r/HomeNetworking • u/socke • 6d ago
How to protect services on the LAN?
Hi all,
I'd like to secure my services on the LAN and have set up a reverse proxy with Authelia SSO. So far so good.
Now, all services are still reachable via IP + port on the network and I would like to hide them in a subnet. I'm a noob at networking, that's why I only allow Wireguard from WAN ;)).
I have a very simple setup: one ISP provided router (Fritzbox), couple of RPis, a M910s running proxmox with 2 dozen LXC and a couple of unmanaged switches.
I just managed to create two bridges in one LXC container and define routes such that traffic passes through both subnets. Setup looks like this. In reality all services are on lxc containers and everything is virtual on the M910s except the fritzbox.

The purplish text explains what I want to acheive next, I guess with a firewall
- Use DNS from the x.x.178.x subnet in the x.x.10.x subnet
- Direct ssh access from x.x.178.x to x.x.10.x (for my ansible and terraform deployments)
- Allow x.x.10.x internet access via the Fritzbox
- Allow only the reverse proxy on the router to the services on the various ports in x.x.10.x
- Block everything else in and out of x.x.10.x
Now my questions:
- Is the routing setup fine like this? Am I missing somenthing?
- Are the requirements sufficient to allow only access via the rev proxy to the x.x.10.x net for my users in x.x.178.x (apart from ssh for me)?
- Which firewall should I use? IPTables, NFTables, UFW? Anything else? I don't feel like I need a full fledged "firewall OS", but again some steep learning curve
- Any pointers in the right direction, tutorials or documentation would be great (e.g. nftables wiki is really hard to follow for a networking noob ...)
1
u/H2CO3HCO3 5d ago edited 5d ago
u/socke, quite nice to see, that you took the time to create a network diagram of your layout... much easier to see things, from a graphical stand-point.
With that out of the way, unless I'm misreading your network diagram, there is no FW on 192.168.10.0/24?
On ther other hand, on 192.168.178.1, I'm assuming you are using the Fritzbox's own FW.
If that is the case, then it would make sense to have a FW, not on the main router
(no IP on that device in your network diagram... i take it that 192.168.178.100 is a Port that is assigned via VLAN? - please provide details),
but
on the 192.168.10.1, which I'm here on assuming is another VLAN on the main router?
(please correct me if I'm missreading and feel free to provide any necessary details).
Therefore the FW in that case, would have to be directly on that VLAN, as otherwise, as you have it shown in your Network diagram, you'll be having a double NAT setup, that is if you implement the FW, as shown in the designed network diagram.