Home Network Security – The Idea (part 1)

I want a more secure home network. I do not know enough about network security, to do it perfectly from the start. I know some from my professional work. I asked people working with networks in their daily and tried to gather a sense of what I was getting myself into.

I have been googling “home network security”, reading some blogs, reading on forums and watched a few youtube videos. I will learn as I go, as the following parts will most likely show, with changes in the design.

I have been recommended mini PCs for OPNSense firewall. Get a proper WIFI Access Point. Run pi-hole for DNS control. Use a managed switch and VLAN.

I know that there are certain things / questions that needs to be uncovered / answered, early in a project:

• Is it smart to reveal a security setup on the Internet? No!
• A plan!
• What is my budget?
• What performance do I want?
• What features do I want?
• What is the life cycle economy?
• How much time do I want to invest in this?
• Is there a backup plan?
• WAF (Wife Acceptance Factor)?

A Home Network plan!

This is a mix of documenting what is on the network, and how I imagine to add layers of security to it.

Specific information on models, versions and revisions is left out on purpose.

Home Network Budget

The budget involves buying some kind of powerful hardware to run a firewall, as it will be running all traffic through it. I also wanted to scale up on the network ETHERNET backbone switch, preferably with a managed switch. I want a more powerful and scalable WIFI network, the current mix of ISP router WIFI and Google Mesh WIFI is not working great.

I will set my budget at 500 Dkk. which is around 666€. I hope I can acquire fast and semi future proof of the above listed parts. 666€ is still less than buying a plug’n’play firewall machine from something like OPNsense.

Performance, before and after?

Running everything through a firewall, should cost something in performances, like ping times. I did some speedtest.net runs over the holidays, so we can compare the results from before and after.

Being a 5G wireless router, speed does depend on network load, which in theory should be pretty high during holidays, as everybody is at home.

Features!

I would like to be able to:

• Separate my endpoints into groups, VLANs or different WIFI networks
• Be in control of which endpoints can talk to other endpoints or access the Internet
• Be able to stop unwanted outbound communication, from devices like Smart TVs
• Have easy administration interfaces

Life Cycle Economy

I want to avoid any kind of monthly expenses.

I could pay for individual VPN tunnels, for my computers and smartphones, but what about all the weird stuff on the network?

I like to own my security solution, or at least if VPN is wanted, it should be implemented in a firewall for the entire network.

Time

Time invested will mostly be on learning new technologies and software. A lot of time will also be spent on troubleshooting stuff that should work, but is not.

I imagine the following (an evening being around 2-4 hours with possible interruptions from being a family and having a home to attend):

• Read and get inspiration: 2-3 few evenings
• Finding, sourcing and buying hardware: 1-2 evenings
• Documenting the process and setup: 2-3 evenings
• Setting up hardware and installing software: 1 evening
• Configuration of firewall, WIFI, switch: 5-6 evenings
• Making it neat and tidy: 1-2 evenings

I can properly manage to work on this 3 days a week, so very realistically, this will take up to 5 weeks to complete. There could be weekends where I got a whole or half a day, where things move fast 🙂

Is there a backup plan?

What if something in the security setup makes Internet or services stop working, at a critical point where troubleshooting is not possible?

• The ISP supplied router will never know that anything changed
• A small unmanaged switch can be plugged into the router and supply access from its DHCP server
• A guest WIFI network, within the security setup with restrictions, could be used
• A “unsecured” WIFI network on the ISP supplied router could be activated

WAF

Wife Acceptance Factor is extremely important. Home network security should not inflict any kind of complexness onto the users (wife and kids), that is tiers higher than connecting to a regular WIFI network with a password.

Maintenance

Security updates are necessary to keep up with. Security updates will eventually also break something. Backup is key! Automatic backup routines to NAS will be looked into, else local backups on single devices / manual backups will have to do.