What's the point of a firewall in a homelab?
reddit / selfhosted

----------------------------------------------------------------------
mrpink57 · 2023-09-29 16:29

The usual purpose of a firewall is to deny all incoming traffic,
outgoing is allowed and incoming is allowed if outgoing was first
established.

A port forward is allowing incoming traffic on that specific port.

>I feel like I really am missing something, and I'm trying to
understand every possible aspect of security before possibly
portforwarding something

I suggest you do more research than just posting a question on reddit,
I suggest you start reading documentation about the purpose of a
firewall if you are this curious.

----------------------------------------------------------------------
DistractionRectangle · 2023-09-29 16:54

So... a couple things. People usually use one reverse proxy in front
of all their services (which you kinda have to if they're all on the
same host and you don't want to do iptables/nftables ~~f******~~...
magic on the router). The only thing keeping their local services
"local" is the lack of a public DNS record. But through the magic of
certificate transparency//enumeration, one can simply guess which
services might also exist on that host and craft a proper request from
the outside. Your reverse proxy will happily serve up the "local"
resource, unless you configure it not to.

Enter Access Control Lists (ACLs). ACLs are rules about who can access
a resource. E.g. if a service is only supposed to be local, it should
only be requestable from the IP block of the corresponding LAN. If
you're using namespaces, you can also whitelist/blacklist requests
from services on the same host (prevents lateral movement from a XSS
on a public service to a local service).

Which of course brings us to today's [relevant
xkcd](https://xkcd.com/742/).

Firewalls work in both directions. They can block both inbound, and
*outbound* traffic. This can help localize the damage if a
vulnerability against one of your public services allows an attacker
to get a foothold on the machine. It makes it more difficult to launch
attacks on other devices in the network (but not impossible, if they
can elevate their privileges the firewall on the host won't be that
helpful).

Which is why you should be considerate of your network topology. You
can use VLANs to segregate the public facing machine from the rest of
the network and limit its access to the internet and other VLANs.


tl;dr a dedicated firewall protects the device from the internet and
protects other devices on the network from the device, while
ACLs+firewall on the host help segerate services from eachother.

----------------------------------------------------------------------
jdblaich · 2023-09-29 17:20

Island hopping.

----------------------------------------------------------------------
cakee_ru · 2023-09-29 20:20

I use a firewall to separate virtual networks. my IoT devices and
guests connect to 2.4 network, it is considered unsafe and has no
internal access and devices can't discover each other - I call it PAN
(public area network). 5 ghz network and ethernet are on another LAN
(local area network) and have access to each other and internal
services.