Good Morning from my Robotics Lab! This is Shadow_8472 and today I have on my desk between my keyboard and monitors a new Protectli Vault running OPNsense. Let\u2019s get started.<\/p>\n\n\n\n
After at least a couple years tentatively researching hardware firewalls, it\u2019s here. Let me tell you: it\u2019s both a relief and a bit of pressure. I\u2019m glad I\u2019m no longer starting from scratch over and over again, but now I feel time pressure to deploy it despite my parents\u2019 assurance that it\u2019s much better to go at a responsible pace. And unless you\u2019re a full time network specialist, that pace is longer than a week.<\/p>\n\n\n\n
My Current Network and Its Weaknesses<\/p>\n\n\n\n
At present, my home network starts with a box owned and controlled by my service provider. This gateway feeds into a gaming router before going out to a couple switches and Wi-Fi. One of my desktops has OpenWRT on a Raspberry Pi 4. ButtonMash, my home server, runs Podman containers for Vaultwarden (Password vault storage) and PiHole (DNS ad blocking). We have a Network Attached Storage by the hostname of GoldenOakLibry. Everything minus a couple workstations has battery backup in case the lights go out.<\/p>\n\n\n\n
And when the lights do go out, the first big flaw comes out. While the network closet may last several hours, Power-hungry ButtonMash and GoldenOakLibry chew through their shared battery in around half an hour before I added ButtonMash\u2019s twin, Joystick, as a development platform. When ButtonMash goes down, the network loses DNS so we can\u2019t resolve URL\u2019s.<\/p>\n\n\n\n
Additionally, I\u2019d like to move to a non-default set of internal IP addresses, like 10.59.102.X instead of 10.0.0.X or 192.168.0.X. While computers getting automatic IP\u2019s over DHCP will essentially take care of themselves, I have invested quite a bit of time into static IP\u2019s on NFS (Network File System), and when I move GoldenOakLibry\u2019s IP, I\u2019ll need to adjust the automounts for all systems accessing it, and that\u2019s just a pain. I want to learn how a home domain works.<\/p>\n\n\n\n
I also have a number of network-related projects I\u2019ve done research for, but burned out on before solving. From memory, here\u2019s a checklist of partial\/incomplete\/need-to-redo projects:<\/p>\n\n\n\n
Keep in mind that the notes on each item suggesting a direction are just the direction I\u2019m leaning in at the moment without reflecting the new hardware. Replacing GoldenOakLibry with a server beefy enough to handle running Podman would solve my current need for rootless Podman\/NFS. I may find a replacement for Caddy that also works as a Domain Controller. Does Caddy even do that? Let me check\u2026 Inconclusive; probably not. I don\u2019t know enough about what to look for in a Domain Controller besides the name. Most of my time focused on researching Demilitarized Zones.<\/p>\n\n\n\n
Demilitarized Zone and Roadmapping<\/p>\n\n\n\n
Originally, I had a goal of deploying this new firewall\/router configured with a demilitarized zone network structure. With hardware in hand, I learned a lot! But as I learned, I realized I needed to learn that much more to do the job right. A DMZ is basically a low security area of your network for serving stuff over an untrusted network (usually the wide open Internet) while protecting your Local Area Network. Ideally your LAN would have a separate physical router in case the one servicing the DMZ is ever compromised, but a homelab environment should be a small enough target that branching off from a single hardened router should be fine. My trouble is that I can\u2019t fully tell where to put what.<\/p>\n\n\n\n
I already know I want to move PiHole, Unbound, and similar projects related to internet traffic, and other projects I want lasting a bit longer into power outages onto the new router. OPNsense is a distribution of BSD and not Linux, so I expect I will need to look into a Linux Virtual Machine if BSD-based containers aren\u2019t available. The gaming router I\u2019m using now will still be our Wi-Fi access point, but I\u2019d prefer to retire it from DHCP duty.<\/p>\n\n\n\n
ButtonMash and Joystick are my enigma. I had plans of clustering them, but I may need one in the DMZ and one on the LAN. GoldenOakLibry belongs on the LAN so far as I can tell \u2013 as do all workstations.<\/p>\n\n\n\n
Takeaway<\/p>\n\n\n\n
There will be more thought to give it another week. I went ahead and hooked it up in place, but it didn\u2019t work despite how I had previously had it working between my upstairs workstation and its rPi router. I\u2019ve reverted the setup to how it was before, and I\u2019ll need to take a closer look and do some further testing.<\/p>\n\n\n\n
Final Question<\/p>\n\n\n\n
What was the last piece of tech you unboxed?<\/p>\n","protected":false},"excerpt":{"rendered":"
Good Morning from my Robotics Lab! This is Shadow_8472 and today I have on my desk between my keyboard and monitors a new Protectli Vault running OPNsense. Let\u2019s get started. After at least a couple years tentatively researching hardware firewalls, it\u2019s here. Let me tell you: it\u2019s both a relief and a bit of pressure. … <\/p>\n