Segmenting networks and using VLANs are key strategies for improving security and performance.
Segmenting networks and using VLANs are key strategies for improving security and performance.
Seems like a solid concept. I believe @wseaton is overlooking… every component contributes, yet nothing is a perfect solution. If this is your sole focus, then you’ve missed the mark on opsec. Additionally, omitting vlans from your toolkit also indicates a failure in securing operations.
It would be better to plan carefully and consider alternatives before deciding to run separate cabling everywhere.
Yes, those older device grouping methods were typically found only in consumer firewalls, as most networks used solutions like Foritnet or Palo Alto with advanced microsegmentation. It would have been nice if there was a more flexible approach—perhaps a Virtual Local Area Network or VLANs—to simplify device grouping.
I found this concept really interesting! Someone deserves recognition for it. Oh, wait—this was already known and addressed for years? Wow. Sorry, no prize for @Lurick. I’m still hoping @wseaton clarifies why VLANs aren’t a good solution and actually strengthen security.
You're welcome on the topic. I'll focus on Avahi and firewall configurations for your TrueNAS Scale setup. Your NAS is built with SuperMicro, IPMI support, and ECC RAM—great hardware choice!
Avahi is merely a pfsense extension, simply install it, specify the target subnets, and everything should function smoothly. IPMI needs to reside on the management network as well. Adjustments to security settings or boot processes should stay within the management zone, along with BIOS access options. Truenas WebUI (with SSH enabled) must be accessible exclusively there. Restrict its connections solely to the management subnet, while SMB and similar services should connect to other networks. Since I’m using Proxmox for virtual machines, I’ve allocated two virtual NICs in Truenas—one without VLAN tagging (receiving full trunk traffic) and another with my lab’s VLAN tag, managed through Proxmox. This setup also applies to the management subnet. Additionally, ensure ZFS snapshots are enabled; they act as a safeguard against accidental changes or ransomware attacks. Snapshots are read-only except via Truenas itself, preventing unauthorized modifications by SMB or NFS users. If data becomes encrypted, you can restore it from a snapshot after resolving the ransomware issue—effectively resetting everything to its original state.
Are you really relying on IPMI for these servers located at home? I own two with it, but they don’t provide much value since the hardware is quite old. If you need access to IPMI, simply connect it to the management VLAN. Be careful not to lose access when changing settings—ensure you can still retrieve a snapshot if needed. Wouldn’t it be better to back up the current state before making any adjustments? And yes, it should automatically save a fresh image every few minutes; having a copy is wise in case of future encryption issues.