26
Including a Pangolin VPS in homelab cluster? (lemmy.ml)
submitted 1 year ago by to c/selfhosted@lemmy.world
6 comments fedilink hide all child comments
 

I'm slowly working my way through deploying Pangolin on a VPS to securely expose some services publicly. I came to wonder a bit about how to approach this VPS security-wise. My homelab runs as a Nomad/Consul/Vault cluster, and it would have been nice to have the VPS as a client node as well, allowing me to spin up and manage the Pangolin components with Nomad jobs. However this means that the VPS would need connectivity to the cluster, essentially a Wireguard connection back to my LAN, this got me thinking.

Should I just forego the entire cluster client idea here and instead see the Pangolin VPS as a completely isolated thing, or is there some secure way to tighten down the connection to my local network with Wireguard? I could for instance restrict the AllowedIPs for the VPS to only be able to reach some specific host for the clustering.

Anyone done anything similar and care to share?

you are viewing a single comment's thread
view the rest of the comments
[–] [S] 1 point 1 year ago (2 children)

But I think that's kind of where the problem lies; if we're talking about external firewalls applied on the cloud provider, then I need an external IP for my homelab network to use in the rules, which defeats the point of Pangolin to begin with. And if we're talking about the firewall inside the VPS, like ufw or whatever, then that would be forfeit if a bad actor would gain root access on that host, they would just disable the rules. This is kind of where my thinking is at currently.

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 2 child comments
    •
  • [–] 1 point 1 year ago (1 child)

    A layered defense is always best. Nothing is 100%, but knowing your threat model will help define how far you have to go and how many layers you want in the way. Defending against State level actors looks different than swatting the constant low effort bot traffic. You're right, if a bad actor gets root on your machine, all security is forfeit. The goal is to minimize that possibility by keeping applications and packages updated and only allowing necessary connections to the machine. You mentioned wireguard or tail scale. Set that up first. Then set up the host firewall to only allow outbound traffic onto the VPN to the required ports and endpoints on the LAN. If the VPS isn't hosting any public facing services, disable all traffic except the VPN connection from and to the public Internet both on the cloud provider's firewall and the host firewall. If it is hosting publicly accessible services then use tools like fail2ban and crowdsec to identify and block problem IPs.

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 1 child comment
    •
  • [–] [S] 1 point 1 year ago* (last edited 1 year ago)

    Yeah I think were on the same track, what I can think of is to do this;

    • Set up firewall rules on my LAN router (which hosts the Wireguard server), restricting access to the Wireguard client coming in from the VPS.
    • Set up firewall rules on the cloud provider to restrict access to anything but my public IP where the Wireguard server is hosted.
    • Do the same in the VPS host internal firewall.
    • Configure the Wireguard server and client config to only allow access to the IPs relevant for the clustering.
    • Set up CrowdSec as part of Pangolin, it's an integrated feature
    • Move the Newt + service containers exposed via Pangolin to their own isolated VLAN in order to further harden the environment around them
    • Configure Nomad and Consul tokens to only allow the VPS to register the Pangolin services and nothing else
  • permalink
  • fedilink
  • source
  • parent