this post was submitted on 23 Nov 2023
6 points (100.0% liked)
Homelab
371 readers
9 users here now
Rules
- Be Civil.
- Post about your homelab, discussion of your homelab, questions you may have, or general discussion about transition your skill from the homelab to the workplace.
- No memes or potato images.
- We love detailed homelab builds, especially network diagrams!
- Report any posts that you feel should be brought to our attention.
- Please no shitposting or blogspam.
- No Referral Linking.
- Keep piracy discussion off of this community
founded 11 months ago
MODERATORS
you are viewing a single comment's thread
view the rest of the comments
view the rest of the comments
Kinda like the others have stated, you’re trusting the company to have fixed any known vulnerabilities, but also that there aren’t any unknown exploits.
Ultimately the question isn’t should you or not, but is the risk worth it? If your home finances are contained there in, if those impossible to recover or reproduce pictures are stored on there, then if you were to have your system locked with ransomware, how important is that data? Do you have their camera system? Would you mind the random internet looking at those cameras? That’s the real question.
If you only have some downloads you could find again and if you lose everything on the system, then you’re not risking much, so it’s kinda why not?
It's bad enough we have to trust VPN server code; but at least that should be the only thing you have to trust public facing.
VPNs are complicated enough that security experts are the only ones typically working on them… and they have a relatively small surface area with few 3rd party dependencies. So it’s about the best you could hope for. I agree there’s still a deep amount of trust. Your OS is generally a greater threat though… and your network gear probably a lesser one.
Where something like synology’s web admin involves a webserver running their software on a runtime (php? Python?) possibly with a database where the webserver, runtime, db drivers, db engine, orm, web framework, and all their third party modules are under continuous development and may not be patched. Plus they’re a targeted system because of their popularity. And they’re meant to be user friendly more than secure.
But having a Cloudflare reverse proxy helps a little. So would running something like fail2ban on the logs or a software level firewall configured to detect abnormal data.
Better would be to simply require a client certificate that you generate and distribute from an offline CA and have cloudflare do tls termination then whitelist only their IP(s) and your intranet IPs on the synology firewall.
Or.. just use a VPN lol
I have setup a wireguard in server with dedicated ip. I followed the documentation and open few ports nothing else regarding security. I connect my home machine and my phone when needed to the wireguard serverso I can access jellyfin and other services.
Do I need to setup anything else, or is it already secure?
One more thing, is it recommended to connect my proxmox host to the wireguard VPN?
Sounds like you did a decent job. Why would you connect the Proxmox host to the VPN? Typically you’ll route certain local addresses (or whole subnets) via chain forwarding. That way, when you connect to the VPN it’s as if you’re on the local network. The way you’re describing it, you would need to know it’s VPN IP which is usually dynamic. And you don’t typically want VPN clients to be able to access each other - just the local network. It really all depends how you set everything up.