16
Uncomplicated firewall rule set for a *arr stack.
(lemmynsfw.com)
you are viewing a single comment's thread
view the rest of the comments
view the rest of the comments
this post was submitted on 10 Feb 2024
16 points (86.4% liked)
Selfhosted
37737 readers
370 users here now
A place to share alternatives to popular online services that can be self-hosted without giving up privacy or locking you into a service you don't control.
Rules:
-
Be civil: we're here to support and learn from one another. Insults won't be tolerated. Flame wars are frowned upon.
-
No spam posting.
-
Posts have to be centered around self-hosting. There are other communities for discussing hardware or home computing. If it's not obvious why your post topic revolves around selfhosting, please include details to make it clear.
-
Don't duplicate the full text of your blog or github here. Just post the link for folks to click.
-
Submission headline should match the article title (don’t cherry-pick information from the title to fit your agenda).
-
No trolling.
Resources:
- awesome-selfhosted software
- awesome-sysadmin resources
- Self-Hosted Podcast from Jupiter Broadcasting
Any issues on the community? Report it using the report flag.
Questions? DM the mods!
founded 1 year ago
MODERATORS
What's your actual end goal? What are you trying to protect against? Do you only want certain systems on your network to be able to access your apps? There's not really much of a point of a firewall if you're just going to open up the ports to the whole network.
If you want it to be more secure then I'd close all the ports except for 22 (SSH) and 443 (HTTPS), stick a reverse proxy in front of everything (like Nginx Caddy, Traefik, etc), and use Authentik for authentication, with two-factor authentication enabled. Get a TLS certificate using Let's Encrypt and a DNS challenge. You have to use a real domain name for your server, but the server does not have to be publicly accessible - Let's Encrypt works for local servers too.
The LinuxServer project has a Docker image called "SWAG" that has Nginx with a bunch of reverse proxy configs for a bunch of common apps. Might be a decent way to go. The reverse proxy should be on the same Docker network as the other containers, so that it can access them directly even though you won't be exposing their ports any more.
Authentik will give you access controls (eg to only allow particular users to access particular apps), access logs for whenever someone logs in to an app, and two-factor auth for everything. It uses OIDC/OAuth2 or SAML, or its own reverse proxy for apps that don't support proper auth.
Just trying to keep outside/malicious actors from entering my stuff while also bring able to use my stuff. More safer is more better, but I'm trying to balance that against my poor technical ability.
My priority list is free>easy>usable>safe. Using UFW seemed to fit, but you're right, punching holes in it defeats the purpose Which is why I wanted to only allow local network and have only the necessary ports open. You have given me lots of terms to Google as a jumping off point so thank you.
VPN back into your network. Only open the VPN port on your router. Use certificates based VPN.
The guy above you gives great advice. Set up SWAG, then the only ports you're exposing are 443.
Once you have that set up, look at adding something like authelia. This will give you 2FA on top of those apps meaning even if someone guesses the password and the URL to access them, they still won't be able to.
I used to use Authelia, but Authentik is nicer since it's mostly configured through a web UI. It also supports SAML for services that don't support OpenID Connect. It also has a proxy mode like Authelia, but that's not recommended if the service has proper SSO support. There's just a bit of an initial learning curve.
Yeah honestly either solution is a solid one