<html>
<head>
<meta content="text/html; charset=utf-8" http-equiv="Content-Type">
</head>
<body text="#000000" bgcolor="#FFFFFF">
<font size="-1">Last year I got rid of my broadband router all together
and opted instead to use a PfSense firewall on my VM box instead.
The best decision I ever made. </font><br>
<br>
<div class="moz-cite-prefix">On 11/05/15 10:28, Martin wrote:<br>
</div>
<blockquote cite="mid:55507630.5010109@ml1.co.uk" type="cite">
<pre wrap="">On 11/05/15 09:13, Jason Irwin wrote:
</pre>
<blockquote type="cite">
<pre wrap="">On 08/05/15 17:44, Jason Irwin wrote:
</pre>
<blockquote type="cite">
<pre wrap="">Now just to decide how to secure the thing.
Add fail-to-ban...
Maybe even VM...
</pre>
</blockquote>
<pre wrap="">
As I already have fail2ban running on a VM, simple enough job to set
that up as the gateway.
I plan to make sshd only accept certs*, limit access to a couple of
users, rate-limit login attempts in ufw/iptables and expose it on a
non-standard port.
Any other low-hanging fruit I should consider?
* Annoyingly the JuiceSSH Android app cert doesn't appear to work
despite being in "authorized_keys". Grr....
</pre>
</blockquote>
<pre wrap="">
If this is in effect a point-to-point tunnel, then you can stop most
break-in silliness by locking down by IP address to only accept the one
known good IP address...
However, if you also need remote access to set the thing up, take care
to not lock yourself out!
And then also, there is the good reminder with that most excellent flag
in Shorewall:
[*] ADMINISABSENTMINDED=yes
;-)
Good luck,
Martin
*:
<a class="moz-txt-link-freetext" href="http://shorewall.net/manpages/shorewall.conf.html">http://shorewall.net/manpages/shorewall.conf.html</a>
</pre>
</blockquote>
<br>
</body>
</html>