Who This Is For
Beginner to intermediate.
Think of it like deciding which doors of your house actually need a doorbell facing the street. Most rooms were never meant to have a direct entrance from outside, even if it'd occasionally be convenient.
What You'll Build
A documented exposure policy listing every public port on your network and exactly why it exists.
Prerequisites
- An existing home lab with at least one internet-facing or forwarded service
Why Public Exposure Changes the Threat Model
The moment a service is reachable from the internet, it's being probed by automated scanners within hours, not years. The basic rule: do not expose management interfaces.
Keep These Internal or VPN-Only
- Proxmox
- Portainer
- NAS admin interfaces
- Router/firewall dashboards
- Grafana
- NetBox
- SSH
Better Alternatives to Port Forwarding
- WireGuard or Tailscale for remote access
- Cloudflare Tunnel only when genuinely appropriate for a public-facing service
- Reverse proxy plus strong authentication for anything that must be public
Firewall Strategy
- Default deny inbound
- Permit only what's actually required
- Restrict management ports to trusted subnets only
Account Separation
- One normal admin account per person, no shared logins
- No routine root login on any host
- Separate service accounts where practical
- MFA on every critical service that supports it
Ongoing Hygiene
- Keep a patch/update schedule
- Maintain an asset inventory and remove unused services promptly (see NetBox)
Security & Backup Notes
- This entire article is a security note, the deliverable is a written policy, not just a configuration change
Troubleshooting
- "It works from home but not remotely", usually CGNAT on your ISP connection; a VPN mesh service like Tailscale sidesteps this
- CGNAT limitations, confirm with your ISP whether you have a real public IP at all
- Hairpin NAT confusion, some routers can't route a LAN device back to itself via the public IP; use local DNS instead
- IPv6 firewall gaps, IPv6 often bypasses IPv4-only firewall rules; audit it separately
Lab Finish Line
A documented exposure policy listing every public port and why it exists.