Hey y’all, I have a small network with opnsense firewall, a unify ap, some client in different subnets, vpn, DNS and some servers.
As I am completely self thought, I got everything to run reading the docs and forums, but I have no idea how to test if what I build is safe and stable.
Are there good up to date tools, or checklists one could follow to audit the different parts of the network (most important the opnsense config)?
What do you check if looking for security issues?
The network mostly relies on client separation through different subnets on different vlans, but I fear I dont understand how for example the vpn and the nas work together in detail to be sure there is no security implication I oversee.
Also: how do you handle client authentication for devices on the same subnet? I know IP/mac-adress ARP entries are easily spoofed and therefore not secure, but I haven’t seen how to do it correctly
Let’s look at the recent case where the FBI/Google took down a sites related to a botnet that was using Android TV boxes that came equipped with malware. These were cheapo, third tier units probably sold via Temu or some equivalent.
In this case they were being used to relay and obfuscate crime related traffic, but there’s no reason that the same technique couldn’t be used to more directly attack the hosting network.
I think that if you assume that device that you plug into your network could be used as an edge router into your network for a WireGuard connection with the outside world, then isolating those devices from your homelab is a good idea.
Something like an Android TV box obviously needs to connect to the Internet, and there are good reasons that you might want to run a VPN on it too. So trying to limit its access to the Internet via ports would be difficult. A VLAN would give me some piece of mind here.