Hi selfhosters,
I’m considering improving the security of my homelab/server setup and I’d love to hear some more experienced opinions on my plans.
Like most self-hosters, I started out with a single-server setup: I cobbled together some old hardware, slapped on a NAS-style OS, bolted on Docker and started experimenting. As things go, my setup has grown a lot over the years. I’m running a lot on that machine - NAS capability, local DNS via pihole, a Wireguard VPN endpoint (so I can tunnel into the LAN from outside), many private services (accessible only from inside the LAN), but also some public ones accessible from the open web.
Although I’ve tried to do my homework in terms of security (various hardening measures for SSH and Docker, reverse proxy, proper SSL termination for everything), I realise I’ve put a lot of eggs in that one basket and I might want to introduce some network segmentation.
I don’t think I’m ready for getting a hardware firewall or a router/switch capable of VLANs just yet. What I’m considering, though, is putting my services available from the open internet on a separate server inside my network - a little Pi 5 I’ve still got lying around. My idea is that if a container on that is breached and if an attacker manages to escape the container to gain root access, compromise would be limited to the few of publicly available services I have on the Pi, thus limiting blast radius. If combined with (software) firewall rules that make the Pi a ‘pariah node’ (dropping all incoming connection efforts), lateral movement to other devices on the network could be contained.
An alternative would be to finally make the move to Proxmox. Everything would still be running on one physical machine, but I’d create several VMs: there would be one for private, one for publicly available services, and I’d firewall the latter off rigorously so it cannot connect to anything else.
I’d like your opinion on these plans. Which one would you recommend? Are they both sound, or is there anything I haven’t considered? Are there other (easy, non-hardware intense) things I could do to improve security even more?
I respect what you said about your own firewall, however I disagree with it! ISP modem/firewall’s are rarely if ever updated/upgraded. I thought I was fine without a hardware firewall until I started getting into some of my more darring adventures into home labbing. I was using DuckDNS for things, but decided I wanted to be able to do more so I needed a static IP. Luckily my ISP offers two static IPs for free so I got those.
I hope part of your hardening SSH is changing the port number! If you want to keep your LAN safer with a firewall, and something small like a pi zero (I use a pi zero 2), you can setup a honey pot vLAN. Again I realize you said not interested in a firewall, but I am saying a honepot helps.
Thanks for your input. It is correct that a lot of ISPs/consumer grade hardware is poorly maintained. Mine is a rare exception, however: I’m running an AVM FritzBox, which are somewhat famous for still receiving updates even after 10+ years on the market. They have only recently pushed a security update my way, so I’m good enough on that front - for now.
I shall consider a firewall in the future though.
I used to do that, but then realised that doing so will do very little. Scanning all possible ports is a matter of seconds, and SSH (unlike Wireguard) will signal to a potential attacker that it’s listening on port X instead of just remaining silent. In other words: in my eyes, it’s security by obscurity and will have very little effect.
What I have done to harden SSH is:
I have also tried out IP whitelisting (which may harden my setup against attacks from the LAN), but found it may be overkill for now. I might turn it back on just for shits and giggles.