What do you run; Opnsense, pfsense, Smoothwall, maybe a WAF like wazuh?
Today was update/audit firewall day. I’m running a standalone instance of pFsense on a Protectli Vault FW4B - 4 Port - Intel Quad Core - 8GB RAM - 120GB mSATA SSD with unbound, pfBlockerNG, Suricata, ntopng, and heavily filtered. I did bump the swap to 8 GB as I’ve previously noticed a few ‘out of swap’ errors under load.
Before I signed off, I ran it through a couple porn sites to see if my adblocking strategy was working. Not one intrusive ad. Sweet!
Show me what you got.
I think I have the same protectli as you and it is awesome. Need it for my 2.5gb uplink. I use openwrt on it… Didn’t really like opnsense. I am more used to linux than bsd.
I host lots of services and get bombarded by scrapers, scanners, and skids both at home and on my VPSs.
I use ipset for the usual blocklists which I download regularly. I also have tarpits on 22/tcp (endlessh). I pipe the IPs from the endlessh logs into fail2ban which feeds the ipsets. I have ipset blocks and fail2ban on my home firewall and all VPSs and coordinate over mqtt. So
any fail2ban trigger > mqtt > every ipset block. Touch my 22/tcp anywhere and you get banned instantly everywhere. The program I use for this is called vallumd and it runs on openwrt.I also put maltrail everywhere but I’m not totally sure how to interpret and respond to the results. Probably will implement a pipe from maltrail to my mqtt > blocklist setup.
I don’t do any network-level adblocking… Might be a future project.
I think I have the same protectli as you and it is awesome
Yes it is. It was a little more than I wanted to spend, and I’m sure I could have gone with a cheaper configuration, but I figured I’d get something with a little ass to it as to not create a bottleneck right at the firewall.
I host lots of services and get bombarded by scrapers, scanners, and skids both at home and on my VPSs. Touch my 22/tcp anywhere and you get banned instantly everywhere.
I too host most of the services I use on a couple of VPS I run. It has always amazed me as to the thickness of the bot layer on the internet. Clearnet experiences something like 2+ zetabytes per 24 hours. Around 50% of that is bot traffic, and they are very sophisticated bots as well. Open port 22 and here they come by the thousands like a feeding frenzy. I went as far as blocking everything with hosts.allow (do first) & hosts.deny (do last). I’ve set f2b on aggressive mode with only one shot. LOL UFW rocks in the background along with Crowdsec. I probably go overboard with security. LOL
When you say open 22, do you mean with just password access with multiple users? I recently made mine only allow entry using ssh certs iirc. And then just blocked incoming for the time being. Guess I’ll need to fix that before another git pull request.
I think when I said open port 22, I was giving an illustration of the hordes of bots that will show up at your doorstep. Best practice is to use ssh keys and rotate them.
Largest ddos attack of all time? 12 tb/sec.
But yeah, I believe it when you say you get 24,855 tb/sec on your VPS.
Beg pardon? I am going to need clarification.
OpenWRT.
I’ve always wondered about OpenWRT. In my uneducated thinking, running an access point/wifi, firewall, router, etc, all in the same package would create a bottleneck right at the point you wouldn’t want it. What has been your experience?
Everything works fine. It’s super handy having such fine control over my router.
Just got OpenWRT One router. I have never set up a VPN server, but the wireguard API didn’t seem too bad. I’ve never used an API either though. What do you think about OpenWRT running Wireguard, firewall, and reverse proxy (Caddy)? My firewall experience is with nftables and ufw back in the day.
My selfhost plans for now are just nextcloud and Jellyfin.
OpenBSD pf
Edit: just home/hobby now, I’m not in tech anymore.
OpenBSD pf
I’d never heard of it so I went and checked it out. It seems to have a lot of pFsense/Opnsense features just managed from the cli. Cool.
It’s the ‘pf’ in pfSense.
pf is developed as part of the OpenBSD project and is the built in packet filter/firewall.
OpenWRT on a Linksys router, with adguard home for DNS blocking.
I used to run OPNSense on some older x86 hardware, but wanted to move to something simpler and less power hungry.
I was going to hack my Linksys, but they locked some things for my model in the US apparently, and needed a flash with firmware I couldn’t find.
I just got OpenWRT One. Its a dev router, but hope fully can handle a firewall, VPN server, and maybe a reverse proxy. It’s based off banana pi.
I just want my Linux notes in one place (nextcloud) and synced (syncthing), and Jellyfin. Got a Raspberry Pi 5 with a NVMe hat and 16 GB of RAM for that. Then add more later.
Pfsense with pfblocker in a VM. Works wonders. Pipe fail2ban to pfblocker for extra goodness.
.
nftables. Deny all, start adding stuff until þings work.
My firewalls are simple, b/c I run a private VPN and just shut off all traffic except over WG. I’ve got one exposed VPS reverse proxying services from oþer VPSes over WG.
But: nftables, and only nftables. I’m a big believer in understanding how stuff works, and þe rulesets created by firewalld and ilk are convoluted - complexity adds risk.
Haha, I thought that said “until pings work”
Also an accurate reading.
