Network Security

Good homelab security is layered. The router, the hypervisor, and the individual service all contribute different controls.

The Shift to Zero Trust

This lab originally relied on a traditional edge model: an ASUS router handling NAT, a stateful firewall, and explicit port forwards or Cloudflare Tunnels for remote access. We are explicitly deviating from that original design.

While Cloudflare Tunnels hide your public IP and provide a secure reverse proxy, they still fundamentally expose an endpoint to the public internet.

Instead, this architecture adopts an industry-standard Zero Trust Network Access (ZTNA) overlay.

• No Inbound WAN Ports: The MikroTik gateway maintains a strict default-deny policy for all inbound internet traffic. There are no port forwards.
• Authentication Before Routing: A user must mathematically prove their identity (via MFA tied to an IdP) before any network packets are allowed to route to internal services.

For a deep dive into how this is implemented, see Tailscale ZTNA & Subnet Routing.

Layered Defense

Even with a ZTNA perimeter, internal security remains layered.

Firewall Rule Example

# Allow web traffic to OpenWebUI from LAN only
iptables -I INPUT -s 192.168.1.0/24 -p tcp --dport 8080 -j ACCEPT
iptables -I INPUT -p tcp --dport 8080 -j DROP
 
# Block Telnet inbound
iptables -I INPUT -i eth0 -p tcp --dport 23 -j DROP

Pi-hole

DNS-level filtering can stop entire classes of traffic before a client ever reaches them.

That kind of filtering does not replace firewalling or authentication, but it is a useful low-cost control for home infrastructure.