I'm planning to set up a local server (Minecraft) accessible by only one other person connecting from a static IP. It's on a dedicated machine that I can easily wipe (Raspberry Pi).
I'm looking to expose only one port, keep the OS up to date, run everything via a limited user, etc... but for the purpose of discussion, let's assume that it's a given that it gets hacked.
I'm not a security expert, up until now my policy has been "it's easier to guard a house without doors." I basically don't open up my network at all - I even force friends to use guest wifi. So my ideal setup here would still allow me to shut down most access to my network.
Preferably, I'd like to have the server on a completely separate network (and maybe the answer is just "sign up for a Digital Ocean droplet"). DMZ is what I'm seeing people recommend, but there's just as much talk saying that consumer-grade routers rarely get it right, and that a bad implementation can be even more risky than port forwarding.
- How can I tell if my router implements DMZ correctly?
- If it is implemented correctly, is it something I can trust to keep my home network completely isolated from a compromised device?
- Am I over-rating the dangers of exposing a single port? Are there better ways of allowing remote access from a single remote IP?