What securing a homelab means
A homelab is a few computers and apps that you look after yourself, so nobody else is checking that they’re locked. Securing it means making sure only the people you chose can use your apps, that known holes get patched, and that a bad day costs you an evening rather than your photos.
You don’t need to be an expert. Most real trouble with home servers comes from a few causes: something left open to the internet, a password nobody changed, or software nobody updated. The checklist below covers each one, and none of it involves anything clever.
Private or public: the decision that matters most
The biggest single choice is whether anything you run can be reached from the internet. Automated scanners try every public address around the clock, so a newly opened port is often found within hours.
- Private means only your own devices can reach your apps, through a tunnel such as Tailscale. Nobody can try passwords on a login page they can’t see. This should cover almost everything you run.
- Public means anyone can reach it. Keep that for the things that need it, such as a website, and put only that one thing on the internet.
It has happened at scale. In 2022 the DeadBolt ransomware encrypted the files on thousands of QNAP and Asustor network storage boxes through flaws in their software, and it could only reach boxes that were open to the internet.
How home servers get attacked
| What attackers try | How it works | What stops it |
|---|---|---|
| Guessing passwords | Trying common and leaked passwords on any login page they find | Nothing exposed, a different password everywhere, two-factor |
| Known flaws | Looking for apps with a published security hole that hasn’t been patched | Nothing exposed, regular updates |
| Default logins | Trying the maker’s standard password on routers, cameras and apps | Changing every default password |
| A weak gadget | Using a cheap camera or smart plug with poor security as a way in | Updates, a separate network for gadgets |
| Ransomware | Encrypting your files and demanding money | A backup it can’t reach |
What it needs
- Your router’s login, to check port forwarding and UPnP. The networking basics page explains how to find it.
- A password manager, so every device and app gets its own long password. See password managers.
- An authenticator app for two-factor codes, covered in email aliases and two-factor apps.
- An hour for the first pass, then a few minutes every few months.
How “no open ports” fits in
Closing every open port is the pick because it shrinks what anyone outside can attack to almost nothing:
- Your login pages disappear from the internet, so password guessing and lists of leaked passwords can’t touch them.
- Unpatched flaws are much harder to reach, because an attacker has to get onto your network first.
- You get time. When a security fix comes out, you can update at the weekend instead of racing the scanners.
- Daily use stays the same. With Tailscale on your phone, you reach every app the way you do at home.
It doesn’t fix everything on its own. You still need updates, unique passwords and backups, because trouble can start inside the house too, from an infected laptop or a badly made gadget.
The easy way to set it up
All of this happens in settings pages and apps. None of it needs the terminal.
- Check your router’s port forwarding page. It may be called Port forwarding, Virtual servers, NAT or Applications. Remove every rule you don’t need, writing each one down first in case something you rely on stops working.
- Turn off UPnP on the same router. It lets any device in the house open ports without asking you. A games console may then report a “strict” or “moderate” NAT type, which affects some online games but isn’t a security problem.
- Turn off remote management of the router, and install its firmware updates.
- Set up Tailscale for anything you used to reach through a forwarded port. The remote access page and its guide show how.
- Change every default password on the router, cameras, printers and each app you install, using your password manager so each one is different. Turn on two-factor wherever it’s offered.
- Keep things updated. ZimaOS and CasaOS offer their own updates in their settings, and Ubuntu installs security fixes by itself. Update your apps every few weeks, after reading what changed.
- Make a backup that ransomware can’t reach, such as a USB drive you plug in for the backup and then unplug. See backups.
- Check from outside. Turn off Wi-Fi on your phone and try any address you used to forward. It should no longer load.
Questions people ask
Is Tailscale itself a risk?
A much smaller one than an open port. Only devices signed in to your account can connect, and every connection is encrypted. Protect that account well: anyone who gets into the Google, Microsoft, Apple or GitHub account you sign in with can add a device, so give it a strong password and two-factor.
Do I need antivirus on my server?
Not in the way a Windows PC does. On a Linux server, no open ports, regular updates and a good backup do far more. Keep antivirus on the computers where people open email attachments and download files.
How would I know if something got in?
Often not straight away, which is why prevention and backups matter more than spotting it. Signs include logins or user accounts you don’t recognise, files you can’t open, or the server working hard when nobody is using it. If you suspect something, unplug the server’s network cable, then rebuild it and restore from a backup made before the problem. Rebuilding is safer than trying to clean it.
Should smart gadgets go on a separate network?
It’s worth doing once you’re comfortable. Many routers have a guest network that keeps its devices away from your computers, which is a reasonable first step, though some gadgets then can’t be controlled from their phone app. Proper separate networks (VLANs) are on the firewalls and router firmware page.
What should my Wi-Fi security be set to?
WPA3 if all your devices support it, or the mixed WPA2/WPA3 mode if some don’t, with a long password. Turn off WPS, the push-button pairing feature, because it has a history of weaknesses.
