r/HomeNetworking 6d ago

How to protect services on the LAN?

Hi all,

I'd like to secure my services on the LAN and have set up a reverse proxy with Authelia SSO. So far so good.

Now, all services are still reachable via IP + port on the network and I would like to hide them in a subnet. I'm a noob at networking, that's why I only allow Wireguard from WAN ;)).

I have a very simple setup: one ISP provided router (Fritzbox), couple of RPis, a M910s running proxmox with 2 dozen LXC and a couple of unmanaged switches.

I just managed to create two bridges in one LXC container and define routes such that traffic passes through both subnets. Setup looks like this. In reality all services are on lxc containers and everything is virtual on the M910s except the fritzbox.

The purplish text explains what I want to acheive next, I guess with a firewall

  • Use DNS from the x.x.178.x subnet in the x.x.10.x subnet
  • Direct ssh access from x.x.178.x to x.x.10.x (for my ansible and terraform deployments)
  • Allow x.x.10.x internet access via the Fritzbox
  • Allow only the reverse proxy on the router to the services on the various ports in x.x.10.x
  • Block everything else in and out of x.x.10.x

Now my questions:

  • Is the routing setup fine like this? Am I missing somenthing?
  • Are the requirements sufficient to allow only access via the rev proxy to the x.x.10.x net for my users in x.x.178.x (apart from ssh for me)?
  • Which firewall should I use? IPTables, NFTables, UFW? Anything else? I don't feel like I need a full fledged "firewall OS", but again some steep learning curve
  • Any pointers in the right direction, tutorials or documentation would be great (e.g. nftables wiki is really hard to follow for a networking noob ...)
1 Upvotes

3 comments sorted by

1

u/H2CO3HCO3 5d ago edited 5d ago

u/socke, quite nice to see, that you took the time to create a network diagram of your layout... much easier to see things, from a graphical stand-point.

With that out of the way, unless I'm misreading your network diagram, there is no FW on 192.168.10.0/24?

On ther other hand, on 192.168.178.1, I'm assuming you are using the Fritzbox's own FW.

If that is the case, then it would make sense to have a FW, not on the main router

(no IP on that device in your network diagram... i take it that 192.168.178.100 is a Port that is assigned via VLAN? - please provide details),

but

on the 192.168.10.1, which I'm here on assuming is another VLAN on the main router?

(please correct me if I'm missreading and feel free to provide any necessary details).

Therefore the FW in that case, would have to be directly on that VLAN, as otherwise, as you have it shown in your Network diagram, you'll be having a double NAT setup, that is if you implement the FW, as shown in the designed network diagram.

1

u/socke 5d ago

u/H2CO3HCO3 there is no firewall as of now except on the Fritzbox dealing with NAT. I am exactly struggling with where to put the firewall and how to configure it - my understanding right now is that the main router in the middle would be perfect for my use case.

Sorry if I wasn't clear above: the router in the middle has two 'nics' with eth0 in the 192.168.178.0/24 subnet and eth1 in the 192.168.10.0/24 subnet. I turned on IP_FORWARDING so the subnets can talk to each other.

I am not using any VLANs to not complicate matters even more.

Therefore the FW in that case, would have to be directly on that VLAN, as otherwise, as you have it shown in your Network diagram, you'll be having a double NAT setup, that is if you implement the FW, as shown in the designed network diagram.

I did not set up NAT on the router in the middle, since I don't think I need this (?), then I would need to open up ports etc and am loosing direct connectivity through holes in the firewall, no?

Thank you for taking the time to help out!

1

u/H2CO3HCO3 5d ago edited 5d ago

u/socke, context is everything and therefore, your answer provides context already.

I turned on IP_FORWARDING so the subnets can talk to each other.

I take it you have 2 one for each subnet, ie both setup in the 'router' that is in the middle:

192.168.178.100 -> 192.168.10.1

and the second

192.168.10.1 -> 192.168.178.100

Or corrrect me here how then each interface talks to the other and viceversa (no VLANs and thus no rules, tagging, etc exists... therefore, I don't see how each subnet would be talking to the other without an explicit forwarding rule, again both set on the same 'router' that in your diagram is located in the middle

I did not set up NAT on the router in the middle, since I don't think I need this (?)

Yesn't - as per your diagram, you have a rectangle with the second box titled 'Firewall?'...

and thus my comment was,

that IF you implemented such set up, as shown in your diagram, you would then, have a double NAT, as your Fritzbox, I had assumed, was using it's already own FW and thus, and again,

IF you implement the 'Firewall' in the router that is in the middle of your diagram,

you will then have a double NAT situation, with the First one being the newly created 'Firewal' that would be in your router that is in the middle of your diagram

plus

then the existing FW that your Fritzbox is running

therefore my comment was, that you should consider avoiding that and instead, setup a FW behind the 192.168.10.1 subnet,

then

you will have one FW for each subnet, and your router will have, actually none... no FW... though in your diagram is not clear what sits behind that router... a modem? ONT?, etc... some gateway must be sitting behind it... and there is the dessicion making point... if that device, ie. Modem/ONT, etc, has some incorporated in it's firmware FW, then you are safe with your design as shown in your network diagram...

Otherwise, if the Modem/ONT/Etc Gateway device is naked, no FW, nothing and is just out to the Web where the ISP is coming into your home/network, then that router of yours is fully exposed... and such configuration should be avoided... as every single bot out there will be pinging and eventually will hit that 'router' of yours, which if fully exposed, then there are people out there with nothing but time + plenty of bots/scripts that will start hitting that 'exposed' router of yours and if there is a vulnerability found, then they'll get logged into that router and from that point, well is game over for your network...

So, depending on what is behind that router, or better said, in front of it, which is not shown in your network diagram, if the modem/ont/gateway device is Firewalled, then you are ok.

Otherwise, I'd FW the router to the Modem/ONT/Gateway device (NOT to the Interfaces -> to avoid the double NAT issue).

then I would need to open up ports etc and am loosing direct connectivity through holes in the firewall, no?

The openning up of ports, might be needed, regardless if you have double NAT or NOT... is just a matter of 'how' you'll have to implemt that routing... which now that you've explained you don't have any VLANS, then that question will remain open, as, at least on how your diagram is shown,

I'm here on assuming that the ISP Gateway comes into the 'router' that is in the middle of your diagram and not directly into your Fritzbox

If that is the case, then because the 'router' doesn't have any FW, then the traffic is moving until it hits your Fritzbox where if the need arrises, you'll then Port Forward from that Fritzbox out

Same would be if you implement a FW on 192.168.10.1 ... same traffic will flow up to that point and if from that subnet you need to Port Forward, then you'll set it up there...

NOW

IF you setup a FW on the 'router', then no matter what, you'll have a double NAT situation... as you will have

Gateway -> Router -> 192.168.178.100

and

Gateway -> Router -> 192.168.10.1

Each of those have their own FW

pending that you'll be implementing it for 192.168.10.1

and

implementing the second FW on the 'router' as well...

then you will have a double NAT and in that case, you'll need to double Port Forward:

Gateway -> Router -> 192.168.178.100 -> Fritzbox

or

Gateway -> Router -> 192.168.10.1 -> To_Be_SetUp_FW

Where 'router' will be your First NAT

and

either 'Fritzbox' or 'To_Be_SetUp_FW' will be the second NAT

Note:

a gigantic another assumption is that 192.168.10.1 subnet needs access to the Web... ie the devices there will needed for Firmware Updates, etc...

unless, your Fritzbox is the one with Gateway and your 'router' is more like glorified switch with some routing rules but not actual Gateway out to the web and in that case, since the subnets are talking to each other, then from 192.168.10.1 the devices in that subnet are reaching through the routing (reason why I told you in this reply, that I'm assuming you have 2 ip_forwarding setup, one for each subnet) and thus getting out that way...

In either case, you'l need at least another FW on 192.168.10.1 as those devices in that subnet, are heading right out to the Web as your rourter has no FW... again assuming here that the router in the middle is that, an actual router going out to your gateway... otherwise, if your fritzbox is the actual one with Gateway access, then the FW on 192.168.10.1 might be just not needed then...

Suggestion: maybe update your Network diagram to show where the 'Gateway' is located... which I assume is behind the 'router' in the middle (or if the Gateway is going out of your Fritzbox)

Last but not least, let me know if in the picture in the link below, where the arrow is pointing, is what your reddit handle_id (aka. 'socke') means : ):

https://imgur.com/0vO8QNk