Could a Netgate be used to protect my Home LAN from my Home Lab?

vargas

I am in the process of setting up a Home Lab.

I will be testing nefarious websites. Some of which could be malware-laden. I don't want the nightmare scenario of other devices on the network getting infected ransomware or any other wormable malware.

Would a Netgate Firewall make sense?

johnpoz

@vargas sure pfsense allows for easy firewall between devices on different networks. Like your normal network from your "lab" network(s)

Can be used to filter traffic where can go, where can't go on the internet, etc.

vargas

thanks @johnpoz.

What would be the best way to do this with pfsense?

johnpoz

@vargas not sure what you mean "best" way? You can run pfsense pretty much on anything.. old pc, as a vm or sure yeah buy a netgate appliance.

I have a sg4860 in my house.. Run multiple vlans and do isolation for my iot devices from my normal stuff. Multiple wifi vlans, etc.

I don't have a "lab" since to me is a lab you something you fire up to "test/play" with something specific.. If its your "production" network its not really a "lab" ;)

While I lab stuff all the time, its pretty much all done in vms on my "production" network - just isolated from day to day stuff "normally"

My switches and AP allow for vlan anything I need off and isolate it for "testing/playing"

vargas

@johnpoz said in Could a Netgate be used to protect my Home LAN from my Home Lab?:

My switches and AP allow for vlan anything I need off and isolate it for "testing/playing"

Great, so what is the difference between VLAN segmentation and firewall segmentation?

johnpoz

@vargas nothing really ;) You can filter traffic at pfsense unless the traffic is being routed through pfsense.. You could bridge to isolate devices on the same L2 network.

But in general devices on the same network would need to run their own host firewall to prevent or allow traffic from other devices on their same network. Pfsense does not get involved communication between devices on the same network.

Putting devices on their own vlan also creates a different broadcast domain. So only devices on that specific network would ever see broadcast or multicast from devices on the same network.. So even if allowed all traffic between vlans - they wouldn't really be able to do any sort of L2 discovery to find other devices on the network..

SteveITS

@vargas Even the devices that have switches, like the 2100, can be configured to treat the ports as independent ports. At that point the ports are configured as separate networks, and you just put in a rule to block traffic from LAN to LAB and vice versa.

vargas

Thanks Jon and Steve - I very much appreciate your informative answers!