Firewall

GNTECH Infrastructure Part 04: Proxmox Firewall, NAT, and Network Isolation

Protect the routing boundary before opening services: inventory firewall ownership, apply a deliberately scoped IPv4 forwarding and NAT lab, test negative paths, and keep a verified rollback.

OPNsense Virtual Firewall on Proxmox — Homelab Security

Deploy OPNsense as a virtualized firewall on Proxmox with VLAN segmentation, Suricata IDS/IPS, and WireGuard VPN. Real VM configs, bridge setup, firewall rules, and performance tuning.

Docker nftables Firewall Backend — Native Firewall for Containers

Migrate Docker from iptables to the native nftables firewall backend. Configure docker daemon.json for nftables on Debian 13, test port publishing, and troubleshoot common migration issues.

Fail2ban Docker Deployment — SSH and Service Protection for Homelab

Protect your homelab from brute-force attacks with Fail2ban. Deploy on bare-metal for SSH and configure custom jails for Docker containers using Traefik and Nginx logs with email alerting.

nftables Host Firewall for a Homelab — Add Rules Without Flushing Docker

Create and verify a separate nftables host-input policy, preserve service-owned tables, and understand why Docker published ports need forwarding rules.

MikroTik RouterOS 7 Firewall — Rules, FastTrack, and Connection Tracking

Configure a production-ready MikroTik RouterOS 7 firewall — understand filter, NAT, mangle, and raw tables, enable FastTrack for wire-speed forwarding, implement connection tracking state rules, and build brute force protection with dynamic address lists.

Proxmox VE Security Hardening — Firewall, 2FA, and Fail2ban

A comprehensive Proxmox VE hardening guide covering firewall rules, TOTP 2FA, Fail2ban, SSH lockdown, AppArmor, and unattended upgrades — secure your hypervisor beyond default settings.

Docker Bypasses UFW — How to Fix Firewall Rules Properly

Publishing a Docker port can make it reachable even when UFW says incoming traffic is denied. Docker routes published bridge-network traffic through NAT and forwarding rules; UFW’s host INPUT policy does not provide the access control you might expect. This guide separates two jobs: limiting where a port is published, and filtering which clients can reach it. Binding to a LAN address reduces exposure, but does not make UFW’s host-input rules control forwarded container traffic. ...

Building R1 — A MikroTik Router for VLAN-Segmented Homelab

Every homelab needs a solid network foundation. This guide walks through the full configuration of R1 — a MikroTik edge router with segmented VLANs, inter-VLAN firewalling, WireGuard VPN, and a Cloudflare Tunnel running directly on the router. The config below is based on RouterOS 7.22.1. Commands are split by section so you can follow along step-by-step. Replace anything in <> with your own values. Hardware Model: MikroTik E62iUGS-2axD5axT OS: RouterOS 7.22.1 WAN: GPON FTTH (PPPoE on VLAN 100) Port Layout Port Role Access VLAN Notes SFP1 WAN — GPON ONT, native vlan 1 for ONT access Ether1 CCTV 50 Untagged, camera network Ether2 MGMT 99 Untagged, management Ether3 MGMT 99 Untagged, secondary management Ether4 HOME 10 Untagged, main home LAN Ether5 Trunk Tagged Inter-switch link carrying all VLANs Step 1 — Bridge Setup Create the main bridge with VLAN filtering enabled, and a separate bridge for container veth interfaces: ...