23
Feedback on Design and Firewall Options (lemmyf.uk)
submitted 9 months ago by OpenTheSeaLegs@lemmyf.uk to c/selfhosted@lemmy.world
20 comments fedilink hide all child comments

All the cool projects I see while lurking around here have thrown me into the world of Self-Hosting! Some months ago I got myself a NAS, flashed it with TrueNAS and started playing. Today, I am ready to face the creation of my first homelab.

Since I got the basic data storage working, I decided to continue with the Firewall setup. I’d like to have my security figured out before I start spinning up machines, playing with their configs and unwittingly opening all kind of arcane doors to the unknown. So I turn to the Fediverse!

I’d like to create the standard network with a DMZ. Within the network, I plan to use VLANS to manage traffic between devices, and the firewall to limit internet access.

This is a sketch of what I think I want to achieve:

Connections

  • The Consoles will connect only to the internet
  • The Home Devices (printers) will connect only to the Home WKS
  • There will be a NAS device hosting VMs with services accessible only from the home network:
    • The Home Automation will connect to IoT
    • The Recipes will connect to Home Wks
    • The Data Archive will connect to Home Wks
    • Jellybean will connect to:
      • Home Wks
      • TV
    • *arr Stack will connect to:
      • The Internet
      • the NAS (presumably Jellybean)
  • The Home WKS connect to pretty much anything

Available Hardware

  • OpenWRT compatible Router
  • 2.5gbs Unmaged Switch
  • 1gbs Unmaged Switch
  • QNAS with 2x2.5gbs NIC, running TrueNas
  • A few Rpis of different specs

Questions

Firewall

My Main questions relate to the Firewall. It seems that pfsense is the way to go for a SW Firewall:

  • What HW should i use? would a Raspberry pi 4, 4GB RAM work?
  • What do you think of Netgear 1100?
  • I like this device since 3ports would allow me to create a physically separate DMZ
  • Should I consider other firewalls?

NAS

For Bonus Points, some questions regarding the NAS:

  • With my current diagram, it seems like it is not possible for the NAS to receive updates from the internet. The obvious change is to place the NAS within the DMZ, but I’d like to keep the Data Archive as far from the net as possible
  • Should i locate the entire NAS in the DMZ?
  • My TrueNas has 2x2.5Gb ports. Can i connect each NIC to a different network? Would this have any benefit?

Thanks for your time!

you are viewing a single comment's thread
view the rest of the comments
[-] N0x0n@lemmy.ml 2 points 9 months ago

Great read thank you !

One technical question if you don't mind.

Maybe add a firewall rule that allows traffic from the NAS to the internet but not the other way around.

How does that work¿ I mean if the internet traffic isn't allowed to the NAS, how can the NAS get updates than?

[-] stown@sedd.it 4 points 9 months ago

Packets initiated from the NAS to the Internet are allowed. Packets initiated from somewhere on the Internet to the NAS are not allowed.

If the NAS requests files from a download server they will be allowed to come through the firewall because the files are a response to a request and not unsolicited traffic. I hope that makes sense.

[-] N0x0n@lemmy.ml 3 points 9 months ago

Ohhh, so if the NAS sends the request, the internet is allowed to send traffic, somehow through a virtual/temporarly port/tunnel.

I didn't knew it worked like that. Do you know what specific subject I need to investigate to learn more about how it works under the hood?

Thanks 👍🖐️

[-] Lcs_150@lemmy.world 4 points 9 months ago

Quick comment to give you a place to start searching; This is called a stateful firewall. Any modern firewall is stateful and tracks connections in a table. When it receives external traffic (packets) associated with a known established TCP connection, it allows that traffic through.

[-] med@sh.itjust.works 5 points 9 months ago

This is also true for UDP and ICMP connections, in case anyone reading wasn't sure. This is how you're able to ping stream and browse from behind your regular firewalls

[-] N0x0n@lemmy.ml 2 points 9 months ago

Thanks 👍

[-] TCB13@lemmy.world 2 points 9 months ago* (last edited 9 months ago)

Just note that by default ANY router is configured this way because they run NAT. Traffic originating from the local devices is forwarded to the internet while traffic originating from the internet isn't forwarded to local devices (unless it's a direct rely to a request initiated from a local machine).

I believe this is a good introductory article: https://devopscube.com/what-is-nat-how-does-nat-work/

[-] vividspecter@lemm.ee 1 points 9 months ago

Except for ipv6 (usually). Although most routers will block incoming traffic anyway by default.

[-] TCB13@lemmy.world 1 points 9 months ago

Yes, no NAT but the same end result.

[-] N0x0n@lemmy.ml 1 points 9 months ago

Thank you !

I do not know if this is different, but I do have some NAT configurations in my Wireguard setup, that forwards all traffic to a protonVPN free tier. I didn't came up with the rules by myself (found some good tutorial on the web)

# Accept sending and receiving on wg0
PostUp = iptables -A FORWARD -i %i -j ACCEPT; iptables -A FORWARD -o %i -j ACCEPT;

# Forward traffic to wg-ext
PostUp = iptables -t nat -A POSTROUTING -o wg-ext -j MASQUERADE;

# allow local network connections
PostUp = ip route add **REDACTED**/24 dev enp4s0;
PostUp = iptables -t nat -A POSTROUTING -o enp4s0 -j MASQUERADE;

Is this somehow related on how a router configuration looks like underneath? Or is that totally different?

Thank your for the link :)!!!

this post was submitted on 23 Jan 2024
23 points (100.0% liked)

Selfhosted

39677 readers
271 users here now

A place to share alternatives to popular online services that can be self-hosted without giving up privacy or locking you into a service you don't control.

Rules:

  1. Be civil: we're here to support and learn from one another. Insults won't be tolerated. Flame wars are frowned upon.

  2. No spam posting.

  3. Posts have to be centered around self-hosting. There are other communities for discussing hardware or home computing. If it's not obvious why your post topic revolves around selfhosting, please include details to make it clear.

  4. Don't duplicate the full text of your blog or github here. Just post the link for folks to click.

  5. Submission headline should match the article title (don’t cherry-pick information from the title to fit your agenda).

  6. No trolling.

Resources:

Any issues on the community? Report it using the report flag.

Questions? DM the mods!

founded 1 year ago
MODERATORS
ruud@lemmy.world
Loki@lemmy.world
CannaVet@lemmy.world
devve@lemmy.world
HybridSarcasm@lemmy.world
HybridSarcasm@lemmy.hybridsarcasm.xyz