Now that I have time for hobbies again I wanna dive right in to building up a home lab. Right now I just have a Netgear router that reached end of life, and a NAS i’d like to make accessible remotely, and a DIY router seems like the correct next step for me. I’m very interested in ad-blocking network wide and someday I’d like to host my own little webpage, but for now I’m really just barely getting started.
I’m information gathering, I don’t know what I don’t know and my networking skills are pretty weak anyway. But even if your needs and desires have nothing to do with mine, I also just like to hear people talk about their set ups. Please? 🌞
I run some china box with 5 integrated 2.5GBe NICs, 48GB RAM and 2x 500GB SSD/NVMe. CPU is Celeron® 6305 @ 1.80GHz, two cores or HT, who knows…
On this I run Proxmox. I didn’t like Proxmox integrated firewall, so I rolled my own.
all containers unprivileged
one container is the firewall. it has all up+down stream NICs mapped via bridges, cable internet, backup 5g internet on dedicated ports. one port to the switch with a few VLANs, and one bridge that is local to the Proxmox for the local VLANs.
Every service I operate sits in its own network/segment, usually with a /30 netmask. VMs/containers have a eth0 device in this and the firewall defined as default gw. On the firewall the VLAN interfaces are named as the container/service. So the interfaces are not eth0 but wan, wan5g, frigate etc. Great for readability.
Some networks like “family” or “guest” or the one with the APs/WLAN-controller are /24. Bit big, but what ever.
I have a structured netfilter firewall script, fw.sh calling it’s parts under fw.d/*fw. Each service is managed individually, sometimes widely open (
iptables -A FORWARD -i frigate -o wan* -j ACCEPT) but usually down to the required ports. Database, reverse proxy etc all on separate containers.There is also like 30 VPN configs from 2 VPN providers. I have a home assistant dashboard where I can direct specific devices to use specifig VPNs. My webradio is routed via UK so I can enjoy BBC2.
root@mercury:~# ip rule show 0: from all lookup local 20: from all lookup main suppress_prefixlength 1 300: from XXX lookup wan_table 310: from XXX lookup wan5g_table 1000: from all fwmark 0x1 lookup bbc-ss-lon 1001: from all fwmark 0x1 lookup bbc-ss-man 3000: from XXX lookup pm-gb 4000: from all lookup wan_table 5000: from all lookup wan_table 5100: from all lookup wan5g_table 32766: from all lookup main 32767: from all lookup defaultip rule also does the fail over to wan5g if required. There are some rules where I tried to auto-filter BBC traffic with marked connections via dnsmasq, but BBC knows all my VPNs (not BBC radio it seems).
IPSec VPNs and other OpenVPNs (dialup, site2site) are handled via a dedicated LXC. There is a tor entry node container, for a few services and one of the public WLANs. Firewall makes sure certain traffic can only exit via certain upstream interfaces, vpn*, wan, wan*… very helpful
I didn’t like opensense… don’t know why. Work a lot with firewalls in my job (mainly check point, fortigate) so have some professional background.
Also: client isolated WiFi for all iot shit. No internet for TV (jellyfin), PV controllers and most others.