Restrict your IOT to a guest network on your router
Done
No need to mess with Umbrel
1 Like
My home network is a bit more complex than simply having a “guest network” 
The proper way to do this is have Umbrel use a specific set of ports, just like very other network application (and how Umbrel used to work before the recent Tor proxy update)
you are worried about IOT right, or is your entire network infected with malware already?
Plus your router should have a firewall already
Not sure what additional firewall is going to do
You should read up on network security as it applies to larger networks. I have web facing services on one VLAN, IP cameras on another, Network management on another, etc, all isolated from each other except for specific allow rules in the gateway firewall for traffic that should be allowed.
2 Likes
so what is the problem?
your Onion service is hidden, umbrel is protected with password and 2FA, isolated from everything else in your network.
If you are so scared, don’t use umbrel.
SOLVED.
1 Like
Sigh. How do you verify that no traffic from
Umbrel is leaked outside the tor proxy? You can’t. Except you can limit and control any leaks by using a firewall and only allow traffic out to known Tor entry nodes on port 9001-9003 which are the default Tor proxy ports. However, a recent refactoring of the Tor proxy docker image used by Umbrel has lead to this no longer being a viable approach.
Unless you can actually help answer the original question here I don’t quite see the point in this debating the security benefits of a default-deny firewall policy. We obviously have completely different security requirements. You can read up on the NIST firewall guidance recommendations if you’re interested: https://nvlpubs.nist.gov/nistpubs/Legacy/SP/nistspecialpublication800-41r1.pdf
99% of Umbrel users just run their node on a flat home network with little to no security hardening. That’s fine. However, I have different requirements.
Wait a second, all umbrel traffic is routed through TOR, have you found out otherwise?
And all TOR traffic are encrypted regardless of port, are you saying the NSA is spying on your TOR traffic? lol
Unless you can sniff some unencrypted traffic from your umbrel, which I highly doubt, this is much to do about nothing
1 Like
has there been any reported hacks into an Umbrel Node? and how long has this Umbrel node software been UP&RUNNING/available - 1 year, 6 months, etc? being an IT person (before, retired now) and having worked computer network defense during that time, I understand the desire to have a FireWall to protect your network that includes the Umbrel Node.
I am waiting on a Raspberry Pi being available at the OEM that I will be using to try to set up an Umbrel Node. I have been into crypto since Dec 2020, so relatively newBEE in crypto, but have read a shitTONNE and watched a shitTONNE of crypto youtube videos… looking forward to trying to get a Bitcoin (and Lightening) node up and running…
1 Like
If your reasoning seriously is that since a 1-year old piece of software has no publically known vulnerabilities, there’s no point in implementing sensible networking security measures to protect it, I wouldn’t put much faith in your expertise as an “IT person”-doing-computer-defense. No offense.
1 Like
@nordlys did you end up with some kind of firewall setup? I am in a very similar position. I found other community members answers here very naive on why LAN security should be considered important. When it comes to securing funds of any size, Local Area Network security should be of high priority.
So many IoT devices are in everybody’s home network running on obsolete software. Those devices could very easily be used for brute-force attacking umbrel if it is not firewalled properly.
In my opinion the best way is to close all incoming ports to all IP addresses except the one is used for administration.
1 Like
What I ended up doing is basically having a ALLOW ANY rule outbound, preceeded by a rule blocking all access to all other VLAN’s. It’s not ideal since I have little granular control over what kind of traffic my node can now send outbound, but at least they can’t touch the rest of my network (and visa-versa obviously).