Testimonial: NethSec8 on a VM in Proxmox

Hi All

As promised earlier, here’s also a Testimonial for NethSec8 running on a VM in Proxmox.

The Testimonial for a hardware native install of NethSec8 can be found here:


For this Testimonial I installed a suitable VM in my Proxmox with the following settings:

Other than this, I followed the instructions here:

Installation — NethSecurity documentation

→ For LAB purposes, I have a vLAN (vlan99) simulating an Internet connection by a Provider.
This provides a 172.25.99.0/24 network, isolated from other LANs but with Internet.
NethSec8 WAN is connected to this, the LAN is connected to my LAN here.


Installation is very quick on Proxmox, even on a low powered Hypervisor.

This is VERY irritating:

Waiting for the boot progress to finish, and a login to be displayed, so I can install qemu-ga…

Nothing happens…

Hitting any key will display the big secret:

Why not show this during any boot?

In any case, it did work.

Nice, clean Dashboard.

→ After firsst Installation, CPU Info would be nice (Cores, etc).

In the meantime, I am aware of the (for me VERY unusual “Bridge” concept) - so one of my first steps was to remove the bridge.

As this is a VM in Proxmox, and actually already backuped to PBS after the initial installation, AND the fact that this is not my actual Internet connection I am not having any risks…

The removal of the bridge did go straightforward - yes. But the WebGUI does not automatically refresh, like other such products - or even NS8. So the bridge is still displayed, with no NICs attached. After a while, it did dawn on me to refresh, and all appeared as expected.

→ The GUI must have a refresh function!!!


Now, as said, the dashboard does have a clean look and feel. But there’s NO Options to display what’s needed and used, and hide or not display what’s not needed or used.

For a lot of my clients, Hotspot is not usable. Fine.
So why can I not remove or hide it from the dashboard?

:frowning:

As an example:

Unifi also offers something similiar to ThreatShield, with an Opt-In Feature.
On the Dashboard, this is displayed:

Bildschirmfoto 2024-12-26 um 05.05.18

As soon as you Mouse-Over, the *Hide" button is displayed…

Note:
This does NOT advocate for CyberSecure by ProofPoint - Neither my clients nor I use this.

But I did want to show how such an Info can be displayed, yet also easily be “hidden” so as not to leave the impression of a “Nag” screen for something I do not want.

It can always be activated on the System/Security screen, then it displays as expected on the dashboard.

This would be a good idea how to implement something like this, with a simple conditional query in the dashboard programming… :slight_smile:

The same should be valid for eg VPNs.


Modifing anything, unsaved changes…

The dashboard itself uses the red color to highlight important issues, so why not above too?
Blue is to “peaceful”, and as part of the GUI color, not very noticeable!


DNS is still unusable - at least on the GUI level.

Come on guys, even Unifi allows almost everything (except for CNAMEs, but even they are coming…)
MX, SRV, whatever.

But just “A” or “*” Records? Not enough!

Note: Even OpenWRT has more in their LUCI WebGUI for DNS…


All in all, NethSec8 has been doing good progress.

IMHO the major caveats are:

  • Bad Screen (Login missing)
  • Unresponsive Webpage (No automatic refreshing)
  • Highlighting Warnings, etc in RED!
  • Dashboard enhancements (Widgets, enabling, disabling, hiding)
  • DNS is VERY lacking, not usable at all for a firewall, OpenWRT offers better…
  • Wireguard still needs CLI configuration.
  • Options for a local Hotspot are needed (No Cloud or External login and NO Social Media Logins!)
  • Default Domain (.lan) needs to be changed.

Still, the whole package is rather expensive, when comparing to other firewalls.
And also, a lot of cases must be solved with CLI - this is not an “easy” firewall for beginners…

More warnings needed when activating services which entail high CPU usage.

Some users seem to like reusing old hardware, and suricata is one of the things which can easily lock down a low-powered weak box… No warning, even on very low powered hardware.

At least things ARE improving…


My 2 cents
Andy

5 Likes

Thank you Andy for trying it again.

I will try to highlight some points.

I know, it’s irritating but it’s OpenWrt default that can’t be easily (easily=without forking the core) changed.

It does :slight_smile:
image

This is a good idea!

It’s a UX choice: only destructive buttons should be highlighted with strong colors, like red. We can argue on it for hours, but IMO is a wise UX decision made by @Lucia_A after days of research and work.

I really do not get it: the DNS in the firewall is not authoritative, is used only to make things easier for the network management. Why would you set a MX here? Can you give me a real example?

Do you know a simple solution that works out of the box on OpenWrt? I never seen a good local Hotspot.

I always change it but I think is a good default: it does not break things.

Can you elaborate a bit?

This could be also a very good improvements!

Nice one, we could add it. Let’s see if Lucia can fit it well inside the UI.

Hi @giacomo

I do see several requests for multi homed or several mail servers at a single site.

And SMTP mail still depends on correct DNS entries… :slight_smile:

Not that I advocate setting up several mail servers at a single site - especially if no real know-how is available, but not my decision…


What OPNsense / PFsense / M0n0wall provides would work just as well under Linux.
Fairly easy, not much resources used…


I’ll elaborate on pricing a little later, I just have a visitor now…

:slight_smile:

My 2 cents
Andy

2 Likes

Ok, but in this case you should set the MX record on the authoritative DNS server and not on your local firewall. Unless you want to override the public MX record: is that the case?

In such a use case, correct handling would imply setting MX externally AND internally, so mailings between the domains do not hang somewhere…

:slight_smile:

1 Like

I think with complex mail setup. Dns is required on the internal firewall as well.

I think it could be necessary if you have a multi server/ multitnode setup, with specific requirements for different use case.

Not related but try setting up carboniotmail server in its full glory. When you don’t have a directly exposed server or vm.

Same would apply for zimbra mail as well as things like proxmox mail gateway. Especially if the mail gateway is used to handle complex mail server setup.

Reule of thumbs would be, in my opinion. If it’s supported in the backend. And there are components that allows for handling of those additional DNS records. I dint see the reason for limiting. The firewall artificially.