Hey there selfhosted community.
I had big plans when I moved last year to finally setup my homelab with proper VLAN seperation. Well a stressfull move later I simply had no energy left and just threw my whole homelab and all my services in my main LAN with no seperation whatsoever.
In how much of a world of pain am I in now when I want to switch my homelab services over in a seperate VLAN? Any recomendations or pointers to documentation for me to go through before I decide if this is something I want to do right now?
Currently this would impact a proxmox host with 3 VM’s and 1 LXC and around 20 docker images.
The argument was that the vlans force a device through the firewall so that the firewall can protect it. But for that to happen, like you said the firewall wasn’t strick enough or didn’t have a defense against a 0 day.
So the vlan doesn’t do anything either way. Either the firewall works in which case you don’t need vlans to force local traffic through them a second time or they don’t work in which case again the vlan did nothing.
firewalls are not for defending against 0 days. it is about access control, and reducing, sometimes even minimizing access to potentially vulnerable services. firewalls are not an infallible security tool, but there is no such thing either. the reason to use it is to restrict access such that fewer attackers can take advantage of a potential vulnerability.
there are intrusion detection/prevention systems that could do more, but it’s unlikely they will protect against 0 days, because 0 days are undiscovered and unknown issues.
it does. its useful to force traffic through a firewall. its for limiting what has access to what. if you wouldn’t use vlans, hosts on the network would not care about your firewall because they can just go straight to the destination.
I’m not sure I understand your argument, but I think what you say is, firewalls are not infallible so they are useless
I’ll try an analogy to explain better. The firewall is a lock on the door to your house. Vlans are a rule that to go from one room to another, you must go back out the locked door and back in.
So an attacker tries to come in and can’t pick the lock. You are safe.
Another attacker can pick the lock and get into a room. But if they can pick the lock for one room, they can pick the same lock again and get into any other rooms because it’s the same lock protecting every room in the house.