Selfhosted

39276 readers

200 users here now

A place to share alternatives to popular online services that can be self-hosted without giving up privacy or locking you into a service you don't control.

Rules:

Be civil: we're here to support and learn from one another. Insults won't be tolerated. Flame wars are frowned upon.
No spam posting.
Posts have to be centered around self-hosting. There are other communities for discussing hardware or home computing. If it's not obvious why your post topic revolves around selfhosting, please include details to make it clear.
Don't duplicate the full text of your blog or github here. Just post the link for folks to click.
Submission headline should match the article title (don’t cherry-pick information from the title to fit your agenda).
No trolling.

Resources:

Any issues on the community? Report it using the report flag.

Questions? DM the mods!

founded 1 year ago

MODERATORS

[email protected]

Feedback on Design and Firewall Options (lemmyf.uk)

submitted 8 months ago by [email protected] to c/[email protected]

1 comments fedilink hide all child comments

All the cool projects I see while lurking around here have thrown me into the world of Self-Hosting! Some months ago I got myself a NAS, flashed it with TrueNAS and started playing. Today, I am ready to face the creation of my first homelab.

Since I got the basic data storage working, I decided to continue with the Firewall setup. I’d like to have my security figured out before I start spinning up machines, playing with their configs and unwittingly opening all kind of arcane doors to the unknown. So I turn to the Fediverse!

I’d like to create the standard network with a DMZ. Within the network, I plan to use VLANS to manage traffic between devices, and the firewall to limit internet access.

This is a sketch of what I think I want to achieve:

Connections

The Consoles will connect only to the internet
The Home Devices (printers) will connect only to the Home WKS
There will be a NAS device hosting VMs with services accessible only from the home network:
- The Home Automation will connect to IoT
- The Recipes will connect to Home Wks
- The Data Archive will connect to Home Wks
- Jellybean will connect to:
  - Home Wks
  - TV
- *arr Stack will connect to:
  - The Internet
  - the NAS (presumably Jellybean)
The Home WKS connect to pretty much anything

Available Hardware

OpenWRT compatible Router
2.5gbs Unmaged Switch
1gbs Unmaged Switch
QNAS with 2x2.5gbs NIC, running TrueNas
A few Rpis of different specs

Questions

Firewall

My Main questions relate to the Firewall. It seems that pfsense is the way to go for a SW Firewall:

What HW should i use? would a Raspberry pi 4, 4GB RAM work?
What do you think of Netgear 1100?
I like this device since 3ports would allow me to create a physically separate DMZ
Should I consider other firewalls?

NAS

For Bonus Points, some questions regarding the NAS:

With my current diagram, it seems like it is not possible for the NAS to receive updates from the internet. The obvious change is to place the NAS within the DMZ, but I’d like to keep the Data Archive as far from the net as possible
Should i locate the entire NAS in the DMZ?
My TrueNas has 2x2.5Gb ports. Can i connect each NIC to a different network? Would this have any benefit?

Thanks for your time!

top 1 comments

sorted by: hot top controversial new old

[–] [email protected] 1 points 8 months ago* (last edited 8 months ago)

If you've an OpenWRT compatible router why are you thinking about pfsense? There isn't much to gain there, your OpenWRT will do NAT and also has a firewall.

I like this device since 3ports would allow me to create a physically separate DMZ

OpenWRT can do this as well. What are your plans with the DMZ tho?

Be careful with the use of the acronym DMZ as in the context of typical routers and ISPs it has a different meaning of what you're implying here. DMZ usually is used in the context for a single host that is "outside" the ISP router's firewall and all requests coming into the ISP router will be forward to that device.

With my current diagram, it seems like it is not possible for the NAS to receive updates from the internet.

You NAS will never "receive updates" it will ask for updates. Maybe add a firewall rule that allows traffic from the NAS to the internet but not the other way around (this is usually the default state of any router, it will allow local devices to go to the internet but not incoming connections to those devices).

My TrueNas has 2x2.5Gb ports. Can i connect each NIC to a different network? Would this have any benefit?

You can, but is it really worth it? If someone hacks the device they'll access the rest of the network. Same applies to your computers and cames consoles, they can be used to jump to the other side and vice versa.

Frankly I don't see the usefulness of your setup as you'll end up with weak points somewhere. Just get a single OpenWRT router and throw everything into the same network. Apply firewall restrictions as needed.