<div dir="ltr">Having a DMZ or separate VLAN for the hosted services will help.<div>Setting up proper firewall rules, deny traffic from the public server to your internal network, and only allow traffic from your internal network TO the hosted services for management will help.</div><div>Controlling the inbound traffic to the hosted services to just the web ports via firewall, or using a tunnel that only exposes those ports will help.</div><div><span style="background-color:transparent">If you have dedicated physical hardware for the hosted services, and a separate physical network layer, that will help.</span></div><div><br>On that last one, I don't even have that. Some things to consider:</div><div>What if an exploit can be used for an attacker to gain RCE or shell access to the underlying VM?</div><div>What if an exploit can be used for an attacker to escape the service VM, and onto the physical machine (bypass hypervisor)?</div><div>What if the network security can be bypassed by VLAN hopping?<br><br>It's all levels of risk mitigation. I personally would rather have the public services running in a VPS, so even if it's compromised, that's the limit of the damage.</div><div>For private services for my family, and some limited access, I use encrypted tunnels or VPN.</div><div><br><br></div></div><br><div class="gmail_quote gmail_quote_container"><div dir="ltr" class="gmail_attr">On Wed, Aug 5, 2026 at 2:44\u202fPM William Park via kwlug-disc <<a href="mailto:kwlug-disc@kwlug.org">kwlug-disc@kwlug.org</a>> wrote:<br></div><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex">True.<br>
- they have way faster/unrestricted connection<br>
- they have better UPS<br>
- they do the backup<br>
- they have better network security<br>
<br>
Here, I have question about "network security". If you have similar <br>
firewall, shouldn't that be enough?<br>
<br>
<br>
On 2026-08-05 13:48, Jason wrote:<br>
> I would agree, a VPS for hosting the public websites is safer than <br>
> putting it inside your home network. Last thing you want is to expose <br>
> a service that can be exploited for remote code execution or shell <br>
> access on the underlying machine... Which are happening a lot more <br>
> often now because of AI.<br>
<br>
_______________________________________________<br>
kwlug-disc mailing list<br>
To unsubscribe, send an email to <a href="mailto:kwlug-disc-leave@kwlug.org" target="_blank">kwlug-disc-leave@kwlug.org</a><br>
with the subject "unsubscribe", or email<br>
<a href="mailto:kwlug-disc-owner@kwlug.org" target="_blank">kwlug-disc-owner@kwlug.org</a> to contact a human being.<br>
</blockquote></div>