Need to isolate home network from self hosted setup reddit / selfhosted ---------------------------------------------------------------------- hidapun · 2023-10-09 01:36 I have just started selfhosting with a very basic setup. I have a nas setup and a p2p vpn (nord meshnet) to access that over internet via a raspberry pi. I want to isolate this from my home network which has a dvr , and other unsecured devices like printers and shared folders on computers. How can I achieve that? ---------------------------------------------------------------------- string-user-equals · 2023-10-09 01:48 VLANs my friend! The routing and switch config get complicated fast though FYI. And youll probably need a new router and a smart switch to accomplish it. If your router has a DMZ option that’ll do it too. ---------------------------------------------------------------------- hidapun · 2023-10-09 01:59 Thanks, will explore that ---------------------------------------------------------------------- therealblownie · 2023-10-09 03:46 If you are using Ubiquiti gear there is a very good detailed write up on how to do this via VLANs to segregate your traffic: https://github. com/mjp66/Ubiquiti/blob/master/Ubiquiti%20Home%20Network.pdf I am using this setup and it works great. ---------------------------------------------------------------------- youngsecurity · 2023-10-09 03:47 I agree VLANs are what are used to segment networks. You create the VLAN on a managed switch. You assign the VLAN to an access port and trunk ports. Then, you create a zone and VLAN on your security appliance and gateway and create the gateway IP for the VLAN. Add the VLAN to the Zone for security isolation. You then configure policies for only the traffic you want the VLANs to allow. If you allow everything, there is no point in doing network segmentation for security. You're building smaller, more secure, isolated networks to minimize the blast radius in case your network has an intrusion. You can look into OpenZiti to create dark services in overlay networks and avoid most of the physical network configuration, too. All the cool kids use software-defined networking. ---------------------------------------------------------------------- cmg065 · 2023-10-09 05:00 Document document document. Draw in out in ms paint or equivalent or write it down however you want but when you need to troubleshoot in a year and can’t remember everything it’ll save you loads of time. ---------------------------------------------------------------------- sowhatidoit · 2023-10-09 06:59 DMZ vs VLAN - do they have different use cases? ---------------------------------------------------------------------- cmdr_cathode · 2023-10-09 07:24 Carefuln with the DMZ options. Sometimes this is a weird misnomer for universal Port fowarding - quite the opposite of what you want to achieve. ---------------------------------------------------------------------- hidapun · 2023-10-09 07:48 Thanks for the detailed step by step, i am still reading about the vlan setup so this helps! ---------------------------------------------------------------------- hidapun · 2023-10-09 07:49 I am in a third world country and working with very basic network gear. But I appreciate your input. ---------------------------------------------------------------------- mirokra · 2023-10-09 08:09 That's why full config /export from MikroTik is so useful. Storing it in git (without passwords and keys). And, I even see the diff when updating things. ---------------------------------------------------------------------- mirokra · 2023-10-09 08:14 MikroTik offers great value (performance and features) for price. RouterOS has a steep learning curve, but probably not impossible for you, as you've already done self hosting. ---------------------------------------------------------------------- 0x947871 · 2023-10-09 08:17 I use macsec to cryptographically segment my main gear apart from LAN where all bad happens. Highly recommended. ---------------------------------------------------------------------- mirokra · 2023-10-09 08:40 I would recommend to learn basic about L2 and L3 of OSI model. L2 is broadcast domain, where each device can communicate directly with any of each other. Often, each LAN is assigned own subnet - range of IP addresses, such as 192.168.xx.yy/24 (one private network ranges). L3 is for communication in between LANs (broadcast domains), where each LAN has different subnet. This is called routing. You want your self-hosted setup to be separate on L2 - separate broadcast domains, but still want routing to internet, but want to block routing between self-hosted LAN and home LAN. This blocking of routing of all/certain traffic between all/certain L3 networks is called firewall filtering. This firewalling goes also beyond L3. Because, stateless firewall is needed to block packets for new incoming connections from WAN (internet) and self-hosted LAN (yours untrusted isolated LAN) to yours home LAN (sensitive things), but simultaneously allow to forward packets for existing established connections initiated from yours home LAN outside - the other way around. Otherwise, you wouldn't be able to use internet - machines asks for data, but response is dropped/blocked by firewall. The rules are defined by you (in capable router). VLANs just create multiple virtual LANs reusing the same physical equipment, without a need to have a separate switch for each LAN. But, L2, L3 and firewalling concepts stay the same, but complexity of physical setup is moved to complexity of configuration. I would recommend MikroTik routers, if you want to have full visibility and control over own network, and are on the budget. They are quite cheap for value - performance and features. However, steep learning curve, and very low level configuration. With cheap consumer routers. Firewall is present, but often it is fixed to do certain things with very little to zero amount of available options to set custom rules. So, you're limited by predefined abstractions in those. ---------------------------------------------------------------------- string-user-equals · 2023-10-09 13:48 Yes. A properly configured VLAN is equivalent to having 2 (or more) separate physical routers and 2 (or more) separate physical switches. In even the most strict compliance situations I’ve run into these would be considered fully segregated networks. A DMZ is a bit more vague. Some routers do a full VLAN for a DMZ and those are great. But I’ve also seen some routers try to do DMZ on the same subnet as the main LAN and control things via routing rules. I don’t trust that personally. In a DMZ you are essentially trusting your router provider how to properly segment your network for you. I personally wouldn’t trust that. ---------------------------------------------------------------------- hidapun · 2023-10-09 18:43 Thanks for the recommendation! Ill look into it ---------------------------------------------------------------------- hidapun · 2023-10-09 18:46 Thanks! This is great info. ---------------------------------------------------------------------- therealblownie · 2023-10-10 12:35 Do you have some old spare routers? If so you could try the 3 dumb routers architecture proposed by Steve Gibson (from Security Now podcast). More details here: https://pcper.com/2016/08/steve-gibsons- three-router-solution-to-iot-insecurity/ If you only have one router, depending on the model try searching on Google/YouTube for how to configure a Guest or dedicated IoT Wireless network using VLAN. If you are feeling adventurous then you could try installing OpenWRT firmware which has great forums that detail how to set this up with VLANs