In Part 1, Guardian was mostly an idea.<\/p>\n\n\n\n
An old enthusiast PC was given a new position in the network: between the cable modem and the main router.<\/p>\n\n\n\n
That position is what makes the project interesting.<\/p>\n\n\n\n
A normal computer sits somewhere inside the network and communicates with the other machines around it. Guardian is different. Traffic has to pass through it before reaching the network behind it.<\/p>\n\n\n\n
That means the old Core 2 Quad can do something more interesting than simply provide another server.<\/p>\n\n\n\n
It can watch.<\/p>\n\n\n\n
It can filter.<\/p>\n\n\n\n
It can separate.<\/p>\n\n\n\n
And, when necessary, it can decide which machines are allowed to talk to each other.<\/p>\n\n\n\n
The hardware may be almost two decades old, but the software running on it can give the machine a surprisingly modern role.<\/p>\n\n\n\n
The simplest version of Guardian would simply forward packets from the cable modem to the main router.<\/p>\n\n\n\n
That alone would make it a useful gateway.<\/p>\n\n\n\n
But if the machine is already sitting at the edge of the network, it seems wasteful to use it only as a packet-forwarding device.<\/p>\n\n\n\n
Guardian has seven Ethernet interfaces, an NVMe drive and a Linux operating system. It has considerably more capability than is required to move packets from one interface to another.<\/p>\n\n\n\n
The question therefore becomes:<\/p>\n\n\n\n
What else can an old PC do when it is placed at the network boundary?<\/strong><\/p>\n\n\n\n The answer is a collection of services that operate at different levels.<\/p>\n\n\n\n Some can block unwanted destinations.<\/p>\n\n\n\n Some can identify suspicious traffic.<\/p>\n\n\n\n Some can scan files.<\/p>\n\n\n\n And some can prevent one class of device from communicating with another in the first place.<\/p>\n\n\n\n Together, these functions turn Guardian from a gateway into a network security appliance.<\/p>\n\n\n\n I already have a small machine performing one of the most useful network-wide filtering jobs in the house.<\/p>\n\n\n\n A Raspberry Pi Zero 2 W runs Pi-hole, powered directly from the USB port of the main router.<\/p>\n\n\n\n It is almost the perfect appliance for the job.<\/p>\n\n\n\n It consumes very little power, takes up practically no space and has only one real responsibility: providing DNS-based filtering for the network.<\/p>\n\n\n\n There is therefore no reason for Guardian to replace it.<\/p>\n\n\n\n Instead, Guardian can provide a second line of defense.<\/p>\n\n\n\n The Pi Zero 2 W can remain the primary Pi-hole server, while Guardian runs another DNS filtering service as a backup.<\/p>\n\n\n\n This could be another Pi-hole installation or an alternative such as AdGuard Home.<\/p>\n\n\n\n The important part is not which software wins the comparison.<\/p>\n\n\n\n The important part is redundancy.<\/p>\n\n\n\n If the Raspberry Pi is unavailable, Guardian can continue providing filtered DNS.<\/p>\n\n\n\n If Guardian is shut down for maintenance, the small Pi can continue doing its job.<\/p>\n\n\n\n This fits the philosophy of the project particularly well.<\/p>\n\n\n\n Guardian does not have to do everything.<\/p>\n\n\n\n A tiny Raspberry Pi is better suited to a tiny, simple job.<\/p>\n\n\n\n The old Core 2 Quad can take care of the heavier work.<\/p>\n\n\n\n DNS filtering is useful for more than removing advertisements.<\/p>\n\n\n\n It can also prevent connections to known tracking domains, telemetry endpoints and other unwanted destinations.<\/p>\n\n\n\n This is particularly interesting when the network contains devices that offer little control over their own software.<\/p>\n\n\n\n A desktop operating system may allow detailed configuration of its network behavior.<\/p>\n\n\n\n A smart plug may not.<\/p>\n\n\n\n A television may not.<\/p>\n\n\n\n A network-connected appliance may not.<\/p>\n\n\n\n Once a device is inside the network, however, DNS provides a common point where many of those requests can be filtered.<\/p>\n\n\n\n This is one reason network-level filtering is so attractive.<\/p>\n\n\n\n The individual device does not need to understand what is being blocked.<\/p>\n\n\n\n Guardian simply refuses to provide the destination.<\/p>\n\n\n\n DNS filtering answers one question:<\/p>\n\n\n\n Where can a device go?<\/strong><\/p>\n\n\n\n VLANs answer another:<\/p>\n\n\n\n Which devices should be able to talk to each other at all?<\/strong><\/p>\n\n\n\n This is particularly important in my network because not every machine belongs to the same computing era.<\/p>\n\n\n\n There are modern Linux systems.<\/p>\n\n\n\n There are Windows XP and Windows 7 machines.<\/p>\n\n\n\n There are network appliances.<\/p>\n\n\n\n There are smart-home devices.<\/p>\n\n\n\n There are servers.<\/p>\n\n\n\n And there are pieces of hardware whose security expectations are very different from those of a modern computer.<\/p>\n\n\n\n Putting everything on one large, flat Ethernet network would mean that every device is effectively a neighbor of every other device.<\/p>\n\n\n\n Guardian gives me the opportunity to change that.<\/p>\n\n\n\n Instead of treating the home network as one network, it can become a collection of smaller networks with controlled communication between them.<\/p>\n\n\n\n The Windows XP and Windows 7 machines are a particularly good example.<\/p>\n\n\n\n These computers still have useful jobs.<\/p>\n\n\n\n Some of them exist because I need the software or hardware of their era. Others are interesting simply because they are pieces of computing history that I still want to use.<\/p>\n\n\n\n But there is no reason to give an old Windows XP installation the same level of trust as a current Linux workstation.<\/p>\n\n\n\n The solution doesn’t have to be disconnecting it completely.<\/p>\n\n\n\n Instead, it can be isolated.<\/p>\n\n\n\n A dedicated legacy VLAN can contain the older machines.<\/p>\n\n\n\n Guardian can control what traffic is allowed to leave that VLAN and, just as importantly, what traffic is allowed to enter it.<\/p>\n\n\n\n The result is something much more useful than simply saying:<\/p>\n\n\n\n “Don’t connect XP to the Internet.”<\/strong><\/p>\n\n\n\n The old machine can still have controlled Internet access when it needs it.<\/p>\n\n\n\n It can still communicate with selected services.<\/p>\n\n\n\n It can still perform the job for which it was kept.<\/p>\n\n\n\n But it doesn’t have to become a fully trusted member of the modern home network.<\/p>\n\n\n\n The old operating system remains old.<\/p>\n\n\n\n Guardian simply gives it a safer neighborhood to live in.<\/p>\n\n\n\n The same idea applies to smart-home equipment.<\/p>\n\n\n\n I have Philips Hue equipment and TP-Link smart devices connected to the network.<\/p>\n\n\n\n These devices are useful, but they are not computers that I would want to treat as trusted peers of my main workstation or file server.<\/p>\n\n\n\n A smart plug does not need access to my engineering PC.<\/p>\n\n\n\n A lighting controller does not need unrestricted access to my NAS.<\/p>\n\n\n\n A device whose primary purpose is to turn something on and off does not need to know what is happening on every other machine in the house.<\/p>\n\n\n\n A separate IoT VLAN can provide exactly that separation.<\/p>\n\n\n\n The devices can still reach the services they require.<\/p>\n\n\n\n They can still communicate with the Internet when necessary.<\/p>\n\n\n\n My trusted machines can still communicate with them when I want to control them.<\/p>\n\n\n\n But the IoT devices do not automatically become members of the trusted LAN simply because they are connected to the same physical switch.<\/p>\n\n\n\n That distinction is important.<\/p>\n\n\n\n Connected does not have to mean trusted.<\/strong><\/p>\n\n\n\n There is another advantage to this arrangement.<\/p>\n\n\n\n Once the network is divided into logical segments, Guardian becomes a central point where the rules between those segments can be defined.<\/p>\n\n\n\n For example, the trusted network might be allowed to initiate connections to the IoT network.<\/p>\n\n\n\n The reverse could be restricted.<\/p>\n\n\n\n The legacy network might be allowed to access the Internet but have very limited access to the trusted network.<\/p>\n\n\n\n The IoT network might have access to selected Internet services while being prevented from initiating connections to computers on the main LAN.<\/p>\n\n\n\n The exact rules can evolve as the network evolves.<\/p>\n\n\n\n This is much more flexible than physically wiring every class of device into a completely separate network.<\/p>\n\n\n\n The Ethernet cables remain part of the same infrastructure.<\/p>\n\n\n\n The separation exists logically.<\/p>\n\n\n\n The result could look something like this:<\/p>\n\n\n\n Internet<\/strong><\/p>\n\n\n\n \u2193<\/p>\n\n\n\n Cable Modem<\/strong><\/p>\n\n\n\n \u2193<\/p>\n\n\n\n Guardian<\/strong><\/p>\n\n\n\n \u2193<\/p>\n\n\n\n Network Switch<\/strong><\/p>\n\n\n\n \u2193<\/p>\n\n\n\n Trusted VLAN<\/strong> Legacy VLAN<\/strong> IoT VLAN<\/strong> Each VLAN has a different level of trust.<\/p>\n\n\n\n The trusted network is where the machines I depend on every day live.<\/p>\n\n\n\n The legacy network contains machines that are useful but no longer have modern security capabilities.<\/p>\n\n\n\n The IoT network contains devices whose software and behavior I do not completely control.<\/p>\n\n\n\n Guardian sits between all of them.<\/p>\n\n\n\n This gives the machine a second meaning for its name.<\/p>\n\n\n\n It isn’t only guarding the network from the Internet.<\/p>\n\n\n\n It is also guarding the different parts of the network from each other.<\/p>\n\n\n\n Segmentation controls who can talk to whom.<\/p>\n\n\n\n DNS filtering controls which destinations devices can resolve.<\/p>\n\n\n\n But neither necessarily tells me whether the traffic itself looks malicious.<\/p>\n\n\n\n This is where an intrusion detection system becomes interesting.<\/p>\n\n\n\n Guardian can run software such as Suricata<\/strong> or Snort<\/strong> to inspect network traffic and look for known attack patterns and suspicious activity.<\/p>\n\n\n\n This changes the role of the machine again.<\/p>\n\n\n\n Instead of simply forwarding traffic, Guardian can become a network sensor.<\/p>\n\n\n\n It can look for things such as port scans, exploit attempts, suspicious connections and signatures associated with known malicious traffic.<\/p>\n\n\n\n This is particularly appropriate for Guardian because it already has a privileged position in the network.<\/p>\n\n\n\n There is little point installing an intrusion detection system on a machine that sees only its own traffic.<\/p>\n\n\n\n Guardian can potentially see traffic crossing the gateway.<\/p>\n\n\n\n The Q6600 therefore has a job that makes much better use of its capabilities than trying to compete with a modern processor.<\/p>\n\n\n\n It doesn’t need to render frames.<\/p>\n\n\n\n It needs to inspect packets.<\/p>\n\n\n\n There are several possible ways to implement this.<\/p>\n\n\n\n Snort is one of the best-known names in open-source intrusion detection.<\/p>\n\n\n\n Suricata is another mature open-source IDS\/IPS platform and is particularly attractive for this project because of its modern architecture and ability to inspect network traffic at high speed.<\/p>\n\n\n\n The final choice can be made after testing the actual hardware and network configuration.<\/p>\n\n\n\n Guardian is not intended to be a benchmark machine.<\/p>\n\n\n\n The important question is not whether a modern server could inspect traffic faster.<\/p>\n\n\n\n Of course it could.<\/p>\n\n\n\n The interesting question is whether a Q6600 with carefully selected network hardware can provide useful inspection for a real home network.<\/p>\n\n\n\n That is exactly the kind of question this project is meant to answer.<\/p>\n\n\n\n There is another idea that is even more ambitious:<\/p>\n\n\n\n network-level antivirus filtering.<\/p>\n\n\n\n A traditional antivirus program runs on the endpoint.<\/p>\n\n\n\n A file is downloaded to the computer and the computer’s own antivirus software examines it.<\/p>\n\n\n\n Guardian offers the possibility of moving at least part of that process toward the network.<\/p>\n\n\n\n One possible combination is Squid with ClamAV<\/strong>.<\/p>\n\n\n\n Squid can act as a proxy, while ClamAV can inspect content passing through the proxy for known malware.<\/p>\n\n\n\n In principle, this creates a path such as:<\/p>\n\n\n\n Client \u2192 Guardian \u2192 Squid \u2192 ClamAV \u2192 Internet<\/strong><\/p>\n\n\n\n The attraction is obvious.<\/p>\n\n\n\n Instead of depending entirely on every individual computer to perform the same inspection, the network can provide another layer.<\/p>\n\n\n\n But modern Internet traffic makes this considerably more complicated than it first appears.<\/p>\n\n\n\n Most web traffic is encrypted with HTTPS.<\/p>\n\n\n\n Guardian cannot simply inspect the contents of an encrypted connection without becoming involved in the TLS connection itself.<\/p>\n\n\n\n TLS interception introduces certificate management, compatibility issues, privacy considerations and additional processing requirements.<\/p>\n\n\n\n So this isn’t a magic network-wide antivirus system.<\/p>\n\n\n\n It is another tool with a particular place in the architecture.<\/p>\n\n\n\n It can still be useful for suitable traffic and controlled environments, but it has to be designed with the realities of modern encrypted networking in mind.<\/p>\n\n\n\n That limitation is actually part of what makes the experiment interesting.<\/p>\n\n\n\n Guardian is not being designed around an imaginary Internet from twenty years ago.<\/p>\n\n\n\n It is an old PC trying to interact with today’s Internet.<\/p>\n\n\n\n At this point the architecture begins to resemble a series of overlapping defenses.<\/p>\n\n\n\n DNS filtering<\/strong> can prevent connections to known unwanted destinations.<\/p>\n\n\n\n VLANs<\/strong> can prevent entire classes of devices from communicating with one another.<\/p>\n\n\n\n Firewall rules<\/strong> can control the traffic allowed between those networks.<\/p>\n\n\n\n Suricata or Snort<\/strong> can look for suspicious traffic.<\/p>\n\n\n\n Squid and ClamAV<\/strong>, where appropriate, can provide another layer of content inspection.<\/p>\n\n\n\n None of these mechanisms is perfect.<\/p>\n\n\n\n That is not the objective.<\/p>\n\n\n\n The objective is to avoid relying on one mechanism to solve every problem.<\/p>\n\n\n\n If an unwanted domain gets through DNS filtering, the firewall still exists.<\/p>\n\n\n\n If something reaches a protected network, VLAN rules still limit where it can go.<\/p>\n\n\n\n If suspicious traffic appears, the IDS can report it.<\/p>\n\n\n\n If a suitable file passes through a proxy, antivirus scanning can provide another opportunity to detect it.<\/p>\n\n\n\n The layers complement each other.<\/p>\n\n\n\n There is also a practical reason to design the system this way.<\/p>\n\n\n\n Guardian itself is old hardware.<\/p>\n\n\n\n A Q6600 is not going to provide the processing capacity of a modern server.<\/p>\n\n\n\n It consumes more power than a modern embedded network appliance.<\/p>\n\n\n\n Its PCI and PCIe resources are limited.<\/p>\n\n\n\n And there will always be workloads that simply make more sense on newer hardware.<\/p>\n\n\n\n But none of those facts invalidate the project.<\/p>\n\n\n\n Guardian doesn’t have to become the most powerful firewall in the world.<\/p>\n\n\n\n It only has to provide useful network functions for this particular home.<\/p>\n\n\n\n That is a much more reasonable goal.<\/p>\n\n\n\n The machine already has the most important resource for this purpose:<\/p>\n\n\n\n a position where it can see the network.<\/strong><\/p>\n\n\n\n Traditional descriptions of a firewall tend to make it sound like a wall.<\/p>\n\n\n\n Traffic arrives.<\/p>\n\n\n\n The firewall decides whether to let it through.<\/p>\n\n\n\n Guardian is becoming something more complicated.<\/p>\n\n\n\n It knows about different networks.<\/p>\n\n\n\n It can provide DNS filtering.<\/p>\n\n\n\n It can inspect traffic.<\/p>\n\n\n\n It can log activity.<\/p>\n\n\n\n It can isolate legacy computers.<\/p>\n\n\n\n It can place smart-home devices in their own environment.<\/p>\n\n\n\n And it can provide another layer of protection for machines that were never designed to survive on today’s Internet.<\/p>\n\n\n\n It is becoming less like a wall and more like a security checkpoint.<\/p>\n\n\n\n Traffic enters.<\/p>\n\n\n\n Guardian decides where it is allowed to go.<\/p>\n\n\n\n And the decision can depend on what the device is, which network it belongs to, where it is trying to connect and what the traffic looks like.<\/p>\n\n\n\n There is something fitting about the fact that the Raspberry Pi Zero 2 W remains part of this architecture.<\/p>\n\n\n\n It would be easy to say that Guardian should replace everything.<\/p>\n\n\n\n One powerful machine.<\/p>\n\n\n\n One operating system.<\/p>\n\n\n\n One service stack.<\/p>\n\n\n\n One point of failure.<\/p>\n\n\n\n But that isn’t necessarily better.<\/p>\n\n\n\n The Pi Zero is excellent at its small job.<\/p>\n\n\n\n Guardian is better suited to heavier network services.<\/p>\n\n\n\n The OpenWrt router provides another layer of redundancy.<\/p>\n\n\n\n The main router continues to perform its normal role.<\/p>\n\n\n\n The network switch provides the physical connectivity.<\/p>\n\n\n\n None of these machines has to do everything.<\/p>\n\n\n\n The system becomes stronger precisely because the responsibilities are distributed.<\/p>\n\n\n\n This is perhaps the biggest change from Part 1.<\/p>\n\n\n\n At first glance, Guardian is an old Core 2 Quad system with a collection of unusually modern network adapters.<\/p>\n\n\n\n But once the software is added, the hardware starts to make more sense.<\/p>\n\n\n\n The Q6600 is no longer the most important component.<\/p>\n\n\n\n The motherboard is no longer simply an old enthusiast board.<\/p>\n\n\n\n The seven Ethernet ports are no longer just an impressive specification.<\/p>\n\n\n\n Together, they form a platform for building network infrastructure.<\/p>\n\n\n\n The machine can connect different generations of hardware.<\/p>\n\n\n\n It can isolate systems that should not trust each other.<\/p>\n\n\n\n It can filter destinations.<\/p>\n\n\n\n It can inspect traffic.<\/p>\n\n\n\n It can provide visibility.<\/p>\n\n\n\n And it can continue doing all of this while sitting quietly between the modem and the rest of the house.<\/p>\n\n\n\n That is a very different purpose from the one for which the machine was originally built.<\/p>\n\n\n\n The P5W DH Deluxe was designed for an enthusiast PC.<\/p>\n\n\n\n The Q6600 was designed to be a high-performance desktop processor.<\/p>\n\n\n\n Neither was designed to be a network security appliance.<\/p>\n\n\n\n But almost twenty years later, that is exactly what makes the combination interesting.<\/p>\n\n\n\n Guardian doesn’t need to be the fastest computer on the network.<\/strong><\/p>\n\n\n\n It needs to be the computer that understands the network.<\/strong><\/p>\n\n\n\n \u2190<\/a>Part 1 \u2014 A PC Built to Guard the Network<\/a><\/p>\n\n\n\n <\/p>\n","protected":false},"excerpt":{"rendered":" Turning Guardian from a network gateway into an active security layer \u2014 with DNS filtering, VLAN isolation, malicious-traffic detection and network-level content inspection. Legacy XP and Windows 7 PCs, smart-home devices and modern systems can coexist while Guardian controls who can talk to whom \u2014 and what traffic is allowed through.<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"closed","sticky":false,"template":"project","format":"standard","meta":{"footnotes":""},"categories":[4],"tags":[],"class_list":["post-202","post","type-post","status-publish","format-standard","hentry","category-projects"],"_links":{"self":[{"href":"https:\/\/offlabelhardware.com\/index.php?rest_route=\/wp\/v2\/posts\/202","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/offlabelhardware.com\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/offlabelhardware.com\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/offlabelhardware.com\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/offlabelhardware.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=202"}],"version-history":[{"count":6,"href":"https:\/\/offlabelhardware.com\/index.php?rest_route=\/wp\/v2\/posts\/202\/revisions"}],"predecessor-version":[{"id":211,"href":"https:\/\/offlabelhardware.com\/index.php?rest_route=\/wp\/v2\/posts\/202\/revisions\/211"}],"wp:attachment":[{"href":"https:\/\/offlabelhardware.com\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=202"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/offlabelhardware.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=202"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/offlabelhardware.com\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=202"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}A Second Line of DNS Defense<\/h2>\n\n\n\n
Blocking More Than Advertisements<\/h2>\n\n\n\n
Giving the Network Different Neighborhoods<\/h2>\n\n\n\n
The Legacy VLAN<\/h2>\n\n\n\n
The IoT VLAN<\/h2>\n\n\n\n
VLANs Are Not Just About Security<\/h2>\n\n\n\n
A Network Made of Trust Levels<\/h2>\n\n\n\n
Modern PCs, servers and infrastructure<\/p>\n\n\n\n
Windows XP and Windows 7 machines<\/p>\n\n\n\n
Philips Hue, TP-Link smart devices and other appliances<\/p>\n\n\n\nWatching for Malicious Traffic<\/h2>\n\n\n\n
Suricata or Snort?<\/h2>\n\n\n\n
Scanning Files at the Gateway<\/h2>\n\n\n\n
The Security Layers<\/h2>\n\n\n\n
Guardian Does Not Have to Be Perfect<\/h2>\n\n\n\n
A More Interesting Kind of Firewall<\/h2>\n\n\n\n
The Smallest Machine Still Has a Role<\/h2>\n\n\n\n
From an Old PC to Network Infrastructure<\/h2>\n\n\n\n