Home server setup?

[xxlonewolfxx123]

Hi Guys,

 

I have a HP Enterprise Server which i plan to run multiple game servers on, I am looking for the best way to make this secure to use with my home network where in the best scenario the server has its own firewall and so does my Home-network.

 

The hardware i have use of will be:

 

Server

BTHomeHub 5

Gigabit Switch

HP MSM442 WAP

[Davit2005]

Are these servers going to be accessible from the Internet?

 

Judging by my Infinty hub you are going to have limited options for firewall/dmz if any at all you'd be better getting a 2nd hand Cisco router with built in firewall in my opinion. You can control the inbound traffic at the firewall rather than after it gets into your network.

[xxlonewolfxx123]

Are these servers going to be accessible from the Internet?

 

Judging by my Infinty hub you are going to have limited options for firewall/dmz if any at all you'd be better getting a 2nd hand Cisco router with built in firewall in my opinion. You can control the inbound traffic at the firewall rather than after it gets into your network.

 

Yeah it does seem limited, I was looking into something like PFSense is this something that would suffice perhaps on a VM on the server or something?

 

Yes the game servers and voice server will be accessible from the Internet.

 

Cheers.

[computer_expert]

pfSense or Sophos UTM 9 should do the trick (the newer sophos xg wasn't great when I tried it)

 

Also make sure you don't expose the IPMI/ilo nic to the internet either (more of a worry if you have a server that shares a nic port with the iLo functionality like Dell servers with idrac express)

[cpjitservices]

+1 for pfsense.

[xxlonewolfxx123]

Trying to decide the best way to achieve this, I am after having my router as my main firewall which will be connected to the server and then i want a second firewall to provide security for all of my other devices and so then i have the server and other devices separately protected, this is going to defeat the object if i run PFSense on a VM on the server with a LAN port going to a switch for other devices isn't it?

[Steve21]

Not sure if you particularly want it away from Windows etc, but any reason you don't just have a DMZ and then use Windows firewall on the game servers?

 

Unless you're specifically trying to do something "special" would certainly be easiest way. (And if it's a normal home connection I'm assuming it's not going to be thousands of players etc on it to warrant any proper ddos protection etc?)

 

Steve

[cpjitservices]

What are u trying to protect in a home network ?

 

Use PFSense as you would your router, What connection have you got ?

 

PFsense has quite complex fire-walling compared to a BT Home Hub. I wouldnt recommend running it virtual.

 

Set up a DMZ as @Steve21 mentioned above, otherwise your going to way over complicate things.

Edited October 3, 2016 by cpjitservices

[xxlonewolfxx123]

This is pretty much what i am after but just trying to see if the second firewall would be ok to setup on a server VM with one of two of its ports going to my LAN and the other is the incoming WAN from router.

 

Pretty much just trying to put another barrier to protect my internal network should the Server become compromised.

[Steve21]

Pretty much just trying to put another barrier to protect my internal network should the Server become compromised.

 

But with a DMZ they're effectively on a different network. The server has no access to the internal network.

 

http://tr1.cbsistatic.com/hub/i/2015/06/03/4222ed77-098e-11e5-940f-14feb5cc3d2a/5756029-DMZ-overview-B.gif

 

So the second firewall isn't really needed unless you want a firewall on the specific gaming server etc too?

 

Steve

[xxlonewolfxx123]

But with a DMZ they're effectively on a different network. The server has no access to the internal network.

 

http://tr1.cbsistatic.com/hub/i/2015/06/03/4222ed77-098e-11e5-940f-14feb5cc3d2a/5756029-DMZ-overview-B.gif

 

So the second firewall isn't really needed unless you want a firewall on the specific gaming server etc too?

 

Steve

 

ahh ok then i see thanks, any suggestions on achieving this on a budget?

[Steve21]

Pretty much all home routers have it built in nowadays. Under the firewall settings should be an option for DMZ, add the server IP to it and it'll stick it on it's DMZ area.

 

Normally used for things like consoles to allow direct access if they have issues with firewalls

 

Steve

[xxlonewolfxx123]

Ok cheers, looks like most people are saying on a budget level to use two routers with the 1st one connected to WAN and using DMZ with server and another connected to the 1st router with that providing a firewall for other home devices, does this sound like the best way?

[Steve21]

Don't see the point personally. One or two gives no differences :s

 

The firewall on the main router will protect the internal network from both external and DMZ machines. If that's breached your network is gonna go down anyway.

 

Think of a DMZ as a VLAN. Unless you give it access it's seperated.

 

Steve

[xxlonewolfxx123]

OK thanks for your help, will look into this when home and will get this setup.

[Steve21]

OK thanks for your help, will look into this when home and will get this setup.

 

A lot of it depends how complex and how much equipment you have

 

I mean you could have your "router" and then "sub-router" for internal, and "sub-router" for DMZ etc. If you want to do fancy bits on it.

 

But if all your talking about is hosting lets say a CS:GO server on it, one should do all you need (assuming it has the functions within it (not used BT but it's pretty standard))

 

Steve

[xxlonewolfxx123]

A lot of it depends how complex and how much equipment you have

 

I mean you could have your "router" and then "sub-router" for internal, and "sub-router" for DMZ etc. If you want to do fancy bits on it.

 

But if all your talking about is hosting lets say a CS:GO server on it, one should do all you need (assuming it has the functions within it (not used BT but it's pretty standard))

 

Steve

 

Yeah was only asking as some people say that the Home routers DMZ function is "Half DMZ" where all it does is open all ports to the specific device and does not prevent it from talking to other devices on the internal network where a "Full DMZ" from a better router would segregate it properly.

[cpjitservices]

Yeah was only asking as some people say that the Home routers DMZ function is "Half DMZ" where all it does is open all ports to the specific device and does not prevent it from talking to other devices on the internal network where a "Full DMZ" from a better router would segregate it properly.

 

I presume you have a fiber internet connection, use PfSense. Its free.

[xxlonewolfxx123]

I presume you have a fiber internet connection, use PfSense. Its free.

 

Yeah the top fibre package BT Offer, i'm getting around 80+ Down with 20+ Up. Will look into Pfsense as well as going to need another system to run it on 24/7.

[JackT]

Tbf for all the hassle its going to cause and the amount of kids that love to ddos servers you're better off renting a dedicated server from a company and using that. Depending on the game servers / voice servers you want to host you might as well look at something like OVH / So You Start for your hosting. If people ddos your home line im sure BT won't be impressed.

[xxlonewolfxx123]

Tbf for all the hassle its going to cause and the amount of kids that love to ddos servers you're better off renting a dedicated server from a company and using that. Depending on the game servers / voice servers you want to host you might as well look at something like OVH / So You Start for your hosting. If people ddos your home line im sure BT won't be impressed.

 

Yeah i understand where you are coming from however paying £40 Plus a month for dedi hosting is not what i would like to do (it is but the wife )

[cpjitservices]

I'd use PfSense and put the server on its own interface and set firewall rules on the LAN interface to not accept anything from that range set on the Interface card.

 

Server will get access to Internet but wont be able t access anything internal