NaibofTabr

Your first concern should be your boundary firewall. You should have all ports closed except the ones that you are definitely using for external services. You should know which ports you have open and why, and what traffic, how much and how often you expect to see on those ports (8080 will have regular Internet use traffic, but your reverse proxy port should only have traffic when you’re away from home and actively using it), and you should monitor that traffic at the firewall every so often, and especially when you make changes to your network. Closed ports should be configured to drop packets rather than respond that the port is closed (stealth mode). On a home network, preventing unwanted incoming connections will protect you from the majority of malicious activity. It’s the most effective single thing you can focus on.

The next thing would be to separate untrusted devices onto dedicated VLANs. This would be for IoT devices, gaming consoles, “smart” appliances, anything that connects to the Internet whose software you don’t have control over. They get isolated on a VLAN that only connects to the Internet and doesn’t allow local connections to devices on other VLANs, so the rest of your network doesn’t exist as far as they’re concerned. This should cut down on things like “smart” appliances taking inventory of your home network and reporting it back to the manufacturer’s servers.

If you do these two things, and you’ve got your reverse proxy configured properly so that other people can’t break into it, you should minimize unwanted connections to your network and your server/containers should be fine with default internal firewall policies. The only reason you would need to do more is if you expect a direct/intentional attack by a motivated hacker, but in that case there’s not much you can do unless you’re an expert.

If you want to go further, try implementing the community version of runZero:

https://www.runzero.com/platform/community-edition/

https://help.runzero.com/docs/self-hosting/

https://www.cisa.gov/resources-tools/services/runzero-community-edition

This is a network visibility tool that will discover and identify devices. To get a really complete look, you would run it from inside your network and deal with anything that you don’t think should be accessible, then run it again from outside your network to see what a potential attacker would see.

More specifics are needed for a support request. Provide the baseline specifications please.

What OS are you using? What is the make and model of the drive? Is it internal or external? USB? SATA? SAS? NVMe? A PCIe adapter? Is this a desktop, laptop, NAS, server, NUC, Raspberry Pi with an expansion board?

For all we know you’re using a refurbished and relabeled SAS drive plugged into an adapter on an eSATA port on a 10 year old motherboard sitting in a cardboard box.

Are you familiar with SMART? Have you done any diagnostics?

Ah right, nothing imperialist about claiming ownership over millions of square kilometers of ocean.

Heh, I opened port 22 on my home network once. There wasn’t anything on it to connect to, but the firewall recorded thousands of SSH connection attempts within hours. Within a day it had over a million hits.

Yeah, you never really know how sheltered you are until you step out.

Pacific leaders have said for years that they don’t want their region to be a theatre for someone else’s power contest. They want responsibility for their own security, not protection from it.

Morally, absolutely, each sovereign nation should be taking responsibility for their own security.

Practically, though… an island nation like Fiji doesn’t have the budget or the manpower to run a large enough navy to patrol their own waters, and never mind ensuring security in the ocean around them. They can’t even keep all the illegal Chinese fishers out. How would they resist a military force? The same is true for every Pacific island nation except maybe Australia.

We can all agree that in principle they should be able to manage their own security independently, but I don’t see how that can be done in practice without the required tools.

On the plus side, global cooling achieved through a shield of reflective debris!

Yes, but a screen of tiny reflective particles spread through orbit between the Earth and the GPS satellites might cause communication problems.

I wonder what you are securing against?

OK, you’re familiar with vulnerability scanners and port scanners right?

The threat model here isn’t really attackers specifically targeting your home network for any particular reason (unless you’re a LastPass engineer working remotely while running an exposed Plex server). They’re not looking for you, they’re looking for anything useful.

The threat model is attackers using scanning tools to discover vulnerable systems connected to the Internet. All they need from you is an active connection and a system that can store data, from which they can host malware files for distribution to other targets or conduct attacks or just run a cryptominer (if you’re lucky and they’re not very ambitious). They can find this by scanning for open ports and then running a vulernability scanner to figure out if there’s some exposed hardware that can be exploited.

An unsecured system is a hazard that could land you in jail when someone else starts using your device and network connection to commit crimes.

Now, as long as you’re behind a standard residential network service, and your ISP is in control of your gateway device, you’re relatively safe from this. Most ISPs will block any traffic like that very strictly. If your ISP is in control of your gateway device then they’re responsible for its behavior (demarcation matters).

But, most self-hosters run into limitations with their ISP blocking a lot of ports by default, because they want to access their personal server from outside their home, and so they take control by running their own gateway device or paying for a business connection which gives them complete control over which ports are open. This is where the risk comes in. You are assuming the responsibility for properly securing your connection to the public Internet, taking it off your ISP’s hands.

If you’re going to do this, you should know exactly which ports you have open to the outside and why, and a general idea of what traffic you expect to see on them when and how much. Monitor that traffic at your firewall. Every other port should be closed and your firewall (on your router, gateway device, or better yet a dedicated OPNSense firewall) should be configured to drop packets received by closed ports (“stealth” mode). You don’t want it to respond that those ports are blocked, you want it to appear to not be there at all.

Every other security implementation is a secondary concern for a home network. Yes you should patch your software regularly and you should practice deny-by-default and least-privilege as a matter of course, but you’re going to mitigate 90% of your risk by just not accepting incoming connections for anything you don’t need. Most vulnerable systems are discovered by automated scanning, so the less your system responds to external connections the better. If you’re going to worry about configuring, securing and patching one device, make it that front line firewall. And be very selective about which internally hosted services you expose externally.

“Why would NATO do this?”

“Ethnic unity” is a euphemism for ethnic cleansing.

You are running into the ultimate, and ultimately unavoidable, limitation of self-hosting, which is the self.

You should run a VM on the VPS for Vaultwarden, with no other services in the VM except whatever you need to connect to it remotely. Keep it simple. Run an exact copy of the VM on your local server. Have the VPS instance push its database to the local instance regularly, to keep up with any changes that your users make. Make regular backups of the local instance.

When you need to update the software, freeze an image of the local VM and then update the local VM, then when you’re sure it’s stable, copy the updated local VM to the VPS. If either the local or VPS instance crashes out, you should be able to recover (or reproduce) one from the other.

In the end though, it is functionally impossible to ensure reliability by yourself. Hosting Vaultwarden on a VPS shifts the responsibility for running the underlying server and network connection to the provider, and probably removing the dependence on your residential network connection will be better for your family/users.

You are still the weak point in your system. You need someone else who can log in to your local server, and into the VPS, and perform recovery if needed. There is no technical solution for this. You cannot be the sole admin, and also ensure reliability for other users.

Even if there is some legitimacy to this motivation, it is very myopic and selfish.

Um, I think you didn’t actually read what I wrote.

Yeah… how exactly do you ventilate 40km of tunnel under the ocean?

The pump to drive air through 25km of duct would be an impressive piece of engineering all by itself.

The duct would be a real piece of work. The pressure in the middle of that pipe would be kind of nuts.

inorite

Huh… so…

There is not a tectonic plate boundary there… drilling a permanent tunnel could actually work… at least, it wouldn’t be especially vulnerable to earthquake issues…

That doesn’t mean it’s a good idea, of course… 85km is a very long distance to travel through a tunnel. A train would make a lot more sense than trucks for cargo movement.

Oh yeah, that’s a good reason to aid the expansion of global surveillance. Let’s all be complicit with the police state because we can’t acknowledge our social anxieties with a bit of honesty.

Here we go again…