Selfhosted
A place to share alternatives to popular online services that can be self-hosted without giving up privacy or locking you into a service you don't control.
Rules:
-
Be civil: we're here to support and learn from one another. Insults won't be tolerated. Flame wars are frowned upon.
-
No spam posting.
-
Posts have to be centered around self-hosting. There are other communities for discussing hardware or home computing. If it's not obvious why your post topic revolves around selfhosting, please include details to make it clear.
-
Don't duplicate the full text of your blog or github here. Just post the link for folks to click.
-
Submission headline should match the article title (don’t cherry-pick information from the title to fit your agenda).
-
No trolling.
-
No low-effort posts. This is subjective and will largely be determined by the community member reports.
Resources:
- selfh.st Newsletter and index of selfhosted software and apps
- awesome-selfhosted software
- awesome-sysadmin resources
- Self-Hosted Podcast from Jupiter Broadcasting
Any issues on the community? Report it using the report flag.
Questions? DM the mods!
view the rest of the comments
if you allowed that to happen you either did not set firewall rules strict enough, or if the client doing the compromise absolutely had to have access to the vulnerable service then you did everything you could to limit the chance of it happening.
usually the solution to that is to limit who can access what more strictly. dont allow user devices like smartphones on the iot vlan, as any app running on the phone could be doing nefarious things. only allow the iot devices and the home assistant service on the iot vlan, and user devices will only talk to home assistant, something supposedly more secure than whatever iot devices there are.
similarly, don't allow user devices to access the ip cameras. put the ip cameras on a network where only the NVR software can access them, and user devices will only access the NVR. if you can, don't put the whole operating system of these services on the iot and ipcam vlans either. this is possible when the services run in containers, because you can pass in only vlan specific interfaces to the containers. if not using containers, you can still use the operating systems firewall to filter incoming traffic.
if you set up proper network filtering, the "if" in "If your firewall couldn't stop it" will become a pretty big "if"
The argument was that the vlans force a device through the firewall so that the firewall can protect it. But for that to happen, like you said the firewall wasn't strick enough or didn't have a defense against a 0 day.
So the vlan doesn't do anything either way. Either the firewall works in which case you don't need vlans to force local traffic through them a second time or they don't work in which case again the vlan did nothing.
firewalls are not for defending against 0 days. it is about access control, and reducing, sometimes even minimizing access to potentially vulnerable services. firewalls are not an infallible security tool, but there is no such thing either. the reason to use it is to restrict access such that fewer attackers can take advantage of a potential vulnerability.
there are intrusion detection/prevention systems that could do more, but it's unlikely they will protect against 0 days, because 0 days are undiscovered and unknown issues.
it does. its useful to force traffic through a firewall. its for limiting what has access to what. if you wouldn't use vlans, hosts on the network would not care about your firewall because they can just go straight to the destination.
I'm not sure I understand your argument, but I think what you say is, firewalls are not infallible so they are useless
I'll try an analogy to explain better. The firewall is a lock on the door to your house. Vlans are a rule that to go from one room to another, you must go back out the locked door and back in.
So an attacker tries to come in and can't pick the lock. You are safe.
Another attacker can pick the lock and get into a room. But if they can pick the lock for one room, they can pick the same lock again and get into any other rooms because it's the same lock protecting every room in the house.