points by kstrauser 3 days ago | 0 comments
My first tech job was working alongside the network admin at a regional ISP. I feel like a n00b on the subject, but objectively, I'm pretty good at it. So basically, I've nerded out about it for years. I do allow VPN access to my LAN, but even that is tightly firewalled with a default-deny policy. Connecting to the VPN just lets you make connections into the LAN's address space, but only for certain IPs and ports. I can connect into Plex running on the LAN, and specific ports on the NAS. I can SSH into a Linux box that doesn't have credentials to connect to anything else. That's about it, really.
I didn't set out to make a hypersecure setup, but approached it with "least access" in mind. I started with the default-deny firewall, and when I needed an exception, I added that one single exception. Honestly, if you follow that principle — don't allow it if you don't require it — you've done 95% of the work a dedicated expert would do.
[–] NikolaNovak 3 days ago
[–] kstrauser 3 days ago
Oh, I get it, trust me! Professional paranoia is a skill that's served me very well over the years! Especially with AI-driven attacks now: we might be little fish, but it's cheaper and easier to catch little fish than it ever has been.
But there's still a calculated risk. To get into this, someone would have to compromise the VPN, then compromise the firewall, then compromise the reasonably-hardened servers running behind it. Sure, those things might be possible. Even with AI, though, is it likely? I don't think it is.
"A ship in port is safe. But that’s not what ships were built for." - Grace Hopper
That's the approach I took when I had VPN to my LAN ~20 -> ~10 years ago; now I worry about the massive "unknown unknowns" - sure, that Linux box doesn't have access to anything else... officially. But what vulnerability is there on that Linux box, or on the plex server, or anything else on your network, that might enable massive expansion of access?