Should I run a sperate firewall? reddit / selfhosted ---------------------------------------------------------------------- simen64 · 2023-09-29 12:23 Hi I want to get into self hosting and this question is really simple. Should I get an old pc to run OPNsense as a router and firewall before I get a server? This would be to keep the server secure ofc. ---------------------------------------------------------------------- AmIBeingObtuse- · 2023-09-29 13:04 I have just pre-ordered a firewalla gold se. It will be my first hardware dedicated to being a router/firewall. I like the intrusion detection and prevention as well as the other advanced features. ---------------------------------------------------------------------- CrAzYmEtAlHeAd1 · 2023-09-29 13:07 Depends on what you want to do with your time! I set up my own router and even virtualized it. I’m looking to move it out of my virtualization server but it’s definitely been a great experience, but definitely a good amount of upkeep. In general I don’t have to touch it, but ya run into issue every now and again but it’s always been a decent learning experience overall! ---------------------------------------------------------------------- autisticit · 2023-09-29 13:35 You can run OPNsense virtualized with Proxmox. So I would advise you to do it before buying a dedicated machine to run it. ---------------------------------------------------------------------- CatOfTheDecade · 2023-09-29 13:38 Yes, especially if your alternative is to use your ISP's router + firewall combo. When I first slapped my OPNsense box behind my FIOS router+firewall, I was shocked at how much traffic the Verizon firewall was letting through *even though I had no rules allowing inbound traffic*. Consider getting something with at least three network ports. That way you can have one for your uplink, one for your home LAN, and one for your DMZ / self-hosted gear. Get a 4-port server and you can add another subnet for any IoT wireless gear you have. I use Protectli because I wanted a company I could reach out to for support if any issues arose, and I didn't trust the fly-by-night sellers on Amazon / Ali. ---------------------------------------------------------------------- torrent7 · 2023-09-29 14:41 Curious, why this over a UDM-SE? ---------------------------------------------------------------------- AmIBeingObtuse- · 2023-09-29 14:58 In all honesty I've never used any Ubiquiti products, so I don't have anything against it. I've been following the Firewalla community for a while and have been very impressed with it's ease of use and ease of setup. It looks like a great place to start my server setups journey and I may well look into Ubiquiti at some point. Hope this answers your question. ---------------------------------------------------------------------- opensrcdev · 2023-09-29 15:21 You don't necessarily need to. Whatever router you use should act as a firewall. ---------------------------------------------------------------------- Mastermind_Rey · 2023-09-29 15:31 just my 2cents - yes, having your own firewall is the way to go...and having dedicated hardware for a firewall is the easiest way to learn, as you can physically see, ie. cable to wan, cable to lan, you know vizualise traffic flow. but virualization is way more cost effecient, you could run pretty much everything you want to selfhost off of more or less 1 beefy box...but the learning curve is a little steaper, as its hard to visualise how everything is connected....that is unless you draw it all out on paper or something. if youre getting a Server anyways down the line, and you have an old pc collecting dust (I wouldnt spend money on an old PC :P). you could spin up a quick OPNSense box and have it in place now and later on down the road when you get that server, transfer the config, or P2V the box later. ---------------------------------------------------------------------- puppetjazz · 2023-09-29 15:55 If your just getting started with firewalls, I would recommend UFW. It's easy to learn and a great introduction imo. ---------------------------------------------------------------------- kearkan · 2023-09-29 16:14 To add to this. Practice with it on a VM, then move to hardware. You don't want proxmox going down to take down your whole network. ---------------------------------------------------------------------- HotNastySpeed77 · 2023-09-29 16:24 I like to delineate between my critical infrastructure and services. The first is basic Internet connectivity for the household - everybody relies on it, and you want it to just work. For this reason, I use a commercial router/firewall device and a WiFi mesh system. Services are a different story - I fiddle with my servers, containers, and VMs constantly. I'm generally the only user of my services, so it's OK if/when something gets broken. You have to decide how much you want to intermingle your critical infrastructure and your services. ---------------------------------------------------------------------- Puzzleheaded_Nose_38 · 2023-09-29 17:22 Maybe pricing? ---------------------------------------------------------------------- PaulEngineer-89 · 2023-09-29 17:48 A typical single board PC like a Pihole should push 20-40k packets per second. At 1500 bytes per packet that’s 30-60 MBps or 240-480 Mbps assuming minimal load. So if you have a cable modem you are good to go but if you have fiber or satellite or something else faster then a small single board computer or desktop server or PC becomes necessary if you want to run a file system, resync server, video server, or similar loads. ---------------------------------------------------------------------- slyzik · 2023-09-29 18:33 if you use a cloudflare tunnel/tailscale vpn you might use any firewall. If you want to open some.ports, NAT, vlans, some more complicated network i would get opense/pfssense. ---------------------------------------------------------------------- jah_bro_ney · 2023-09-29 18:42 1. Pricing 2. Security - How Ubiquiti dealt with their 2020 hack and their failure to disclose it to customers before sensitive user data was leaked left a really bad taste in people's mouths. 3. Features - pfSense and OpnSense both have more features than the Unifi controller ---------------------------------------------------------------------- HTTP_404_NotFound · 2023-09-29 19:21 As I just responded to basically this exact question- Please- check my comment here. It might shed some light on your decision making process. https://www.reddit.com/r/homelab/comments/16vfyu6/comment/k2r7ljg/?utm \_source=share&utm\_medium=web2x&context=3 ---------------------------------------------------------------------- dflahaut · 2023-09-29 20:07 You should try IP Fire (https://www.ipfire.org). For me the best choice. ---------------------------------------------------------------------- niceman1212 · 2023-09-29 20:29 I would worry more about hardware failing than proxmox shitting the bed ---------------------------------------------------------------------- ImagineAllTheKarma · 2023-09-29 20:38 Is there a reason the DMZ/self-hosted gear need their own port on the router? I have mine just setup as VLANs with the switch ports configured ---------------------------------------------------------------------- CatOfTheDecade · 2023-09-29 21:38 VLANs should be fine. I personally prefer physical isolation. ---------------------------------------------------------------------- ecker00 · 2023-09-29 21:53 Virtualized in proxmox works great in my experience, a few times I've bricked the configs and so nice I can just restore a snapshot or backup with a click! ---------------------------------------------------------------------- ecker00 · 2023-09-29 21:54 Benefit of virtual is easy snapshots, backup and restore when you mess something up. Saved me plenty ---------------------------------------------------------------------- chrissie_brown · 2023-09-29 22:52 old pc is always a waste of power consumption. if you really want, try opnsense, ipfire or else on a small, less power consumptin hardware. there are many platforms available. it is always a good idea, to run a firewall on a separate device. because in case of an attack, it targets only this device and not the rest of your infrastructure. but YMMV. I run fli4l back in the days on an old x486, just attached a picture for provement :) [https://ibb.co/pZWNHTs](https://ibb.co/pZWNHTs) Yes i am this old. ---------------------------------------------------------------------- codecarter · 2023-09-29 23:41 i second that! I run 5 linux containers in a vm using vmware workstation. ---------------------------------------------------------------------- fuzz_64 · 2023-09-30 00:16 What are you looking to host? I just have web servers available on the internet but access everything else from internally (a secure tunnel if I'm away from the house). I use CloudFlare as primary line of security so i don't have to expose my IP address or any ports to the internet. ---------------------------------------------------------------------- magnumopus44 · 2023-09-30 01:46 I run proxmox however my firewall is a separate dell poweredge r210. That thing is bullet proof. While you can virtualise it having a dedicated unit is so much better because you can pay with proxmox host without having to restart the firewall. ---------------------------------------------------------------------- Railgunning · 2023-09-30 03:41 You can also cluster Proxmox and have your router fail over. As long as you keep your NIC configuration consistent between nodes, and trunk the same VLANs on your switch, this can be a neat way to have part of your networking be HA. ---------------------------------------------------------------------- netczar · 2023-09-30 05:17 Buy a Mikrotik. Powerful, cheap as chips to buy and run and super configurable. Big support community as well. ---------------------------------------------------------------------- TheHellSite · 2023-09-30 05:41 Have a simple backup router in place and that is no issue at all! It is for home use not business. This argument always comes up and is pretty much of no importance most of the time. ---------------------------------------------------------------------- ImFromBosstown · 2023-09-30 12:44 What does this have to do with anything? ---------------------------------------------------------------------- ImFromBosstown · 2023-09-30 12:50 This is the way ---------------------------------------------------------------------- codecarter · 2023-09-30 17:59 the benefits of running virtual as stated by user ecker00 above ---------------------------------------------------------------------- ImFromBosstown · 2023-09-30 18:35 You wouldn't run opnsense in workstation lol