Securing my network reddit / selfhosted ---------------------------------------------------------------------- conrat4567 · 2023-11-20 22:35 Hi, I apologise if this isn't the right place to ask for advice or if I come across as stupid. I work in IT and have started to run my homelab. It's mainly local stuff like a NAS and media server but I do have a Home assistant instance running. I was always a hardware guy but with my role growing I felt I needed to learn about networking and how a network runs services on the Internet. I own a domain and use NGINX to point to my HA box. Cloudflare points my domain to my local IP via plugin that watches for changes as I understand it. Currently Home assistant and NGINX are open on my router but I'm pretty sure I made them open only to the two static IPs running my services. Cloudflare seems to mask my local IP when pinging my domain but I'm sure there are ways around it. I want to eventually run a Minecraft server and a few other bits as a hobby but I'm conscious of the security risk of opening up ports and exposing my servers to the Internet. Is there a way I can secure my network even more? Am I doing this wrong? Again I apologise I'd this is the wrong place or I come off as stupid. While Networking and Hardware are my specialty at work, the buck stops at the router ---------------------------------------------------------------------- No_Dragonfruit_5882 · 2023-11-20 23:01 If you can use VLAN's. Setup a vlan and put the Services your exposing in there. Create a Firewall rule that blocks access from the vlan into your homenetwork that way port forwarding should not be any issue. I would not run any exposed Service even with cf tunnel without separating the Networks, since if any Services you are exposing has a zero day or any other vun. Then it will compromise your home network. ---------------------------------------------------------------------- Cevap · 2023-11-20 23:14 I would like to learn more about this type of setup. Any tips or diagrams I can look up? Would appreciate thank you ---------------------------------------------------------------------- No_Dragonfruit_5882 · 2023-11-20 23:26 Depends on your Router / Firewall. Most homeuser Routers do not Support vlan. Most people in here use pfsense / opnsense for networking. ---------------------------------------------------------------------- conrat4567 · 2023-11-20 23:41 Thank you for your reply. 😁 That's not me, but yes, I do understand VLANs, we use them at work but slowly moving to a flat network with different subnets to split everything up. I have switches that support VLANs, but I would have to brush back up on it. Only my main work network is split up into VLANs. Everything else is flat. I plan on upgrading my router anyway, so it's something I can look into. ---------------------------------------------------------------------- No_Dragonfruit_5882 · 2023-11-20 23:46 Bruuuhhh. Iam soo sorry man. Didnt look at the Name..... If you need help with anything regarding networking / what Firewall to use etc feel free to either DM me or write here. Some other steps to keep your network safe are: Ratelimiting => Helps against bruteforce attacks Something like Crowdstrike (better than fail2ban) => Blocks attacks based on a pretty big database of ips Always use the latest Software Versions and update the OS => Security patches get installed Use Geoip Blocking => Blocks people from countrys that dont need to access your Services ---------------------------------------------------------------------- Ariquitaun · 2023-11-21 00:36 Use vlans to create a dmz you can place a server only for public Internet facing stuff. ---------------------------------------------------------------------- Still-Snow-3743 · 2023-11-21 02:19 One thing nobody has mentioned here, I run all my services as a docker container. It makes them very easy to back up, and very easy to segregate. If a service gets compromised, in theory, it's isolated to what it can access inside the docker container and can't compromise the host. And if you delete and rebuild the container, any damage done in the container dies with it. Running home assistant with docker is as simple as the command: sudo docker run -d \\ \--name homeassistant \\ \--restart=unless-stopped \\ \-e TZ=America/Chicago \\ \-v $(pwd)/homeassistant:/config \\ \--network=host \\ homeassistant/home-assistant There is of course, more details to learn and the devils are in the details, but thankfully anything you want to know on how to set up your network in this regard you can just ask chatgpt. ---------------------------------------------------------------------- conrat4567 · 2023-11-21 09:39 Thank you. VLANs seem to be the common consensus. Time to play around with my switches lol ---------------------------------------------------------------------- conrat4567 · 2023-11-21 09:42 Thank you, I may take you up on that if I get stuck. Blocking by country seems like a good idea but I worry if some of my inbound traffic for services comes from some of those countries. I know that one of my sensors contacts a server in china, I know its legit to some extent. Vlans seem to be the biggest one mentioned so I will look in to that first I think. Isolation seems to be the best security method. Everything I have is up to date and backed up ---------------------------------------------------------------------- conrat4567 · 2023-11-21 09:45 You can ask Chat GPT? That I did not know lol. Thanks for this. My NGINX is running in a container as well as the Cloudlfare plugin but my HA has its own server. A bit overkill but its just to future proof as I plan on automating a lot and having a NUC dedicated to that seems sensible. ---------------------------------------------------------------------- No_Dragonfruit_5882 · 2023-11-21 10:27 You can aways allow a list of ips from China even tho all other connections are blocked. You can block parts of a country aswell ---------------------------------------------------------------------- Still-Snow-3743 · 2023-11-21 11:08 Oh dude, yeah ChatGPT knows Linux and docker better than I do and I've been doing this sort of thing professionally for 15 years, lol. Whatever you need as far as writing scripts, invoking containers, or generally asking it questions, you can just consider it an expert network administrator and it can write all your scripts and whathaveyou. One of the best moments this year was when I realized I never had to figure out how to write an iptables command again lol ---------------------------------------------------------------------- jrwren · 2023-11-21 22:07 > Is there a way I can secure my network even more? Am I doing this wrong? The answer to this is always yes, until you get to the point where you no longer have a network, because you have nothing, because the most secure thing is the thing which does not exist. ---------------------------------------------------------------------- Ariquitaun · 2023-11-21 23:22 Careful not to go blind