# Network Security Hardening Guide ## GeniusTechLab — 2026 Edition --- ## Table of Contents 1. [Introduction](#introduction) 2. [Network Architecture Principles](#network-architecture-principles) 3. [VLAN Segmentation Strategy](#vlan-segmentation-strategy) 4. [Firewall Configuration](#firewall-configuration) 5. [VPN Hardening (WireGuard)](#vpn-hardening-wireguard) 6. [DNS & Pi-hole / AdGuard Home](#dns--pi-hole--adguard-home) 7. [IDS/IPS Deployment](#idsips-deployment) 8. [Wireless Security](#wireless-security) 9. [Endpoint Hardening](#endpoint-hardening) 10. [Monitoring & Alerting](#monitoring--alerting) 11. [Incident Response Checklist](#incident-response-checklist) 12. [Security Audit Checklist](#security-audit-checklist) --- ## Introduction This guide distills the best practices from GeniusTechLab's 100+ posts on networking, security, and homelab hardening into a single actionable reference. Whether you're running a home network, a small business, or a homelab with 50+ services, these are the steps that matter most. **Who this is for:** Homelabbers, small business IT admins, and anyone who wants to move beyond default router settings and take network security seriously. **What you need:** - A router with VLAN support (UniFi, Mikrotik, or OPNsense recommended) - A managed switch (802.1Q VLAN capable) - A spare mini PC or VM for DNS/IDS (N100 minimum) - 2-4 hours for initial setup --- ## Network Architecture Principles ### The 5 Rules of Network Security 1. **Default deny, explicit allow** — Every firewall rule should start from "block everything" and only open what's needed 2. **Segment by trust level** — IoT devices, guest devices, and servers should never share a network 3. **Encrypt in transit** — All remote access via WireGuard VPN, never expose services directly to the internet 4. **Log everything** — If you can't see it, you can't defend it 5. **Patch relentlessly** — 90% of breaches exploit known vulnerabilities with available patches ### The Hub-and-Spoke Model ``` Internet → Router/Firewall → Core Switch → VLANs ├── Management (10.0.10.0/24) ├── Servers (10.0.20.0/24) ├── IoT (10.0.30.0/24) ├── Guest (10.0.40.0/24) └── VPN (10.0.50.0/24) ``` Each VLAN is isolated. Inter-VLAN traffic is routed through the firewall where rules control what can talk to what. --- ## VLAN Segmentation Strategy ### Recommended VLAN Layout | VLAN ID | Name | Subnet | Purpose | Internet Access | Inter-VLAN | |---------|------|--------|---------|----------------|------------| | 10 | Management | 10.0.10.0/24 | Network gear, admin access | Yes | To Servers only | | 20 | Servers | 10.0.20.0/24 | Homelab services, Docker, Proxmox | Yes | From Management only | | 30 | IoT | 10.0.30.0/24 | Smart home, cameras, appliances | Yes (DNS filtered) | Blocked | | 40 | Guest | 10.0.40.0/24 | Visitor WiFi | Yes (isolated) | Blocked | | 50 | VPN | 10.0.50.0/24 | WireGuard clients | Yes | To Servers only | ### Key Rules - **IoT VLAN has no access to any other VLAN** — smart devices are notoriously insecure - **Guest VLAN is fully isolated** — guests can only reach the internet - **VPN VLAN can access Servers** — for remote homelab management - **Management VLAN can access Servers** — for admin access - **Servers cannot initiate connections to Management** — prevents lateral movement --- ## Firewall Configuration ### OPNsense / pfSense Baseline Rules 1. **Default LAN → any** (start here, then lock down) 2. **Block IoT → RFC1918** (prevent IoT from reaching internal networks) 3. **Block Guest → RFC1918** (isolate guest traffic) 4. **Allow VPN → Servers** (for remote management) 5. **Block Servers → Management** (prevent lateral movement) 6. **Allow Management → any** (admin access) 7. **Block any → Management** (no inbound to network gear except VPN) ### Hardening Checklist - [ ] Change default admin password (32+ characters) - [ ] Disable admin access from non-Management VLANs - [ ] Enable firewall logging on all rules - [ ] Set up GeoIP blocking (block traffic from countries you don't do business with) - [ ] Enable IDS/IPS (Suricata or Sensei) - [ ] Configure rate limiting on WAN interface - [ ] Disable UPnP (manually configure port forwards instead) - [ ] Enable SYN cookies / SYN flood protection --- ## VPN Hardening (WireGuard) ### Why WireGuard Over OpenVPN - **10x faster** — kernel-level implementation, no userspace overhead - **Smaller attack surface** — 4,000 lines of code vs 100,000+ for OpenVPN - **Modern cryptography** — ChaCha20, Poly1305, Curve25519, BLAKE2s - **Roaming support** — seamless transition between WiFi and cellular ### WireGuard Configuration Best Practices ```ini # /etc/wireguard/wg0.conf (server) [Interface] Address = 10.0.50.1/24 ListenPort = 51820 PrivateKey = # Drop all traffic by default, then allow established + specific PostUp = iptables -A WG-INPUT -i wg0 -m state --state ESTABLISHED,RELATED -j ACCEPT PostUp = iptables -A WG-INPUT -i wg0 -d 10.0.20.0/24 -j ACCEPT PostUp = iptables -A WG-INPUT -i wg0 -j DROP # Client: Laptop [Peer] PublicKey = PresharedKey = AllowedIPs = 10.0.50.2/32 ``` ### Security Hardening Steps 1. **Use PresharedKeys (PSK)** — adds a second layer of symmetric encryption 2. **Restrict AllowedIPs** — only assign /32 per client, not the full VPN subnet 3. **Use firewall rules on the WireGuard interface** — don't rely solely on AllowedIPs 4. **Rotate keys annually** — generate new keypairs with `wg genkey` 5. **Use a non-standard port** — 51820 is the default; use something else 6. **Enable PersistentKeepalive** — only if behind NAT (25 seconds) 7. **Never expose the admin UI through WireGuard without MFA** — add TOTP or WebAuthn --- ## DNS & Pi-hole / AdGuard Home ### Why Network-Level DNS Filtering - Blocks ads, trackers, and malware domains for every device on the network - No browser extension needed — works at the network level - Caches DNS responses → faster browsing - Provides visibility into what domains your devices are contacting ### Recommended Setup 1. **Install AdGuard Home on a dedicated VM or container** (lighter than Pi-hole, better UI) 2. **Configure upstream DNS:** - Primary: `1.1.1.2` (Cloudflare malware blocking) - Secondary: `9.9.9.9` (Quad9 security) 3. **Enable client-specific settings:** - IoT VLAN: strict blocking + only allow approved domains - Guest VLAN: standard ad blocking - Management: no blocking (admin needs full access) 4. **Add blocklists:** - AdGuard DNS filter - OISD Big - StevenBlack unified 5. **Set up DNS-over-HTTPS (DoH)** for encrypted DNS to upstream ### DNS Firewall Rules - **Block IoT VLAN from using any DNS except AdGuard** (prevents devices from bypassing filtering) - **Block direct DNS to 8.8.8.8 / 1.1.1.1** at the firewall level - **Log all DNS queries** for forensics --- ## IDS/IPS Deployment ### Suricata on OPNsense/pfSense 1. **Install Suricata package** 2. **Enable IPS mode** (inline, not just IDS) 3. **Subscribe to ET Open rules** (free) or ET Pro rules (paid) 4. **Configure interfaces:** - WAN: IPS mode, block malicious inbound - LAN: IDS mode (monitor only, to avoid false positive blocking) 5. **Tune performance:** - Set `max-pending-packets: 1024` - Set `detect-thread-profile: medium` - Enable `ezq` mode for better throughput 6. **Suppress noisy rules:** - Add suppressions for internal traffic that triggers false positives - Start with alert-only mode for 7 days, then switch to drop mode ### Performance Impact | Router | IDS/IPS Throughput | Impact | |--------|-------------------|--------| | OPNsense (N100) | ~800 Mbps | 20% CPU | | OPNsense (i5-12400) | ~2.5 Gbps | 35% CPU | | UniFi UDM-Pro | ~3.5 Gbps | 40% CPU | | Mikrotik RB5009 | ~4.2 Gbps (raw) | 25% CPU | --- ## Wireless Security ### WPA3 Configuration - **Enable WPA3-Personal (SAE)** on all modern access points - **Fallback to WPA2/WPA3 transition mode** for older devices - **Disable WPS** — it's a known vulnerability - **Use 802.11w (PMF)** — Protected Management Frames prevents deauth attacks ### SSID Strategy | SSID | VLAN | Security | Band | Notes | |------|------|----------|------|-------| | GTL-Home | Management | WPA3 | 5GHz + 6GHz | Personal devices | | GTL-IoT | IoT | WPA2 | 2.4GHz only | Smart home devices | | GTL-Guest | Guest | Open + captive portal | 5GHz | Isolated, rate-limited | ### Additional Hardening - **Set minimum signal strength** (-70 dBm) to prevent distant attacks - **Enable band steering** to move clients to 5/6GHz - **Disable 2.4GHz for non-IoT** — 2.4GHz is more susceptible to attacks - **Use EAP-TLS for enterprise** — certificate-based auth, not passwords --- ## Endpoint Hardening ### Linux Servers ```bash # 1. SSH hardening sed -i 's/#PermitRootLogin.*/PermitRootLogin no/' /etc/ssh/sshd_config sed -i 's/#PasswordAuthentication.*/PasswordAuthentication no/' /etc/ssh/sshd_config sed -i 's/#Port.*/Port 2222/' /etc/ssh/sshd_config systemctl restart sshd # 2. Install fail2ban apt install -y fail2ban systemctl enable fail2ban # 3. Enable automatic security updates apt install -y unattended-upgrades dpkg-reconfigure -plow unattended-upgrades # 4. Configure UFW firewall ufw default deny incoming ufw default allow outgoing ufw allow 2222/tcp # SSH on non-standard port ufw enable # 5. Install and configure AIDE (file integrity monitoring) apt install -y aide aideinit cp /var/lib/aide/aide.db.new /var/lib/aide/aide.db ``` ### Docker Host Hardening - **Use read-only containers** where possible (`--read-only`) - **Drop all capabilities** (`--cap-drop=ALL`) and add only what's needed - **Use seccomp profiles** to restrict syscalls - **Enable user namespace remapping** (`userns-remap=default`) - **Scan images with Trivy** before deployment - **Use Docker Bench Security** for CIS benchmark compliance --- ## Monitoring & Alerting ### The 3 Things You Must Monitor 1. **Bandwidth usage per VLAN** — sudden spikes indicate compromise or misconfiguration 2. **DNS queries** — unusual domains or volume indicate malware beaconing 3. **Firewall denials** — repeated denials from the same IP indicate targeted attacks ### Recommended Stack | Component | Tool | Purpose | |-----------|------|---------| | Metrics | Prometheus + Grafana | Bandwidth, CPU, RAM, disk | | Logs | Loki or journald | Centralized log aggregation | | DNS | AdGuard Home query log | DNS monitoring | | Alerts | Alertmanager or Gotify | Push notifications for critical events | | Uptime | Uptime Kuma | Service availability monitoring | ### Alert Thresholds - **Bandwidth**: Alert if any VLAN exceeds 80% of allocated bandwidth for >5 min - **DNS**: Alert if any device queries >500 unique domains in 1 hour - **Firewall**: Alert if >100 denials from same IP in 1 minute - **Services**: Alert if any critical service is down for >30 seconds --- ## Incident Response Checklist When you suspect a breach or compromise: ### Phase 1: Contain (0-15 minutes) - [ ] Disconnect affected device(s) from network (pull cable or disable switch port) - [ ] DO NOT power off — RAM may contain evidence - [ ] Block the source IP at the firewall - [ ] Change passwords for any accounts that device had access to ### Phase 2: Assess (15-60 minutes) - [ ] Check firewall logs for the source IP — what else did they try? - [ ] Check DNS logs — did the device contact any suspicious domains? - [ ] Check AdGuard Home / Pi-hole logs for blocked domains - [ ] Check IDS/IPS alerts for the time window - [ ] Take screenshots of all logs (evidence preservation) ### Phase 3: Eradicate (1-4 hours) - [ ] Identify the attack vector (phishing, unpatched service, weak password) - [ ] Patch the vulnerability or close the attack vector - [ ] Reinstall the OS on compromised devices (don't trust "cleaning") - [ ] Rotate all credentials the device had access to ### Phase 4: Recover (4-24 hours) - [ ] Restore from known-good backup (verify backup integrity first) - [ ] Monitor the network for 48 hours for recurrence - [ ] Document the incident: timeline, root cause, lessons learned - [ ] Update firewall rules to prevent similar attacks --- ## Security Audit Checklist Run this checklist quarterly to maintain network security: ### Network - [ ] Firmware updated on router, switch, and APs - [ ] Admin passwords rotated (32+ characters) - [ ] VLAN configuration reviewed and verified - [ ] Firewall rules audited (remove unused rules) - [ ] IDS/IPS rules updated - [ ] DNS filtering blocklists updated ### VPN - [ ] WireGuard keys rotated - [ ] VPN access list reviewed (remove stale clients) - [ ] PresharedKeys rotated - [ ] VPN firewall rules verified ### Wireless - [ ] WPA3 enabled on all SSIDs - [ ] WPS disabled - [ ] Guest network isolated - [ ] Old/unused SSIDs removed ### Endpoints - [ ] All OS patches applied - [ ] SSH keys rotated - [ ] Fail2ban / intrusion detection running - [ ] Docker images scanned with Trivy - [ ] Unused services disabled ### Backup - [ ] 3-2-1 backup verified (3 copies, 2 media, 1 offsite) - [ ] Backup restore tested - [ ] Immutable backup configured (ransomware protection) ### Monitoring - [ ] Grafana dashboards reviewed - [ ] Alert thresholds tuned - [ ] Log retention verified (minimum 90 days) - [ ] Uptime monitoring verified --- ## Conclusion Network security is not a product you buy — it's a practice you maintain. The steps in this guide will take you from default-settings vulnerable to hardened and monitored. The key is consistency: run the audit checklist quarterly, keep firmware updated, and monitor your logs. For more detailed guides on specific topics, visit: - **Best Firewall for Homelab 2026** — geniustechlab.com/posts/2026-08-05-best-firewall-homelab-2026 - **Best Router for Homelab 2026** — geniustechlab.com/posts/2026-08-07-best-router-homelab-2026 - **Zero-Trust Network Segmentation** — geniustechlab.com/posts/2026-07-07-zero-trust-security-vpn-vulnerabilities - **Best Mini PCs for Proxmox** — geniustechlab.com/posts/2026-07-25-best-mini-pc-proxmox-2026 --- *© 2026 GeniusTechLab. This guide is free to download and share. For commercial use, please contact us at contact@geniustechlab.com.*