[kwlug-disc] Home Web Servers Security

[Paul Nijjar]

I am not an expert on this and don't know current best practices, but
here is some generic advice: 

- Put the home server on its own VLAN (often called a DMZ), if you
  have the networking capability for this. Then in pfSense strictly
  block outgoing access from this VLAN to your home network. 
- Put firewall rules on the host only allowing port 80 and 443 traffic
  to the host, and maybe incoming SSH from your home network if the
  box is headless. 

I also do not know what current practices are from Rogers with respect
to running these servers. I thought they used to block people hosting
websites from residential IPs?

My understanding is that AI scraping has driven everybody's bandwidth
bills sky-high, so that is something to watch for as well. 

What is the current hosting for these sites? Are they all on separate
hosting plans? Would it be cost effective to consolidate them onto a
small VPS in the Cloud (tm)? That has its own disadvantages (if one
site gets compromised then they all do) but it may put your home
network at less risk.

- Paul

On Mon, Aug 03, 2026 at 02:09:07PM -0400, Jon Thiele wrote:
> Looking for some advice.   I manage Wordpress sites for three
> charities I'm involved in. Very low traffic - maybe 500 hits a month
> combined.
> 
> The cost is starting to get a bit pricey since I pay for these sites
> myself.   I was thinking that I could handle this using my own
> standalone PC.  So I cloned one site and set it up on Ubuntu 26.04.
> Everything went well - but now I'm thinking about exactly how to set
> up the networking part securely.   I'm on Rogers and right now and I'm
> forwarding ports 80 and 443 to my PC on my internal network.  Is this
> good enough?  I've used pfSense in the past and could use their port
> forwarding feature but not sure what the difference would be.  If you
> run a home server, what did you do?
> 
> Thanx.
> 
> Jon
> 
> _______________________________________________
> kwlug-disc mailing list
> To unsubscribe, send an email to kwlug-disc-leave at kwlug.org
> with the subject "unsubscribe", or email
> kwlug-disc-owner at kwlug.org to contact a human being.