Nothing fancy, old ubiquiti gateway with a dedicated pihole server for my DNS.
this post was submitted on 17 Sep 2025
82 points (100.0% liked)
Privacy
41882 readers
1077 users here now
A place to discuss privacy and freedom in the digital world.
Privacy has become a very important issue in modern society, with companies and governments constantly abusing their power, more and more people are waking up to the importance of digital privacy.
In this community everyone is welcome to post links and discuss topics related to privacy.
Some Rules
- Posting a link to a website containing tracking isn't great, if contents of the website are behind a paywall maybe copy them into the post
- Don't promote proprietary software
- Try to keep things on topic
- If you have a question, please try searching for previous discussions, maybe it has already been answered
- Reposts are fine, but should have at least a couple of weeks in between so that the post can reach a new audience
- Be nice :)
Related communities
much thanks to @gary_host_laptop for the logo design :)
founded 5 years ago
MODERATORS
Same. What's the deal with having elaborate firewall stuff for a normal family home anyway?
If the built in stuff isn't good enough then 99.9% of households would be compromised a long time ago already.
The last stats I remember reading cited some 1.5 million home networks are compromised on a daily basis. Some people, such as myself, run more complex services on their local servers that are perhaps tied into remotes such as VPS. You'll see a lot of selfhosters with rather elaborate firewall defenses set up. I self host a lot of services I use that the 'normal family home' would outsource to public entities. I have a rack in the closet and several VPS, so I need something more than just Windows Firewall, or similar, that I can dial in to my unique environment.
Also, because I can.
Valid! I also tinker with selfhosting using Docker containers, didn't think of firewalls the same way. Thank you.
No worries mate. What do you host?
Some of it is for fun and testing, learning. Which I used to do. I used to have an old watchdog that I put pfsense on, just don't need it nowadays.
Once i learn how it works and have run through the setup, I move on. Just need to spend my time in other areas, but now I have an understanding of it and can apply that logic or idea to other things and troubleshooting.
This is perfectly valid! I to a lot of tinkering with selfhosting using Docker containers, and I have learned a ton from that. I feel a bit silly that I didn't make the connection with firewalls - just tinkering for fun!
Opnsense on a thin client, riser with a quad port Intel NIC.
Pfsense guy here, and professionally Palo alto guy. Can someone tl;dr the purpose of blockerng and suricata? I thought I remember the Lawrence systems folks mentioning using it for IPS but with segmentation at home "human" IPS seems more relevant than digital
- Suricata: Open source IDS/IPS
- PfBlockerNG: Used to block ads, malicious content, and manage access based on IP geolocation and domain names. It provides features like DNS-based blocking
Some of the features of both overlap which might not be a bad thing.
I think I have the same protectli as you and it is awesome. Need it for my 2.5gb uplink. I use openwrt on it... Didn't really like opnsense. I am more used to linux than bsd.
I host lots of services and get bombarded by scrapers, scanners, and skids both at home and on my VPSs.
I use ipset for the usual blocklists which I download regularly. I also have tarpits on 22/tcp (endlessh). I pipe the IPs from the endlessh logs into fail2ban which feeds the ipsets. I have ipset blocks and fail2ban on my home firewall and all VPSs and coordinate over mqtt. So any fail2ban trigger > mqtt > every ipset block. Touch my 22/tcp anywhere and you get banned instantly everywhere. The program I use for this is called vallumd and it runs on openwrt.
I also put maltrail everywhere but I'm not totally sure how to interpret and respond to the results. Probably will implement a pipe from maltrail to my mqtt > blocklist setup.
I don't do any network-level adblocking... Might be a future project.
I think I have the same protectli as you and it is awesome
Yes it is. It was a little more than I wanted to spend, and I'm sure I could have gone with a cheaper configuration, but I figured I'd get something with a little ass to it as to not create a bottleneck right at the firewall.
I host lots of services and get bombarded by scrapers, scanners, and skids both at home and on my VPSs. Touch my 22/tcp anywhere and you get banned instantly everywhere.
I too host most of the services I use on a couple of VPS I run. It has always amazed me as to the thickness of the bot layer on the internet. Clearnet experiences something like 2+ zetabytes per 24 hours. Around 50% of that is bot traffic, and they are very sophisticated bots as well. Open port 22 and here they come by the thousands like a feeding frenzy. I went as far as blocking everything with hosts.allow (do first) & hosts.deny (do last). I've set f2b on aggressive mode with only one shot. LOL UFW rocks in the background along with Crowdsec. I probably go overboard with security. LOL
OpenWRT on a Linksys router, with adguard home for DNS blocking.
I used to run OPNSense on some older x86 hardware, but wanted to move to something simpler and less power hungry.
I use firewalld with a script that automatically updates a blocklist of known shady IPs.
I've been using Ufw but airvpn's kill switch seems to override it, should i be using something else?
I have found that a lot of VPN kill switches interfere with other security measures. For instance, I use tailscale on my VPS. I also run a local VPN. If I have the kill switch on the local VPN engaged, it interferes with tailscale and I cannot ssh in to my VPS. So, a not so elegant solution for me is to disengage the local VPN's kill switch for that session, and then re-enable it after I am finished administering my VPS. After which I will do a DNS leak check to make sure everything is as it was. Takes a couple of quick steps, but it seems to work.
nftables. Deny all, start adding stuff until þings work.
My firewalls are simple, b/c I run a private VPN and just shut off all traffic except over WG. I've got one exposed VPS reverse proxying services from oþer VPSes over WG.
But: nftables, and only nftables. I'm a big believer in understanding how stuff works, and þe rulesets created by firewalld and ilk are convoluted - complexity adds risk.
Haha, I thought that said "until pings work"
Also an accurate reading.
Rock on!
pfSense on this:
https://a.co/d/6WpafWQ
I also block outgoing port 53 only allowing my Pihole through.
I use Tailscale to access the network while away.
Do you run unbound on pFsense?
No my pfSense setup is fairly minimal
Opnsense on dedicated device, several built in filters + several github backed filters for unbounddns.
Haven't tested it heavily, but the times I am on an outside network not using VPN into my network, or using TOR, etc, i am inundated with ads... So i guess successful internally.
outside network not using VPN ........ i am inundated with ads…
I swear I do not know how the regular Joe Schmoe internet user deals with all that clutter. Sometimes I am called by a friend to look at their computer for some issue they are having. It is mind bogglingly frustrating for me.
OpenBSD pf
Edit: just home/hobby now, I’m not in tech anymore.
Also this. On some unremarkable HP office PC that's probably about a decade old. No ad filtering or anything as it interferes with others in the house. I've thought about trying a second unbound service with adblocking for me, but haven't gotten around to it.
No ad filtering or anything as it interferes with others in the house
Ahhh the WAF (Wife Aceptance Factor). I made a seperate Vlan for my lady friend so when she comes over to visit, I don't have to reinvent the wheel for her. She can have all the ads and slop she can stomach, just keep it on your seperate branch and we'll both be happy.
load more comments
(2 replies)
OpenBSD pf
I'd never heard of it so I went and checked it out. It seems to have a lot of pFsense/Opnsense features just managed from the cli. Cool.
It’s the ‘pf’ in pfSense.
pf is developed as part of the OpenBSD project and is the built in packet filter/firewall.
Show me what you got.
you're doing the same thing i am, so there's not point. lol
Yeah, but you got charts n' graphs and a big writeup. Nice job.
Opnsense with unbound DNS here. Running on an old PC that got converted to dedicated firewall (with added NIC card for ports). Nothing crazy, just enough to control what communicates out of my network.
Used to do the same thing with an old PC. Hell, at one time I was running one off a laptop with USB to RJ45 adapters for the WAN/LAN ports.
I run IPFire on a PC Engines apu4d4 (https://pcengines.ch/apu4d4.htm). I use dynDNS, WireGuard and set up a DMZ with it. I also have a WiFi card installed und use hostAPD to run that.
I think they stopped producing them because the AMD SOC they used is EOL. I was a big fan of their open platform.
My firewall varies from installation-to-installation, as it's always client-side with a custom DNS provider. Right now, I'm using YaST Firewall on my main machine, iptables on my old ThinkPad, and my other machines are currently between operating systems. In the past, I have also dabbled in ufw, pf, and awall.
In addition to that, I generally use NextDNS (though I also get excellent results with Mullvad DNS).
My policy is simple: reject all incoming connections, except for Torrent and Syncthing.
load more comments
(1 replies)
Hiding behind my firewalls. Shhhhh.
Sitting in my bunker
Hid behind my wall.....
In perfect isolation here behind my wall
Waiting for the worms to come
Nock nock, someone's home?
RST
Ubiquiti DM pro with its built in suricata. Honeypots, no remote mgmt, ACLs to minimum need, HA networks in isolation. DPI, multiple pi-holes. Phone alerts on intrusion wazuh just for node security compliance. ManageEngine for patches. NTFY alerts on console access.
It's not perfect
I run iptables on Debian, on a cheap aliexpress minipc with dual NICs. Been using more or less the same config for about five years. It’s simple, boring, and works great.
It’s simple, boring, and works great.
One cannot quibble with long term success. Admitidly tho, I am a sucker for a good UI. One of the first things I do when researching a piece of opensource software is to do an image search to see what it looks like. LOL
Same. Immeasurably disappointed whenever the repo for a GUI program does not include any screenshots.
OpenWRT.
I've always wondered about OpenWRT. In my uneducated thinking, running an access point/wifi, firewall, router, etc, all in the same package would create a bottleneck right at the point you wouldn't want it. What has been your experience?
Everything works fine. It's super handy having such fine control over my router.
view more: next ›