Infrastructure Flaws and Security Issues
2026 Lab Refresh Edit: This is no longer how the lab is configured, but leaving here for historical purposes
If you haven’t yet I would recommend reading post #3 that goes over the hardware on the network as well as the basic network layout. While the lab is mostly working right now there are some issues that are non-starters for me. In no particular order:
The domain marcuslynn.com points directly at my public IP address.-> FIXED, now using a reverse proxy.- I’m not a fan of this simply because of the DDOS and privacy risks. It wouldn’t take much for someone to take down my services just by obtaining the domain name or Dox me.
- To fix this I’ll need to proxy through the public cloud, either Azure, AWS, or Google.
The network is completely flat, all hosts and clients on a single /24 network.-> FIXED, created a new subnet & VLAN.- It shouldn’t be tough to imagine why this is a security risk. Having the webserver on the same LAN as my file storage, personal machines, and other critical services is asking for trouble.
The webserver is HTTP only.-> FIXED, got an SSL cert & HTTPS running.- Another big issue. I need to get an SSL cert installed to utilize HTTPS.
NATing for the webserver breaks all the other internal portals.-> FIXED, See #1- I suspect this is an issue with my NAT, but in essence things like the router management site also runs on HTTP so when I NAT’d the webserver for port 80 guess where all that traffic got sent to :)
- This is semi-related to point #2.
The domain isn’t available on the local LAN.-> FIXED, See #1- Navigating via marcuslynn.com doesn’t work but the internal address does while on the 10.0.1.0/24 network.
- This could be fixed with a hairpin NAT but again, I think it might be better to address the real problem rather than the symptoms.
- Manual server provisioning.
- Not so much an issue just that I’m lazy and want to look more into Docker, K3 and other automation tools.
Lack of a UPS.-> FIXED, added a UPS for the entire rack.- Already had several power outages which have impacted the lab. While I’ve configured auto starts across ESXi guests and my bot services, it’s not ideal.
- The Bludit admin logon doesn’t have any 2FA.