Building a secure home network

Question

I am trying to design my next home network and I was curious if there was an accepted pattern or if something like my design would work.

-> Main Gateway AT&T Duel Modem Router combo
    |-> Nice Firewall something like a Sophos
            |->DMZ Router cheap router
                |->Web Server - Public facing
            |->LAN Router cheap router
                |->Home Network - xbox, pc's, iot devices
            |->Lab Router cheap router
                |->Pentest Network - vulnerable VM's galore 

Would a setup like this benefit or hurt my network's security?

The caveat here is that I know very little about networking which is why I am trying to setup something complex at home.

My goals here are as follows

• All three sub networks have access to the web
• My Lab network isn't visible from the web
• My Lab network can't see my home network or my web server.
• My web server cant see my home network or my lab environment

I don't know if this is possible yet but that's why I am doing this.

Answer 1

Based on the information you have provided, i think you should start with having: - a good firewall (Sophos is ok, IF it has WAF (web app firewall) as blogs are mostly attacked using app level). But if you dont want to pay, then pFsense is also a good choice, its an all in one firewall.

• host it behind cloudflare or incapsula (preferably paid packege having WAF and DDOS prevention in it)

• IPS/IDS for detection and prevention of attacks (pFsense has snort for it or suricata)

• Network design seems to be ok, so its better to have vLANS for network segregation

• Monitoring system (with logging based on any SIEM, like OSSEC)

I think that should be enough for you

Answer 2

Also consider the following (they're also available under pfsense as well, if you go that route, but probably available on many other platforms:

As its a home network, I assume guests will use it. Set up 2 subnets that are separated, one for trusted use and one for everything else. Set rules that stop the 'everything else' network speaking other than to the WAN, or at least very limited other LAN locations. Use certificate based authentication not WAP2 on the trusted network (802.1X /WPA2-enterprise), its not hard to set up and it makes the network a lot more secure as you need a certificate (saved on your device) and password not just a password. Or look up OTP (one time password) which are those little tokens that change unpredictably and make 2 factor login possible. Don't trust MAC authentication as it can be spoofed. These will raise the barrier for people trying to get network access without permission.

Probe your own network - pfsense has nmap, use it. Check with online port scanners.

Assume your own laptop/device is a possible weakness (if someone controls that they get the network too). Ensure its secure and use good practices there.

Run squid + a network based malware scanner, and an IDS like securicata or snort. It won't solve everything but will catch a lot of known attempt types.

As for pfsense, one other idea - instead of multiple routers, get a 2008 core2 board (dual core or Q6600 or similar, they're all cheap) with 4gb ram for £50/$75 and a small (8-16gb) ssd off eBay (sometimes called a "disk on module"), put pfsense on it, and stack it with 2-3 network adapter cards off eBay (Intel if able and able to handle vlans for when you need them, most Intel Gb cards will). It'll cost less than an OEM router and it'll handle all the above with plenty of juice to spare, and handle any routing and firewalling you're likely to need between half a dozen local networks (whether physically separated on different poirts or logically separated by vlans). Don't worry about server quality - this kind of board can last many years and is cheap to replace/fix 2nd hand if it goes, and you don't need 99.9999% uptime.

Random ideas. Good luck!