------------------------------------------------------- hardypart · 2023-09-28 18:14 You need a switch that supports VLANs, there are some very affordable options out there. ---------------------------------------------------------------------- boop_xyz · 2023-09-28 18:25 Any suggestions? ---------------------------------------------------------------------- rov3rrepo · 2023-09-28 18:52 This is a pretty good video that outlines some routers and other hardware you may need for VLANs https://youtu.be/lUzSsX4T4WQ?si=z_6v1wfi2gJ6nxhV ---------------------------------------------------------------------- L0g4in · 2023-09-28 19:15 First you probably want to bridge your ISP modem to rum your own Firewall/Security Gateway and router. Then I’d recommend implementing VLANs for trusted, untrusted and homelab devices. Then depending on what you aim to do with the server(s) I would recommend setting up a reverse proxy to serve your applications with https and avoid exposing open ports directly to the internet. I would recommed caddy, it is a very good beginner alternative. Other things you could play around with is your own DNS resolver in Pi.hole, your own streaming service with jellyfin and your own phishing training for family and relatives with GoPhish. Good luck! ---------------------------------------------------------------------- boop_xyz · 2023-09-28 19:34 Do you have a place that has information about this? I'm aware of pfsense but my question is mainly regarding to blocking potentially network invaders and preventing against DDOS attacks as I plan on hosting game and web servers ---------------------------------------------------------------------- apbt-dad · 2023-09-28 20:11 I use ubiquiti Edgerouter and their AP, that support VLANs. ---------------------------------------------------------------------- jmeador42 · 2023-09-28 20:16 A VLAN will not make your server less vulnerable to attacks. It will only help contain the damage to a particular subnet once something has been hacked. ---------------------------------------------------------------------- boop_xyz · 2023-09-28 20:32 How do I help make it more secure while not causing latency ---------------------------------------------------------------------- jmeador42 · 2023-09-28 20:53 At minimum, if you're hosting this out of your house, you're going to need some kind of firewall, a reverse proxy, and internal managed switches for VLAN isolation. ---------------------------------------------------------------------- boop_xyz · 2023-09-28 21:15 How would I setup a reverse proxy? ---------------------------------------------------------------------- kryptkpr · 2023-09-28 23:22 Keep server things inside root-less containers and only expose the ports required for your services via upnp or manual forwarding. It would take multiple layers of sandbox escape to make it out to your real network, not bulletproof but close to it. ---------------------------------------------------------------------- mpw-linux · 2023-09-29 00:19 Make sure you applications are secure. Maybe have a proxy server in front which will call your various apps. You are using Static Ip's ? You could have your proxy server on one machine and the apps on a local machine. Database/etc. on local machine. Make the proxy server as secure as you can. I don't think you need vlans. You can even use Tailscale on all the machines as 100.x.x.x ip's If it is just for friends then the proxy server can be only be accessed via 100 ips. Change ssh to another port then 22. You don't need an overly complicated setup for what you trying to do. ---------------------------------------------------------------------- boop_xyz · 2023-09-29 00:20 I know but I'm not sure how to do it ---------------------------------------------------------------------- mpw-linux · 2023-09-29 01:12 Not sure how to do what? Anyway start simple and work your way up. Anyway a GL.inet router runs Openwrt so you could have a subnet on that router which talks to your main ISP router. I use 1 GLinet router for about 4 computers that cannot be accessed accept via Tailscale ip's. Look into Tailscale vpn it is free and simple to setup. ---------------------------------------------------------------------- boop_xyz · 2023-09-29 01:13 How to setup proxies, what to specifically do, etc. ---------------------------------------------------------------------- CardboardLambo · 2023-09-29 03:31 Why not use a wireguard vpn? ---------------------------------------------------------------------- mpw-linux · 2023-09-29 04:17 It is not that the Reverse Proxy is hard it is that your apps need to call the proxy with its ip and also the ip of the server you want the proxy to send request to. look up some examples of how it works via Google. I used a Go proxy and Go apps that made http request to the proxy along with the destination ip. I had 1 machine as the proxy another as my database server and another server sending request and reply's to the proxy. The only internet facing server is the proxy all other machines are local. My system is just for home usage not corporate. ---------------------------------------------------------------------- ManiacMog · 2023-09-29 05:01 Look up Nginx Proxy Manager. It made setting up and maintaining reverse proxying quite easy for me, and it has a nice web GUI. Also, definitely put a firewall between your WAN and your reverse proxy (probably best you just setup a firewall for your whole network). In my setup I use pfSense as my home router and firewall. I ditched my ISP's router and plug the gigabit line right into my pfSense server, and I have two gigabit network ports where I route traffic to my home network. One route goes to my wifi access points and I treat that LAN as untrusted. The other route goes to all of my servers and I have higher security around it. I tightly control the traffic going into that LAN from either WAN or the untrusted/wifi LAN. On top of that all services are secured with MFA and any SSH connection can only be established using an SSH key, I've disabled password logins. You can do quite a bit to secure your network. Just depends on how far you want to take it. ---------------------------------------------------------------------- mrchem1911 · 2023-09-29 11:39 OPNsense will do this very easily ---------------------------------------------------------------------- jmeador42 · 2023-09-29 13:06 The assumption was that this is going to be publicly accessible. ---------------------------------------------------------------------- compuwar · 2023-09-29 14:02 VLANs are not a complete solution if you’re connecting to a server on more that one of them. Physical LAN seperstion is better, but it’s really easy to screw things up. Game servers are routinely compromised, especially Minecraft servers. Hosting services open to multiple people requires a lot of updating and trusting those people’s computer security. ---------------------------------------------------------------------- compuwar · 2023-09-29 14:05 You cannot add security without adding latency for anything that isn’t locally connected. Security requires something inspect and act upon traffic. That always takes more time than not doing that. ---------------------------------------------------------------------- CardboardLambo · 2023-09-29 15:31 Yeah that makes sense. Not having to set up each tunnel