KillerTic

joined 1 year ago
 

Hi everyone,

I have lost myself in the networking rabbit hole... Read quite a few posts, watched YouTube videos, ... So I thought I could share my plan here and get some feedback, if I am over complicating things.

I have pulled the trigger on a Unifi network and am waiting now on my delivery of my UDM SE, APs and L2 Switches. I wanted to take more control of my network and make it more secure. That being said, the most security will be reached, once I am enhancing my docker networks (which will be done at a later stage). This is setting up the basics.

Networks I want to introduce (Subnets and VLANs):

  • Networking (LAN)
    • Router, UDM, APs, ...
    • Anything network related should live in this network
  • Servers (LAN)
    • My NAS, Hypervisor, Pi, VMs, ...
  • Trusted (LAN/WLAN)
    • Main home network for PCs, Laptops, Tablets, Phones, ...
  • Media (LAN/WLAN)
    • TV, PS4, Alexa, Soundbar, ...
    • Reson not putting it on IOT or Trusted, I need the Guest network able to reach it and don't want them to reach my Trusted network. IOT I want to be quite limited.
  • IOT (WLAN)
    • Vaccum, Photovoltaics, ...
  • Guests (WLAN)
    • Anyone visiting

In the following diagram you can see my thoughts on how I intend to configure the Firewall. Who can talk to who...

Maybe this diagram is a little clearer:

https://preview.redd.it/siftt8ydro2c1.png?width=666&format=png&auto=webp&s=0d2e8fcd57d8ce45bcb0bc62e2bdaf71cd6d2213

Old diagram

https://preview.redd.it/qqfce2ii4o2c1.png?width=770&format=png&auto=webp&s=f99ad2bb5817386c723c3749a3418f0076783ba2

Is this overkill? Am I blind and missing something?

Looking forward to your feedback and criticism.

Edit: Indication if just LAN, WLAN or both
Edit2: Second diagram, which might be a bit clearer

[–] [email protected] 1 points 1 year ago

For sure not best practice, but I have a SMB share on my servers for the Docker folder and mount it on my dev machine.

Recently switched to a dev VM on my hypervisor, which has VSCode Server from Coder running. It also has the different shares mounted. Now I can VPN in from anywhere, switch on my dev VM and do whatever needs doing with my full environment available to me.

[–] [email protected] 1 points 1 year ago (1 children)

Personally I disagree. You might be running internal services you do not want to expose. It also is an active step to expose something. This way you are in control what is exposed and what isn’t.

[–] [email protected] 1 points 1 year ago

Exactly this. I remember how hard it was for me to start and how often I screwed up, felt uncertain, …

[–] [email protected] 1 points 1 year ago

Thank you very much. Means a lot coming from the creator of noted.lol!

Which reminded me, I always wanted to donate and just did so!

You are the reason I choose Ghost by the way and got quite a few inspiration from your articles! Thanks for that.

[–] [email protected] 1 points 1 year ago (3 children)

Wow… very narrow minded perspective you have. So you call me scum, but did you donate or did you consume my content for free? Lol (I know the answer as so far I did not receive donations)

I embrace new technology and as I wrote in my about section, I adopt GenAI for learning purposes. Because learning in real life use cases is how I learn best.

I am sharing knowledge for free, spend hours on writing these articles. If I would need to pay for the pictures out of my pocket, I would not make my content available.

I am happy to donate to people who spend time giving back to the community, I do not rely on donations, but if anyone is like me, I am happy to accept them!

GenAI is one of the biggest revolutions we habe seen so far. Get behind it or be left in the dust…

[–] [email protected] 1 points 1 year ago

Yeah and I went through it with thinking, let’s make it as secure as possible without 100% knowing the effect…

You need password auth for copying your key, don’t you. Unless you import it during the install…

[–] [email protected] 1 points 1 year ago (2 children)

Thanks for the advice!

Why would you leave PermitRootLogin to yes? Doesn’t really matter, if root ca nit login anyways?!

You are right on restarting sshd. That’s a typo…

An other user also mentioned to not fill out the root password and it will disable root + install sudo. Guess I didn’t read the instructions properly. Will definable be adopted.

I agree on importing from Github, but I am unsure how many people have their keys there…

UFW on a virtual machine might not be needed, but also not really harmful. I do like having in on every machine for piece of mind. Also this guide can be used for bare metal installs.

Crowdsec is on the todo list!

Thanks again. I will keep updating my article 😊

[–] [email protected] 1 points 1 year ago

All right, you got my attention 😂

Challenge accepted! (Some rainy day I got some time).

Thanks for that!

[–] [email protected] 1 points 1 year ago (2 children)

Honestly, when I tried it was like two years ago. I think back then I wasn’t experienced enough and was annoyed at some stage not being able to get docker to run.

I should give it another go. Would you just do it on RPi and a LXC container or also on your VM?

[–] [email protected] 1 points 1 year ago (1 children)

Thanks!

I saw the ed25519 keys sometime ago, but haven’t had time to understand it.

Will look into it and the link!

[–] [email protected] 1 points 1 year ago

Nice timing! Happy you found it exactly when you needed it

[–] [email protected] 1 points 1 year ago (5 children)

Just because I know it and I wanted something with as little bloat as possible.

Tried alpine once, could not get it running.

 

I am back with another published article.

Ideogram.ai: penguin in a server room covered in ice and snow, whole picture made out of green matrix style lines of code, cinematic

Please be kind! I am a self-taught Linux user and by no means an expert. My goal with this guide is to help newcomers to Linux have an easier and more secure start.

To all the experts out there, please be kind and do share your tips and observations. I am happy to keep updating the article to make the self-hosting world more secure.

https://nerdyarticles.com/debian-server-essentials-setup-configure-and-hardening-your-system/

view more: next ›