Hello, I’m getting into self hosting and looking to setup a small home lab to play around with different technologies. I’m considering setting up a DMZ to keep my lab hardware separate from the rest of the network and other users. What is some of the minimal hardware required to do this on a small budget? Also what are some of the necessary security measures I should understand. One of my first projects would be to setup a small Linux box that I can ssh into remotely. Thanks.
EDIT After much reading today and great guidance from this community this is basically what i ended up doing… Got a dell optiplex on ebay for about 55 bucks and a dual intel network card on amazon with a managed switch. If i can bridge my current router as an access point, i should be on my way! This community rocks! Lemmy is awesome!
It depends on what u wanna run, I use an old AMD A8-7600B, wich by today standards is less than a laptop cpu. But I run OpenMediaVault wich is just a NAS, so usually my cpu usage with 2 users at the same time is around %40-%60.
I recommend u to use passmark as a reference, just tipe the cpu u have in mind + passmark and make thr comparison with mine so u can have an idea.
Manually set up the local IP of ur machine in the router/modem, then in the computer (so everything is failsafe), then configure the firewall (I recommended ufw) and only allow the ports that u need in the necessary protocol, nothing more. Also, to be script kiddos safe I recommend to change the ports of everything that u can, in this case SSH, I don’t remember the usual port, but change it to something like 666, 999, 6666, u get the idea, if we aren’t the same as every other server in existence we r gonna be safe most of the time, disable password login and use an rsa key.
Get yourself a decent router capable of running OpenWRT, which will allow you to set up vlan’s for your lab, and (I would also recommend) another separate vlan for your IoT and other “smart” devices.
The TP-Link Archer C7 is old but reliable and has a lot of open source support.
If you’re feeling more adventurous You could also build your own router with any computer that’s got two or more Ethernet ports using PFSense, Firewall-NG, or IPFire
Instead of pfSense, I would really recommend OPNsense, originally a fork but now standing on its own. I like the fact that OPNsense tracks closer to the current FreeBSD release than pfSense.
One of my first projects would be to setup a small Linux box that I can ssh into remotely.
Why not just take the next step and setup tailscale? That way you can learn and also not have to worry about setting up a full security stack and everything for your DMZ.
Tailscale will let you create a virtual local network so that you don’t have to expose anything to the internet.
You can physically isolate by running multiple independent switches, you could run different subnets on the same switches or you could VLAN separate but that would require a managed switch or setting up your topology that something tags the traffic with the proper vid before running on the unmanaged switches. All have their pros and cons but i would strongly recommend getting a managed switch (managed firewalls/routers/switches depending on features/port count can all fill that need) and doing VLAN separation if you don’t have a lot of equipment you’re starting out with.
Managed switch to create vlans and a firewall to manage the traffic.
Past that it’s really a case of how much you want exacting control. Even a single /24 network gives 253 hosts and the class C space allows for a whole pile of those, so in theory it’d be easy to put everyone in their own network, but a pain to maintain.
I did this myself for all of 150 dollars. I bought an OptiPlex 7050 off of Amazon and added a dual intel network card. From there, I installed OPNsense. I have a DMZ, WAN, and LAN interface.
After much reading today, this is basically what i ended up doing. Got an optiplex on ebay for about 55 bucks and a dual intel network card on amazon with a managed switch. If i can bridge my current router as an access point, i should be on my way!
You can’t both bridge your current router and use it for WiFi AP because of the hierarchy of the network. You’ll need either a compatible AP-capable WiFi radio in your be router (hard to find, limited compatibility, I think you might top out at WiFi 4e (ac1350) in terms of what hardware is available.
Alternatively, you can use a dedicated access point alongside your new router which is easier and will get you better, more up to date, technology
You are not logged in. However you can subscribe from another Fediverse account, for example Lemmy or Mastodon. To do this, paste the following into the search field of your instance: !selfhosted@lemmy.world
A place to share alternatives to popular online services that can be self-hosted without giving up privacy or locking you into a service you don’t control.
Rules:
Be civil: we’re here to support and learn from one another. Insults won’t be tolerated. Flame wars are frowned upon.
No spam posting.
Posts have to be centered around self-hosting. There are other communities for discussing hardware or home computing. If it’s not obvious why your post topic revolves around selfhosting, please include details to make it clear.
Don’t duplicate the full text of your blog or github here. Just post the link for folks to click.
Submission headline should match the article title (don’t cherry-pick information from the title to fit your agenda).
No trolling.
Resources:
selfh.st Newsletter and index of selfhosted software and apps
It depends on what u wanna run, I use an old AMD A8-7600B, wich by today standards is less than a laptop cpu. But I run OpenMediaVault wich is just a NAS, so usually my cpu usage with 2 users at the same time is around %40-%60. I recommend u to use passmark as a reference, just tipe the cpu u have in mind + passmark and make thr comparison with mine so u can have an idea.
Manually set up the local IP of ur machine in the router/modem, then in the computer (so everything is failsafe), then configure the firewall (I recommended ufw) and only allow the ports that u need in the necessary protocol, nothing more. Also, to be script kiddos safe I recommend to change the ports of everything that u can, in this case SSH, I don’t remember the usual port, but change it to something like 666, 999, 6666, u get the idea, if we aren’t the same as every other server in existence we r gonna be safe most of the time, disable password login and use an rsa key.
Get yourself a decent router capable of running OpenWRT, which will allow you to set up vlan’s for your lab, and (I would also recommend) another separate vlan for your IoT and other “smart” devices.
The TP-Link Archer C7 is old but reliable and has a lot of open source support.
If you’re feeling more adventurous You could also build your own router with any computer that’s got two or more Ethernet ports using PFSense, Firewall-NG, or IPFire
Instead of pfSense, I would really recommend OPNsense, originally a fork but now standing on its own. I like the fact that OPNsense tracks closer to the current FreeBSD release than pfSense.
Agreed!
One of my first projects would be to setup a small Linux box that I can ssh into remotely.Why not just take the next step and setup tailscale? That way you can learn and also not have to worry about setting up a full security stack and everything for your DMZ.
Tailscale will let you create a virtual local network so that you don’t have to expose anything to the internet.
I’ll look into that thanks!
You can physically isolate by running multiple independent switches, you could run different subnets on the same switches or you could VLAN separate but that would require a managed switch or setting up your topology that something tags the traffic with the proper vid before running on the unmanaged switches. All have their pros and cons but i would strongly recommend getting a managed switch (managed firewalls/routers/switches depending on features/port count can all fill that need) and doing VLAN separation if you don’t have a lot of equipment you’re starting out with.
Thanks for the advice! I ended up getting a managed switch on amazon and an older dell computer to set up OPNsense. Can’t wait to get started!
EdgeRouter is proprietary but minimal. You can also look at Opnsense running on a used thin client off ebay.
Managed switch to create vlans and a firewall to manage the traffic.
Past that it’s really a case of how much you want exacting control. Even a single /24 network gives 253 hosts and the class C space allows for a whole pile of those, so in theory it’d be easy to put everyone in their own network, but a pain to maintain.
I did this myself for all of 150 dollars. I bought an OptiPlex 7050 off of Amazon and added a dual intel network card. From there, I installed OPNsense. I have a DMZ, WAN, and LAN interface.
After much reading today, this is basically what i ended up doing. Got an optiplex on ebay for about 55 bucks and a dual intel network card on amazon with a managed switch. If i can bridge my current router as an access point, i should be on my way!
You can’t both bridge your current router and use it for WiFi AP because of the hierarchy of the network. You’ll need either a compatible AP-capable WiFi radio in your be router (hard to find, limited compatibility, I think you might top out at WiFi 4e (ac1350) in terms of what hardware is available.
Alternatively, you can use a dedicated access point alongside your new router which is easier and will get you better, more up to date, technology