Want to harden my home network, looking for advice

[Rifter]

This is going to be long, and cover alot of aspect of home network, sorry ill break it down into full and bullet format. Thanks in advance.

CLIFFS:
- im old, current knowledge in security/networking consists of IIS and NT 4 server era hardware/software, you know when buying a cisco pix and calling it good was all there was.
- Want reliable secure home network with cutting edge features(Qos, network level AV, IPS/IDS, add blocking)
-planning to buy supermicro sys-e200-9b, anything better available in mini-ITX or NUC format?
- What software do i want to run?, im thinking after initial research about pfsense with squid\snort. better options? should i run multiple software's in VM?

FULL VERSION:

What i want is to build a new fully secure and safe home network, harden it against attack, and have more control over it in general, with good monitoring and logging. Right now im just using a soho wireless router with a statefull inspection firewall, because im lazy and back in the day stateful inspection was all that was available and needed. I have worked in IT before in a web hosting company, back in the 90's, so i have experience with enterprise level firewalls and networks but its seriously outdated, like from when IIS and NT 4 server were cutting edge..... so i have old knowledge and understanding of how networks work, but need updated info on new software/hardware. Lately ive just been PC gaming with no attention to keeping up to date with networking.

What i want the software(s) to have:

- Network level antivirus/malware inspection of all HTTP and HTTPS traffic in realtime
- Ability to put my current router in its own network(DMZ) and use it as just a wireless AP with no access to wired network at all just internet access(to prevent attacks coming from hacking my router, i live in a dense metropolitan area, and from my cell phone i can see over 200 wireless networks, thats how dense... its insane, figuring out good bands to have decent wireless throughput has been a challenge to say the least, i have more than 4 30+ story apartment building withing a few hundred feet of me)
- Qos\traffic shaping
- IPS/IDS, the more advanced the better
- Would love to have virus/malware inspection of torrent traffic in realtime on the network level but have not figured out how to do this yet, any ideas???? layer 7 DPI looks like it could do this but i have no idea how to implement this, i would imagine that if the torrent traffic is encrypted that this will be a monumental task indeed, if its even possible.
- ability to block telemetry data going back from wired lan to internet from me and the Gf's main PC's(both win10), i realize this will likely entail packet inspection from wired LAN PC's over time and customizing the firewall rules to block this, thats ok im willing to put in the time/effort to make this happen, i know how to use wireshark to inspect traffic\packets and ports, but software that will log this traffic to be inspected later would help, not sure if any pfsense packages can do this but im willing to make custom firewall rules anyways.
- Add blocking on the network level(i have a rasberry pi with pi-hole doing DNS level ad blocking now which is very effective, i can keep using this or if better option let me know)
- Caching web proxy to save data usage, transparent proxy ideally.
- Good VPN support
- Obviously DHCP server will be needed

This is spurred on by all the telemetry and data mining going on nowadays and adds, everyone is after your data and i finally want to put a stop to as much of it as i can and protect my personal data and my network/data seriously, more than what SOHO routers offer, and with all the legal issues with torrents i would like to keep that as anonymous/safe as possible as well. I just want better than what SOHO routers can offer, i want to get back to more of an enterprise level of network monitoring and fire walling. And im worried as much about telemetry/data going out as i am about outside attacks coming in, actually im worried more about personal data going out lol.

To do this im planning on buying a supermicro sys-e200-9b, this is a quad core intel n3700 with 4 intel NIC's in mini-ITX form factor. I will put the full 8GB of ram in it, and run a SSD 64 or 128GB. If you guys have a better small mini itx or NUC size computer to use let me know. Has to be small, im going to wall mount it beside my router/cable modem. so no full size atx or micro atx or rack mount. Would like to keep power usage below 20-30w for whole system.

From what i can tell after preliminary research Pfsense with squid and snort can do most of what im after(i used iptables back in the day, thats how old i am....) If there is a better software package to use please let me know. Im willing to run this on anything BSD/Linux/Windows doesnt matter, the hardware ill be buying can run anything x86, ill even go ARM hardware if that is more feasible, im out of date on software, let me know. I doubt buying a windows server license is worth it over linux/BSD but im open to anything. I dont care if its CLI or GUI , i can do both, im looking for whats most effective and capable. I just want something that will work and work well, and be as reliable as the price of gold.

A question though, i have never ran VM's before for anything beyond basic research on new OS's. Im currently running alot of servers on my LAN, a DLNA media server, Lan file server, FTP server, HTTP server, Mail server. These are all currently running on different ATX PC boxes or NUC/pi's on a wired LAN(thats right, im running 5 PC's as servers for different tasks, not counting my main PC and the Gf's, on various OS's). This consumes alot of power I would like to consolidate these if possible. Would running them and Pfsense on the same supermicro box im planning on buying all in VM's be as secure as running them separate?

Or am i better off having a dedicated pfsense(or other firewall) box on the perimeter and then running all the servers in VM or just all on one OS on one box inside the firewall? The most powerful computer serving currently is a AMD Phenom II 940 with 8GB ram, im sure it could run all servers in VM or all on linux/windows if this is a good idea as running them separate.

To all who read all that, thank you! and let me know your opinions. I hope i didnt come off as a paranoid mofo lol.

 

[VirtualLarry]

I'm interested in what you decide as well. I have a fairly complex network (FIOS connection), with several NAS that I don't want to have acessable from the internet, except for one doing web serving. I have both an outer (Verizon) as well as an inner (mine) router protecting my LAN and providing my wifi. I also have several desktops and laptops, that use the internet as well as my NAS units.

I was recently compromised, as was my Paypal, apparently. A few months after I upgraded my main rig to Win10, although I think that perhaps one of my NAS units was possibly compromised somehow, before that.

I've re-formatted, with a fresh new primary SSD, the Win10 box, and I've updated the firmware on all of my NAS units, and changed their passwords.

But I'm still uneasy, and worried that there may be further backdoors in some of my equipment.

 

[Rifter]

I'm interested in what you decide as well. I have a fairly complex network (FIOS connection), with several NAS that I don't want to have acessable from the internet, except for one doing web serving. I have both an outer (Verizon) as well as an inner (mine) router protecting my LAN and providing my wifi. I also have several desktops and laptops, that use the internet as well as my NAS units.

I was recently compromised, as was my Paypal, apparently. A few months after I upgraded my main rig to Win10, although I think that perhaps one of my NAS units was possibly compromised somehow, before that.

I've re-formatted, with a fresh new primary SSD, the Win10 box, and I've updated the firmware on all of my NAS units, and changed their passwords.

But I'm still uneasy, and worried that there may be further backdoors in some of my equipment.

This is basically why im doing it as well, my mail server has been compromised twice in the last year and started going im sending spam to the whole internet! on me, i guess this shouldn't surprise me its running a old non updated OS, since i never use it directly its been setup the same since the early 2000's i just let it do its thing and monitor the logs monthly the attack/infection has to have come from the outside, or one of the other PC's on the network. Since stopping my Gf from clicking stupid shit in her browser is like trying to make a crack addict stop smoking crack this is why i want full HTTP and HTTPS AV/anti malware protection on the network level in realtime. I think my issues lie with her PC, id put it in a DMZ but she would kill me She refuses to use a less than admin account on her PC and doesnt even use any noscript/popup blocking plug ins, its scary actually, she nukes her PC at least twice a year with some kind of virus/trojan/infection.

I mean stateful firewalls are good and all, but if your PC/server gets infected a stateful firewall isnt going to do shit because you(you pc) are opening the network connection so it will think its legit, you can play the cat and mouse port blocking game but this is reactionary and tends to bring on frustration when you run into the issue of legit programs using the same ports as viruses/trojans and just turns into a mess. I want to be proactive not reactive so I need a smarter firewall, im hoping pfSense is it.

Also i met up with a few old friends from my ISP days, some of which are still in the business, and some of them have had security issues since going to win10, one had his personal banking info taken and had someone else try to log into his online banking, some guy from india apparantly, this makes me think win10 is not as secure as everyone seems to think so im worried about my 3 win10 boxes, im sure it will get better over time windows tends to do that security wise. Of course these guys still in the business are like no problem just buy(insert $10,000 enterprise level hardware firewall here) and you will be fine! which obviously doesnt help me as im not made of money nor do i have the room for a rackmount firewall in my living room, this is why im looking for free open source options that i can run on small NUC/microITX size PC.

So far my plan is probably going to be setup pfSense with squid/snort on the supermicro box i plan on buying, and seeing what i can get out of it with the available packages, i may be happy with this ive never run it so dont know yet.

Then Im probably going to move all my servers to my phenom II box, have not decided if i will just transfer them all over to one real linux/BSD OS or run alot of VM's, they currently span windows/linux/BSD environments, installing them all into one real OS will take alot of time, but may be worth it over running them in VM's, i have no idea of any possible security issues if i run alot of servers in VM's on the same box, especially if some of the VM's would be outdated OS's no longer getting security updates. And ill put this server in its own VLAN for better security and monitoring ability, or even in the DMZ with the wireless AP. Currently some of them are running on old no longer supported OS's, so moving them all to one real new current linux/BSD OS is probably the best move here security wise. I have 2 domains i use for personal crap, posting pics online for family, testing webpages stuff like that, nothing serious but im running a HTTP/FTP/Mail server to use these domains. so far only my mail server has been an issue, and i want to stop that from happening again.
.
Ill also keep my wireless AP as separate from my wired LAN as possible, in its own DMZ ideally not the fake DMZ most SOHO routers can offer, there is so much wireless traffic in my area i simply dont trust wireless, and i have Ethernet cable run to everywhere that needs it anyways i use wireless only for phones and tabs, i dont want this to be a weak point in my network. Undecided if i will put my server box in same network/DMZ as the AP as i want to be able to log into it the server from my desktop through the internal network, i can probably set rules in pfsense for allowing this, but im not sure if that will weaken/defeat the purpose of a DMZ in the first place, so server and AP may be separate. If my phones/tabs need access to the internal LAN(rare) they can VPN into it, i have a feeling this will be more secure than a bunch of rules letting traffic in from the phones through the DMZ directly, again probably defeats the purpose.

Ill probably keep my Pi-hole DNS server going for add blocking, at least until i find out if pfSense has a package that can replace it, or has other add blocking abilities. For $35 this by far seems to be the best way to block adds on the DNS level with dedicated hardware, I love this thing.

If anyone has any suggestions other than Pfsense please let me know. DPI sounds great from what i know about it(which is little), any open source options for a good DPI firewall? Can pfSense do DPI? The friends i have still working in enterprise networking think its the best thing since sliced bread, but they all use it on dedicated hardware costing as much as my car or more. So not sure if a real DPI firewall is even feasible on the hardware i will be using.

 

[iwajabitw]

I just bought Untangle, $50 annual, for home. My Linux skills are rusty but haven't needed them yet. It's free to use a and play with, which I did for 2 weeks before purchasing. Some of the apps expire, without purchase, but have lite versions that are free. I installed on a Core 2 Duo, 4gb ram, 80gig hd and it barely uses 1/4-1/2 the resources. I have about 20 computers for Boinc and the rest are cell phones, Xbox and such....So far so good.

www.untangle.com

 

[Red Squirrel]

Pfsense or/and untangle are pretty good. I personally use Pfsense. Vlans are something nice to implement too which will require a managed switch, you can split stuff up based on purpose/risk to minimize the attack surface should something get compromised. For example if you run any kind of servers like a Minecraft server, you put that on a separate vlan than your main network. If there is an exploit in the Minecraft (or any other game/service) server that allows remote code execution or what not, it's limited to that vlan. Of course vlans alone won't do that, but with a proper firewall you can setup rules between vlans. By default I block everything and only allow what is required.

I also put wireless on a separate vlan, that one can access a few things like environmental controls, which obviously could be a risk, but it's still better than full blown access to the entire network, should it get hacked. I also have a separate guest wireless vlan, that one has an easy password but is limited to strictly the internet, and only certain ports like 80, 443 etc.

One good mindset with security is thinking of what could in theory be possible, even if you figure it probably is not. Best to secure yourself from a non issue, than finding out later that it is an issue. If you are about to plug something in your network, consider what if there is malicious code on it to spy on you, scan your network, and try to infect it? Chances are, that is not the case, but then consider that the NSA intercepts random stuff like Cisco devices... what else do they intercept and what kind of damage could they really make the code do if they really wanted? Could they also plant trojans on consumer home automation stuff, which then spreads to the rest of the network? Perhaps. If something is technologically possible, consider it a possibility. If it's closed source, there is no way for anyone to check. Speaking of IoT... DISABLE uPNP! A lot of devices will use it, uPNP allows a device on the inside from opening ports on your router! It is a ridiculous feature that should never have existed in first place. Pfsense has it disabled by default I believe.

These days the biggest threat is not so much being hacked in the traditional sense, where your stuff gets deleted, altered etc, the biggest threat is being spied on, usually by the government. While it's hard to make your every day activities spy proof, you can make it harder on them by not using mainstream stuff like gmail etc. But that is getting beyond home network security, but figured I'd mention it as it kind of falls into the same aspect.

 

[XavierMace]

I prefer Sophos UTM to pfSense as it has more features out of the box and is far more user friendly. pfSense has a smaller resource footprint thought.

 

[Rifter]

I prefer Sophos UTM to pfSense as it has more features out of the box and is far more user friendly. pfSense has a smaller resource footprint thought.

Thanks ill check it out, Always good to have options.

 

[MrAlexander006]

Thanks ill check it out, Always good to have options.

I second the Sophos UTM recommendation. I've used this for years using their free Home license, and will most likely be moving my business to it soon since I like and am familiar with it now.

 

[John Connor]

https://netgate.com/products/sg-1000.html

 

[33Whiskey33]

Any update as to what your final solution was? I am currently looking at pretty much the same thing. Except I was thinking of running the SG-1000 as a perimeter firewall, and then the sys-e200 as a web server / Pfsense vm (more power for experimentation on plugins) / home lab.