Part 2 — Teaching Guardian to Guard
In Part 1, Guardian was mostly an idea.
An old enthusiast PC was given a new position in the network: between the cable modem and the main router.
That position is what makes the project interesting.
A normal computer sits somewhere inside the network and communicates with the other machines around it. Guardian is different. Traffic has to pass through it before reaching the network behind it.
That means the old Core 2 Quad can do something more interesting than simply provide another server.
It can watch.
It can filter.
It can separate.
And, when necessary, it can decide which machines are allowed to talk to each other.
The hardware may be almost two decades old, but the software running on it can give the machine a surprisingly modern role.
More Than a Gateway
The simplest version of Guardian would simply forward packets from the cable modem to the main router.
That alone would make it a useful gateway.
But if the machine is already sitting at the edge of the network, it seems wasteful to use it only as a packet-forwarding device.
Guardian has seven Ethernet interfaces, an NVMe drive and a Linux operating system. It has considerably more capability than is required to move packets from one interface to another.
The question therefore becomes:
What else can an old PC do when it is placed at the network boundary?
The answer is a collection of services that operate at different levels.
Some can block unwanted destinations.
Some can identify suspicious traffic.
Some can scan files.
And some can prevent one class of device from communicating with another in the first place.
Together, these functions turn Guardian from a gateway into a network security appliance.
A Second Line of DNS Defense
I already have a small machine performing one of the most useful network-wide filtering jobs in the house.
A Raspberry Pi Zero 2 W runs Pi-hole, powered directly from the USB port of the main router.
It is almost the perfect appliance for the job.
It consumes very little power, takes up practically no space and has only one real responsibility: providing DNS-based filtering for the network.
There is therefore no reason for Guardian to replace it.
Instead, Guardian can provide a second line of defense.
The Pi Zero 2 W can remain the primary Pi-hole server, while Guardian runs another DNS filtering service as a backup.
This could be another Pi-hole installation or an alternative such as AdGuard Home.
The important part is not which software wins the comparison.
The important part is redundancy.
If the Raspberry Pi is unavailable, Guardian can continue providing filtered DNS.
If Guardian is shut down for maintenance, the small Pi can continue doing its job.
This fits the philosophy of the project particularly well.
Guardian does not have to do everything.
A tiny Raspberry Pi is better suited to a tiny, simple job.
The old Core 2 Quad can take care of the heavier work.
Blocking More Than Advertisements
DNS filtering is useful for more than removing advertisements.
It can also prevent connections to known tracking domains, telemetry endpoints and other unwanted destinations.
This is particularly interesting when the network contains devices that offer little control over their own software.
A desktop operating system may allow detailed configuration of its network behavior.
A smart plug may not.
A television may not.
A network-connected appliance may not.
Once a device is inside the network, however, DNS provides a common point where many of those requests can be filtered.
This is one reason network-level filtering is so attractive.
The individual device does not need to understand what is being blocked.
Guardian simply refuses to provide the destination.
Giving the Network Different Neighborhoods
DNS filtering answers one question:
Where can a device go?
VLANs answer another:
Which devices should be able to talk to each other at all?
This is particularly important in my network because not every machine belongs to the same computing era.
There are modern Linux systems.
There are Windows XP and Windows 7 machines.
There are network appliances.
There are smart-home devices.
There are servers.
And there are pieces of hardware whose security expectations are very different from those of a modern computer.
Putting everything on one large, flat Ethernet network would mean that every device is effectively a neighbor of every other device.
Guardian gives me the opportunity to change that.
Instead of treating the home network as one network, it can become a collection of smaller networks with controlled communication between them.
The Legacy VLAN
The Windows XP and Windows 7 machines are a particularly good example.
These computers still have useful jobs.
Some of them exist because I need the software or hardware of their era. Others are interesting simply because they are pieces of computing history that I still want to use.
But there is no reason to give an old Windows XP installation the same level of trust as a current Linux workstation.
The solution doesn’t have to be disconnecting it completely.
Instead, it can be isolated.
A dedicated legacy VLAN can contain the older machines.
Guardian can control what traffic is allowed to leave that VLAN and, just as importantly, what traffic is allowed to enter it.
The result is something much more useful than simply saying:
“Don’t connect XP to the Internet.”
The old machine can still have controlled Internet access when it needs it.
It can still communicate with selected services.
It can still perform the job for which it was kept.
But it doesn’t have to become a fully trusted member of the modern home network.
The old operating system remains old.
Guardian simply gives it a safer neighborhood to live in.
The IoT VLAN
The same idea applies to smart-home equipment.
I have Philips Hue equipment and TP-Link smart devices connected to the network.
These devices are useful, but they are not computers that I would want to treat as trusted peers of my main workstation or file server.
A smart plug does not need access to my engineering PC.
A lighting controller does not need unrestricted access to my NAS.
A device whose primary purpose is to turn something on and off does not need to know what is happening on every other machine in the house.
A separate IoT VLAN can provide exactly that separation.
The devices can still reach the services they require.
They can still communicate with the Internet when necessary.
My trusted machines can still communicate with them when I want to control them.
But the IoT devices do not automatically become members of the trusted LAN simply because they are connected to the same physical switch.
That distinction is important.
Connected does not have to mean trusted.
VLANs Are Not Just About Security
There is another advantage to this arrangement.
Once the network is divided into logical segments, Guardian becomes a central point where the rules between those segments can be defined.
For example, the trusted network might be allowed to initiate connections to the IoT network.
The reverse could be restricted.
The legacy network might be allowed to access the Internet but have very limited access to the trusted network.
The IoT network might have access to selected Internet services while being prevented from initiating connections to computers on the main LAN.
The exact rules can evolve as the network evolves.
This is much more flexible than physically wiring every class of device into a completely separate network.
The Ethernet cables remain part of the same infrastructure.
The separation exists logically.
A Network Made of Trust Levels
The result could look something like this:
Internet
↓
Cable Modem
↓
Guardian
↓
Network Switch
↓
Trusted VLAN
Modern PCs, servers and infrastructure
Legacy VLAN
Windows XP and Windows 7 machines
IoT VLAN
Philips Hue, TP-Link smart devices and other appliances
Each VLAN has a different level of trust.
The trusted network is where the machines I depend on every day live.
The legacy network contains machines that are useful but no longer have modern security capabilities.
The IoT network contains devices whose software and behavior I do not completely control.
Guardian sits between all of them.
This gives the machine a second meaning for its name.
It isn’t only guarding the network from the Internet.
It is also guarding the different parts of the network from each other.
Watching for Malicious Traffic
Segmentation controls who can talk to whom.
DNS filtering controls which destinations devices can resolve.
But neither necessarily tells me whether the traffic itself looks malicious.
This is where an intrusion detection system becomes interesting.
Guardian can run software such as Suricata or Snort to inspect network traffic and look for known attack patterns and suspicious activity.
This changes the role of the machine again.
Instead of simply forwarding traffic, Guardian can become a network sensor.
It can look for things such as port scans, exploit attempts, suspicious connections and signatures associated with known malicious traffic.
This is particularly appropriate for Guardian because it already has a privileged position in the network.
There is little point installing an intrusion detection system on a machine that sees only its own traffic.
Guardian can potentially see traffic crossing the gateway.
The Q6600 therefore has a job that makes much better use of its capabilities than trying to compete with a modern processor.
It doesn’t need to render frames.
It needs to inspect packets.
Suricata or Snort?
There are several possible ways to implement this.
Snort is one of the best-known names in open-source intrusion detection.
Suricata is another mature open-source IDS/IPS platform and is particularly attractive for this project because of its modern architecture and ability to inspect network traffic at high speed.
The final choice can be made after testing the actual hardware and network configuration.
Guardian is not intended to be a benchmark machine.
The important question is not whether a modern server could inspect traffic faster.
Of course it could.
The interesting question is whether a Q6600 with carefully selected network hardware can provide useful inspection for a real home network.
That is exactly the kind of question this project is meant to answer.
Scanning Files at the Gateway
There is another idea that is even more ambitious:
network-level antivirus filtering.
A traditional antivirus program runs on the endpoint.
A file is downloaded to the computer and the computer’s own antivirus software examines it.
Guardian offers the possibility of moving at least part of that process toward the network.
One possible combination is Squid with ClamAV.
Squid can act as a proxy, while ClamAV can inspect content passing through the proxy for known malware.
In principle, this creates a path such as:
Client → Guardian → Squid → ClamAV → Internet
The attraction is obvious.
Instead of depending entirely on every individual computer to perform the same inspection, the network can provide another layer.
But modern Internet traffic makes this considerably more complicated than it first appears.
Most web traffic is encrypted with HTTPS.
Guardian cannot simply inspect the contents of an encrypted connection without becoming involved in the TLS connection itself.
TLS interception introduces certificate management, compatibility issues, privacy considerations and additional processing requirements.
So this isn’t a magic network-wide antivirus system.
It is another tool with a particular place in the architecture.
It can still be useful for suitable traffic and controlled environments, but it has to be designed with the realities of modern encrypted networking in mind.
That limitation is actually part of what makes the experiment interesting.
Guardian is not being designed around an imaginary Internet from twenty years ago.
It is an old PC trying to interact with today’s Internet.
The Security Layers
At this point the architecture begins to resemble a series of overlapping defenses.
DNS filtering can prevent connections to known unwanted destinations.
VLANs can prevent entire classes of devices from communicating with one another.
Firewall rules can control the traffic allowed between those networks.
Suricata or Snort can look for suspicious traffic.
Squid and ClamAV, where appropriate, can provide another layer of content inspection.
None of these mechanisms is perfect.
That is not the objective.
The objective is to avoid relying on one mechanism to solve every problem.
If an unwanted domain gets through DNS filtering, the firewall still exists.
If something reaches a protected network, VLAN rules still limit where it can go.
If suspicious traffic appears, the IDS can report it.
If a suitable file passes through a proxy, antivirus scanning can provide another opportunity to detect it.
The layers complement each other.
Guardian Does Not Have to Be Perfect
There is also a practical reason to design the system this way.
Guardian itself is old hardware.
A Q6600 is not going to provide the processing capacity of a modern server.
It consumes more power than a modern embedded network appliance.
Its PCI and PCIe resources are limited.
And there will always be workloads that simply make more sense on newer hardware.
But none of those facts invalidate the project.
Guardian doesn’t have to become the most powerful firewall in the world.
It only has to provide useful network functions for this particular home.
That is a much more reasonable goal.
The machine already has the most important resource for this purpose:
a position where it can see the network.
A More Interesting Kind of Firewall
Traditional descriptions of a firewall tend to make it sound like a wall.
Traffic arrives.
The firewall decides whether to let it through.
Guardian is becoming something more complicated.
It knows about different networks.
It can provide DNS filtering.
It can inspect traffic.
It can log activity.
It can isolate legacy computers.
It can place smart-home devices in their own environment.
And it can provide another layer of protection for machines that were never designed to survive on today’s Internet.
It is becoming less like a wall and more like a security checkpoint.
Traffic enters.
Guardian decides where it is allowed to go.
And the decision can depend on what the device is, which network it belongs to, where it is trying to connect and what the traffic looks like.
The Smallest Machine Still Has a Role
There is something fitting about the fact that the Raspberry Pi Zero 2 W remains part of this architecture.
It would be easy to say that Guardian should replace everything.
One powerful machine.
One operating system.
One service stack.
One point of failure.
But that isn’t necessarily better.
The Pi Zero is excellent at its small job.
Guardian is better suited to heavier network services.
The OpenWrt router provides another layer of redundancy.
The main router continues to perform its normal role.
The network switch provides the physical connectivity.
None of these machines has to do everything.
The system becomes stronger precisely because the responsibilities are distributed.
From an Old PC to Network Infrastructure
This is perhaps the biggest change from Part 1.
At first glance, Guardian is an old Core 2 Quad system with a collection of unusually modern network adapters.
But once the software is added, the hardware starts to make more sense.
The Q6600 is no longer the most important component.
The motherboard is no longer simply an old enthusiast board.
The seven Ethernet ports are no longer just an impressive specification.
Together, they form a platform for building network infrastructure.
The machine can connect different generations of hardware.
It can isolate systems that should not trust each other.
It can filter destinations.
It can inspect traffic.
It can provide visibility.
And it can continue doing all of this while sitting quietly between the modem and the rest of the house.
That is a very different purpose from the one for which the machine was originally built.
The P5W DH Deluxe was designed for an enthusiast PC.
The Q6600 was designed to be a high-performance desktop processor.
Neither was designed to be a network security appliance.
But almost twenty years later, that is exactly what makes the combination interesting.
Guardian doesn’t need to be the fastest computer on the network.
It needs to be the computer that understands the network.