Optimal Home Network/Home office configuration…maximize security and privacy?
I am looking to get some feedback on how best to configure my pfsense/netgate sg2440 to make my network as secure and private as I can.
I Am not hosting email nor a website…is their any benefit to a DMZ?
Should I be using the default LAN as stated above or would I be better off using one of the extra interfaces, creating a new interface and adding the VLANs parent interface to it?
Getting my Unifi Pro's controller to connect? It's currently plugged into my LAN interface. Should the VLAN parent interface have any rules for Unifi pro to stay updated(Call home?) I believe the Unifi pro controller will not work over a VLAN?
I have struggled to get PfBlocker to work...I have a separate post in the PfBlocker section about network configuration but wanted to provide context to my over all network strategy.
I'd always say no to a DMZ. They is really no reason to ever have one unless you are running a honey pot or having networking issues that port forwarding can not handle. It's always more secure to use port forwarding method as you are restricting everything expect for those ports allowed.
Honestly for LAN's. It really doesn't matter what you use. If they get passed your firewall, they will figure out the LAN subnet easy enough. Some might disagree with that statement but I work as a network engineer. I can't tell you how many times I was able to sniff out a network once getting past the firewall in about 3 minutes. HOWEVER. I would change up the differences between all my interfaces. For Example. I use a 192.168.1.x for my production LAN PCs, but my servers uses a 10.10.10.x subnet. Instead of keeping the 192.168.x.x scheme. I changed it for the servers because if someone gets access to one LAN, they may stop their port scans thinking they obtained access and only do damage to the one LAN instead of both. But that is just my two sense on it.
UnFi's are awesome. I've only used the software manager/controller not a physical one. But if you want to be able to access LAN devices from the wifi. You can plug the UnFi into the main production subnet and then just enable "guest" on the WAP to have the guest network separated from the LAN. If you do not need access to devices on the LAN. Why not simply plug it into another optional interface and be done with it? There is no real reason for a switch unless you need more WAPS with Vlaning and POE etc… I believe the controller will work over the VLAN. Just in the PFSense you need to make a specific rule entry to allow your production subnet to talk to that specific WAP ip address on the other subnet.
As for DNS. There is really not much to it, other then what DNS provides more stable\fastest connections for your IP to Name resolutions compared to your current ISP DNS. What I did was ran a namebench on my workstation. It took about 30 minutes, but it checks UltraDNS, OpenDNS, Google DNS and your IPS's DNS and compares them. For me OpenDNS was 200% faster then my ISP's, so I changed my PFSense to use OpenDNS instead. Your results may very so make sure to run the tool.
I would also recommend that if you do change your DNS servers, that you do it under System>General Setup and not under Services>DNS Forwarders. Anything in System>General Setup over takes priory over the Services area.
Sorry can't be much help on PFBlocker. I don't use it so have no experience with that.
"I Am not hosting email nor a website…is their any benefit to a DMZ? "
Lets be clear what we are defining as a DMZ.. DMZ is really nothing more than a firewalled segment. So in that sense lets say you allow unsolicited inbound traffic to something.. I for one host a ntp server to the ntp pool.. This server sits in what I call my dmz - all that really means is this network segment has no other access to my other segments. So even if the machine was compromised it would only have access to other stuff in the dmz segment.
Even if you don't forward any unsolicited traffic from internet, you might want a "dmz" or firewalled segment that can not talk to your other networks - but your networks can talk to it. You might use such a segment for say your iot devices. So just encase these doing something you don't want them to do they are firewalled off from your other networks.
I thank you both kindly for your thoughts.
Very helpful…more work to do.
Well as you mentioned. There are a few meaning of DMZ.
In my example, a DMZ is a zone that allow for ALL traffic inbound to come in. This is where honey pots and other things are useful. It can redirect attacks on your network to places you have them go specifically because all traffic is allowed and its easy to get to.
Its also often used for troubleshooting, such as those with issues with NAT on a Playstation, would create a DMZ and allow all traffic to it as a troubleshooting method or simply to leave it in that state for a full NAT connection.
So depending on your definition, it can mean two different things. To avoid confusion I simply just say (using another subnet) instead of (using a DMZ).
Here is a thread on PFSense forums with someone asking the difference between the two. Most pretty much follow my first definition of the word.
or IoT devices that are sniffing my network and then snitching all home to the vendor server.
wrong with it if they are all not disturbing the rest of the LAN.
connected to your firewall directly this one will be freezing!