Hosting on my network with pfsense and vlans reddit / selfhosted ---------------------------------------------------------------------- Ambitious_Tip_97 · 2023-12-03 22:28 Hello, I've been learning and making products to sell online, I've recently started to make a simple website using angular to host docs and usage guides for my products, I believe its almost ready to publish and I'm thinking of hosting it in a VM on my personal server in my local network I've read little about cloudflare tunnel but I'm wondering if my setup is enough I've been using pfsense and vlans for sometime, Plus I've been sharing my internet with 5 neighbours and a small cyber cafe for about 3 years and had no issues I'm aware of, But I've heared about VLAN hopping which made me afraid to proceed All vlans are only allowed to access the net, no rules to allow to talk to other vlans, Except for VLAN 0 which can talk to the rest of the vlans I'm also using Nod32 antivirus firewall on my VM with filtering mode set to "Policy-based" which I believe blocks/drops all traffic except what I allow But I'm not sure if these steps are enough to avoid vlan hopping, For now its not a big deal if my VM gets hacked, I'm mainly worried about the rest of the network, Will they be safe if I expose my Public IP? Is Pfsense enough to protect them? Is my vlan setup enough to protect against vlan hopping? Thanks! ---------------------------------------------------------------------- peterAtheist · 2023-12-03 23:43 As far as I know VLAN hopping is only a problem when there is a bleed in one of your networks. F.e. you plug a device in into [192.168.22.0/24](https://192.168.22.0/24) and expect a DHCP address in that range. But for some strange reason you get [192.168.23.35](https://192.168.23.35) ... Can happen if the VLAN on the switch (Trunk, (un)tagged, VLANs) is incorrectly configured Invest in a good switch, only allow admin on that switch via 1-port on 1 INTERNAL (management) network = A separate network from your LAN. My 2 cents - I hope you deploy on Linux or BSD and not Micro$hit IIS ---------------------------------------------------------------------- Ambitious_Tip_97 · 2023-12-04 02:31 Fortunately, I don't encounter unexpected IPs from DHCP, all are within the specified subnets I have sg200-50p from cisco and I believe its a good switch, the management port is in vlan 0 and Only my main pc is connected to vlan 0, Will probably remove it and use a device dedicated for management with no internet access As for the deployment, I'm still new in this field and will definitely consider your advice when I get there, Thanks! ---------------------------------------------------------------------- mosaati · 2023-12-04 06:54 Since pfsense is block first, nothing can communicate unless you have a rule that allow it to communicate. VLAN hopping is a valid problem, it can be mitigated with locked down ports with white-listed MAC addresses and vlan tags. I highly recommend that nothing is served on vlan0. It should be only for an admin station and network devices, you should not use the admin station unless you are performing admin activities, for every day activities you should be on another locked vlan as anyone else. I also highly recommend to enable IPS.