Homelab Security

I’m usually more of a lurker here, but I wanted to post this because I constantly see some version of:

“Never expose anything in your home lab to the Internet. Internet = bad.”

I understand where that comes from. Being extremely cautious is obviously the safest approach. Short of unplugging the computer from the wall, keeping everything completely inaccessible from the Internet is about as safe as you can get.

I just don’t think that level of isolation is always necessary.

So I decided to see what I could actually find out about my own environment.

I have several services exposed to the Internet, including Authentik, OMBI, Blue Iris, Immich, Lubelogger, AzuraCast, and Rocket.Chat.

Some of these are exposed through Authentik because they don’t have authentication that I’m comfortable relying on by themselves. Everything runs through an NGINX reverse proxy, and Cloudflare proxies DNS for most of it.

I absolutely care about security. I don’t want random people on the Internet having easy access to anything on my network.

At the same time, I want friends and family to be able to use some of these services without turning it into an IT project for them.

I know VPNs are commonly recommended, and they absolutely have their place, but I don’t think it’s reasonable for every use case to tell friends or family, “Install this VPN client on your phone or computer, connect to it, and then you can use this thing I told you about.”

Most people are just going to say no.

There’s a reason you don’t have to connect to a VPN before opening Google.

So I wanted to get a better idea of whether my current setup was actually full of holes.

At work, I have access to Horizon3.ai NodeZero. (horizon3.ai) It’s an enterprise automated penetration-testing platform that can perform both internal and external penetration tests.

I ran an external test against my home environment.

The short version is that the only thing it really flagged as a potential weakness was the Blue Iris web interface.

It was not able a compromise of Blue Iris. The finding was essentially that Blue Iris was exposing a management interface, although I don’t think that description is completely accurate for how I’m using it.

It discovered the other Internet-facing services as well, but it did not identify them as exploitable weaknesses and was not able to compromise them.

And I didn’t exactly make the test difficult.

I gave NodeZero every URL/DNS name for the services I had exposed, along with the public IP address of my firewall. In other words, it knew exactly what was there and exactly where to attack.

We use the same system against our company infrastructure, and when it runs, our firewalls and other security tools light up pretty heavily. It very actively probes, attacks, and attempts exploitation.

So I have every reason to believe it was doing the same thing against my home environment.

For anyone curious, my home firewall is OPNsense.

I’m not suggesting that exposing services to the Internet is risk-free, or that everyone should start opening ports on their firewall.

My point is simply that I think there’s a lot of room between:

“Expose everything with no protection”

and

“Nothing in a home lab should ever be accessible from the Internet.”

With proper authentication, reverse proxying, patching, segmentation, and some actual testing, I think Internet-facing home lab services can be done reasonably safely.

Feel free to ask questions about the setup or the NodeZero results. I have some redacted screenshots if anyone is interested.

And yes, if you want to tell me I’m an idiot for exposing things to the Internet, that’s fine too. 😄

I mainly wanted to put some actual test results out there for other people to look at and discuss.

Yes I wrote this and then had AI revise it, because I am not a good writer.