NaibofTabr

I’m not sure you know what SNMP is

Oops, I was definitely confusing that with ICMP. Good point.

https://oneuptime.com/blog/post/2026-03-20-block-icmp-firewall-risks/view

Also Iot devices aren’t really much of a threat.

I consider it a threat if a device maps my local network, identifies the other devices I have connected, and/or monitors my network traffic and then sends a report on that back to its control server.

Also don’t put things on the internet. That is generally a really bad idea and will bite you in the butt eventually.

Ain’t that the truth. We really should just not.

I’m looking for advice to maximize security.

The most important answers to this all live outside your server. What is your home network like? Do you control the gateway? Do you have a dedicated firewall? Do you have devices segregated into VLANs so they can’t observe each other (especially IoT devices)? Do you have SNMP disabled?

1. Containers are not a security barrier. They cannot be, they never will be.
2. If you are defending against intrusion at your local file server, it is already too late. The call is coming from inside the house.

If you want security, you block all inbound and outbound traffic by default at your network firewall (not the server OS firewall), and then you open only the ports that you actually need, one by one. You set all the closed external ports to do not respond (“stealth” mode), so that anybody trying to reach your network from outside just gets nothing back except on the ports you specifically need to use. You segregate your internal network into logical areas, and you put things that need to talk to each other on their own VLAN, which may or may not have access to the upstream WLAN trunk depending on what they’re doing. You don’t allow crosstalk between VLANs except in very specific cases. You set static IPs and document them, so that you never have to ping or traceroute internally to find something, so you don’t need SNMP. Anybody trying to use SNMP is conducting surveillance on your network and should stick out from other traffic (some “smart”/IoT devices do this automatically - they are bad and should be treated as malicious and should not be allowed to phone home). And then you monitor your traffic at the firewall, and you deal with anything unexpected as it comes up (like once a week review the logs until you have a sense of what normal looks like on different days at various times, then maybe set a few automatic alerts for things that exceed normal-ish boundaries, then go to reviewing like once a month or so - you don’t need to be checking your logs hourly unless you have some reason to be actively paranoid).

If you handle everything correctly at the router/firewall level, you’re way way beyond the security of most residential and small business networks. You’re not, you know, impenetrable, but you’re at the point where somebody with experience and resources will have to be trying to break into your network specifically on purpose. If you’re that kind of target then nothing short of an actual SOC is going to help you, and running self-managed servers on your home network is a bad idea.

the best device for school is a generic laptop that you can easily find guides and replacement parts for. That way you can fix things

This is the right idea. The qualifier is unnecessary. Repairability is always valuable. The more generic a device is, the more spare parts for it there will be on the market, and the longer those spare parts will be continue to be available on the market.

Buy common refurb/resale tech. Keep it for years, or decades.

memory is impossible dream

Yeah, it’s one of the best reasons to actually RTFM: “How does the guy that designed this think it works? What did they intend for it to do?”

I also find it’s useful when I’m vague on the specifics, especially with network protocols. I might be expecting it to do something and then find out, oh, this doesn’t solve that problem, I’m in the wrong config file.

Well the “critical/irreplaceable” qualifier is kind of important - that’s why I specified it. It’s up to you to decide what that means for your data and risk tolerance.

For everything that I consider irreplaceable, I’m not comfortable with anything less than 100% duplication on the live system, and also an external offline backup. Even with enterprise-grade hardware, I don’t trust storage devices, they’re all destined to fail. Storage is the most important part of a data server, and should be treated like it is constantly trying to light itself on fire, like a library with wooden shelves lit with torches. All the other components are just as unreliable, but more expendable.

Admittedly, when you account for hot standby drives, the cost is that my storage availability is only 40%. A 16TB storage pool is in fact 5x 8TB drives: 2 mirrored pairs and 1 standby. On the plus side, thanks to ZFS and TrueNAS those drives can be whatever, no need to worry about RAID considerations for matched drives. SAS or SATA? who cares? They can even be different speeds, ZFS will compensate. Buy whatever is the right size for the pool, let the system deal with the other issues.

Can you put a price on stability? longevity? peace of mind?

The server hardware is all old repurposed stuff - a desktop build from 2013, secondhand data center surplus, refurbished/used drives, none of it’s worth much and almost all of it is well past end of life, any part of it could fail without warning at any moment. It doesn’t matter, it is highly reliable because the redundancies have redundancies, including the boot drives. Trying to squeeze every bit of value out of the hardware is a losing game because it’s basically worthless anyway, but the same would be true if it were all new top-of-the-line gear. The hardware is expendable, the data is not. Buy more cheap hardware, plan for it to explode, learn how to build stable, recoverable systems.

Used data center drives are great for a home lab. They’re built like tanks for hundreds of thousands of hours of constant operation. Unless you’re running a business hosting a bunch of public-facing websites out of your garage, you don’t have that kind of workload (and if you are doing that you should just be buying new drives anyway and writing them off as a business expense).

Data center drives get replaced when they hit a ceiling of operating hours, with no actual faults, or if they experience any minor faults (it’s a business expense - drives are consumables - data centers have storage rooms of spares sitting around, they just replace them).

Any competent reseller should be able to give you a SMART report, and that should tell you if there are any major issues (generally they don’t get resold if there are, nobody will buy them). If the seller won’t give you a SMART report then obviously don’t buy, they’re either a scammer or incompetent.

If your array redundancy is set up properly then there’s no reason to be “scared” or trust in “good luck”. Assume luck will be bad. Mirror every storage device that has critical/irreplaceable data on it, and have at least one hot standby drive in every pool. Don’t bother with complicated striping schemes to try and scrape a little more storage space out of your drives, that’s dumb. One-to-one mirroring for every drive. Storage drives are consumables. They will fail, not if but when, even if you only buy new. Learn to read a SMART report. Enjoy quality hardware with no real problems at low prices.

You say you got PEBKAC faults, I feel bad for you son.
I got 99 problems but wetware ain’t one.

Computer networking is basically a completely different field from operating systems and programming, though obviously some of the concepts are relevant. Turns out plugging these things into each other so that they can share information in a useful way is kind of difficult. A lot of very smart people have been working on it for almost 70 years, and frankly it’s still a fucking mess, so don’t feel bad if you feel a little lost.

Starting with the basics is the right instinct, in my opinion. Start with the OSI model:

https://jakarta.telkomuniversity.ac.id/7-osi-layer-the-building-blocks-of-networking/

https://www.geeksforgeeks.org/computer-networks/osi-model-analogy-osi-7-layers-explained/

This helps to break down the actual functioning of the network into logical steps. It’s very helpful when you’re trying to visualize the operation of some of the more abstract bits of the technology stack (like TCP/UDP), and when you’re trying to think through what piece of it might be causing your problem in the moment (the router is on and the cables are plugged in, why is there no connection?). It’s a map that can help you when you’re lost. It’s also a guide to how a lot of people who work on networking technology think, so it can help you understand how things are supposed to work.

Beyond that, Professor Messer is a great resource: https://www.professormesser.com/

If you feel reasonably confident with computer hardware components and various types of cable connectors, you can probably skip the A+ part and go straight into Network+. Because you’re doing this as a home hobbyist (not for the actual certification), I recommend just listening to the courses like you would a podcast. Don’t try to memorize or fully understand everything, just use it to get a grasp of the terminology and purpose of the various pieces.

I also recommend taking on a project to gain experience. Implenting PiHole https://pi-hole.net/ for your home network will cover routing, DHCP and DNS, plus you can do it with a Docker container.

Your first concern should be your boundary firewall. You should have all ports closed except the ones that you are definitely using for external services. You should know which ports you have open and why, and what traffic, how much and how often you expect to see on those ports (8080 will have regular Internet use traffic, but your reverse proxy port should only have traffic when you’re away from home and actively using it), and you should monitor that traffic at the firewall every so often, and especially when you make changes to your network. Closed ports should be configured to drop packets rather than respond that the port is closed (stealth mode). On a home network, preventing unwanted incoming connections will protect you from the majority of malicious activity. It’s the most effective single thing you can focus on.

The next thing would be to separate untrusted devices onto dedicated VLANs. This would be for IoT devices, gaming consoles, “smart” appliances, anything that connects to the Internet whose software you don’t have control over. They get isolated on a VLAN that only connects to the Internet and doesn’t allow local connections to devices on other VLANs, so the rest of your network doesn’t exist as far as they’re concerned. This should cut down on things like “smart” appliances taking inventory of your home network and reporting it back to the manufacturer’s servers.

If you do these two things, and you’ve got your reverse proxy configured properly so that other people can’t break into it, you should minimize unwanted connections to your network and your server/containers should be fine with default internal firewall policies. The only reason you would need to do more is if you expect a direct/intentional attack by a motivated hacker, but in that case there’s not much you can do unless you’re an expert.

If you want to go further, try implementing the community version of runZero:

https://www.runzero.com/platform/community-edition/

https://help.runzero.com/docs/self-hosting/

https://www.cisa.gov/resources-tools/services/runzero-community-edition

This is a network visibility tool that will discover and identify devices. To get a really complete look, you would run it from inside your network and deal with anything that you don’t think should be accessible, then run it again from outside your network to see what a potential attacker would see.

More specifics are needed for a support request. Provide the baseline specifications please.

What OS are you using? What is the make and model of the drive? Is it internal or external? USB? SATA? SAS? NVMe? A PCIe adapter? Is this a desktop, laptop, NAS, server, NUC, Raspberry Pi with an expansion board?

For all we know you’re using a refurbished and relabeled SAS drive plugged into an adapter on an eSATA port on a 10 year old motherboard sitting in a cardboard box.

Are you familiar with SMART? Have you done any diagnostics?

Heh, I opened port 22 on my home network once. There wasn’t anything on it to connect to, but the firewall recorded thousands of SSH connection attempts within hours. Within a day it had over a million hits.

Yeah, you never really know how sheltered you are until you step out.

I wonder what you are securing against?

OK, you’re familiar with vulnerability scanners and port scanners right?

The threat model here isn’t really attackers specifically targeting your home network for any particular reason (unless you’re a LastPass engineer working remotely while running an exposed Plex server). They’re not looking for you, they’re looking for anything useful.

The threat model is attackers using scanning tools to discover vulnerable systems connected to the Internet. All they need from you is an active connection and a system that can store data, from which they can host malware files for distribution to other targets or conduct attacks or just run a cryptominer (if you’re lucky and they’re not very ambitious). They can find this by scanning for open ports and then running a vulernability scanner to figure out if there’s some exposed hardware that can be exploited.

An unsecured system is a hazard that could land you in jail when someone else starts using your device and network connection to commit crimes.

Now, as long as you’re behind a standard residential network service, and your ISP is in control of your gateway device, you’re relatively safe from this. Most ISPs will block any traffic like that very strictly. If your ISP is in control of your gateway device then they’re responsible for its behavior (demarcation matters).

But, most self-hosters run into limitations with their ISP blocking a lot of ports by default, because they want to access their personal server from outside their home, and so they take control by running their own gateway device or paying for a business connection which gives them complete control over which ports are open. This is where the risk comes in. You are assuming the responsibility for properly securing your connection to the public Internet, taking it off your ISP’s hands.

If you’re going to do this, you should know exactly which ports you have open to the outside and why, and a general idea of what traffic you expect to see on them when and how much. Monitor that traffic at your firewall. Every other port should be closed and your firewall (on your router, gateway device, or better yet a dedicated OPNSense firewall) should be configured to drop packets received by closed ports (“stealth” mode). You don’t want it to respond that those ports are blocked, you want it to appear to not be there at all.

Every other security implementation is a secondary concern for a home network. Yes you should patch your software regularly and you should practice deny-by-default and least-privilege as a matter of course, but you’re going to mitigate 90% of your risk by just not accepting incoming connections for anything you don’t need. Most vulnerable systems are discovered by automated scanning, so the less your system responds to external connections the better. If you’re going to worry about configuring, securing and patching one device, make it that front line firewall. And be very selective about which internally hosted services you expose externally.

You are running into the ultimate, and ultimately unavoidable, limitation of self-hosting, which is the self.

You should run a VM on the VPS for Vaultwarden, with no other services in the VM except whatever you need to connect to it remotely. Keep it simple. Run an exact copy of the VM on your local server. Have the VPS instance push its database to the local instance regularly, to keep up with any changes that your users make. Make regular backups of the local instance.

When you need to update the software, freeze an image of the local VM and then update the local VM, then when you’re sure it’s stable, copy the updated local VM to the VPS. If either the local or VPS instance crashes out, you should be able to recover (or reproduce) one from the other.

In the end though, it is functionally impossible to ensure reliability by yourself. Hosting Vaultwarden on a VPS shifts the responsibility for running the underlying server and network connection to the provider, and probably removing the dependence on your residential network connection will be better for your family/users.

You are still the weak point in your system. You need someone else who can log in to your local server, and into the VPS, and perform recovery if needed. There is no technical solution for this. You cannot be the sole admin, and also ensure reliability for other users.

Hmm, OK could be interesting…

O… K…

Um…

Yeah… that makes sense…

That’s intended behavior, right? Let me guess, you used the project to vibe code the web page?

Good show mate, off to a brilliant start.

No, we’re talking about companies scraping hundreds of millions if not billions of labor hours of output to train their models for the sake of developing software products which they then sell for profit.

Every model that was trained on legally acquired free public data and open source code should be freely publicly available and open source.

Every model that was trained on not legally acquired public data (e.g. Meta’s models) should be taken out of production until all of the lawsuits are concluded, and hopefully the parties responsible are put out of business.

I’m not talking about future, potential labor that AI might replace. I’m talking about the labor which was stolen to produce these models in the first place.

But, please use AI.

Please identify the issues with the LLM generated code.

Why would the issues be obvious and easy to point out? Most issues with code aren’t. If they were, we wouldn’t have Patch Tuesday, a direct code review would prevent issues from shipping in the first place.

Throwing this out as if it means LLM code is acceptable and ends the argument is ridiculous. Do you have any grasp of how software vulnerabilities are discovered at all?

There are serious and skilled people out there who use LLMs responsibly.

There is no “responsible use” for a platform built on the largest form of labor theft ever devised.