Hi selfhosters,

I’m considering improving the security of my homelab/server setup and I’d love to hear some more experienced opinions on my plans.

Like most self-hosters, I started out with a single-server setup: I cobbled together some old hardware, slapped on a NAS-style OS, bolted on Docker and started experimenting. As things go, my setup has grown a lot over the years. I’m running a lot on that machine - NAS capability, local DNS via pihole, a Wireguard VPN endpoint (so I can tunnel into the LAN from outside), many private services (accessible only from inside the LAN), but also some public ones accessible from the open web.

Although I’ve tried to do my homework in terms of security (various hardening measures for SSH and Docker, reverse proxy, proper SSL termination for everything), I realise I’ve put a lot of eggs in that one basket and I might want to introduce some network segmentation.

I don’t think I’m ready for getting a hardware firewall or a router/switch capable of VLANs just yet. What I’m considering, though, is putting my services available from the open internet on a separate server inside my network - a little Pi 5 I’ve still got lying around. My idea is that if a container on that is breached and if an attacker manages to escape the container to gain root access, compromise would be limited to the few of publicly available services I have on the Pi, thus limiting blast radius. If combined with (software) firewall rules that make the Pi a ‘pariah node’ (dropping all incoming connection efforts), lateral movement to other devices on the network could be contained.

An alternative would be to finally make the move to Proxmox. Everything would still be running on one physical machine, but I’d create several VMs: there would be one for private, one for publicly available services, and I’d firewall the latter off rigorously so it cannot connect to anything else.

I’d like your opinion on these plans. Which one would you recommend? Are they both sound, or is there anything I haven’t considered? Are there other (easy, non-hardware intense) things I could do to improve security even more?

  • irq0@infosec.pubEnglish
    2·
    11 hours ago

    Containing lateral movement of a compromised machine is hard

    Before doing anything else , consider if you actually need to expose anything to the internet at all. Running a VPN would let you reduce your exposed service to 1 port ( wireguard is UDP based so it’s harder to test if the port is open too ). A VPN like NetBird / tailscale / Cloudflare warp don’t need you to open any ports at all

    Except for services that absolutely must be open to the internet ( like my Tor Relay ) I access everything via NetBird

    • LewdLemon@sh.itjust.worksOPEnglish
      1·
      1 hour ago

      Before doing anything else , consider if you actually need to expose anything to the internet at all. Running a VPN would let you reduce your exposed service to 1 port ( wireguard is UDP based so it’s harder to test if the port is open too ). A VPN like NetBird / tailscale / Cloudflare warp don’t need you to open any ports at all

      Good advice! Here’s my setup in more detail:

      • a good 90% of my services are “private”, i.e. they’re only accessible through Wireguard or from the LAN. I use local DNS + a reverse proxy to get “virtual” URLs + proper SSL termination within the LAN. Also, all administrative tools (e.g. SSH) are private (Wireguard or LAN only); none of them are publicly available.
      • some of my services (e.g. Nextcloud, Wireguard, RustDesk) are public so as to allow me to use collaboration and file sharing tools with others. For this I do expose some ports publicly.

      As you can see, I have mostly realised what you said. However, I don’t see myself setting up VPN connections for each and every user of my services and train them how to use them; link shares via Nextcloud or tech support via RustDesk need to be frictionless, so taking these services private isn’t an option.

      Yet if one of these public services were to be compromised and root access gained, I do see the risk of a (motivated) attacker to attempt lateral movement to get at the more sensitive services that I’m keeping local for a reason.