Post #3172227
2026-06-06 15:57 UTC
Current Mikrotik home firewall strategy:
* Add log rules to the end of firewall chains
* Stream logs and parse via script (pending: grafana dashboard). The script shows all packets that hit the log rules before the default-allow at the end
* add rules to cover excisting traffic (or fix shit if broken or sending unwanted packets)
* Optimize
* After a sufficient time period of no log rule hits, change the log rules to default-drop
bonus round: move as much traffic from ipv4 to ipv6. The majority of the IoT are a lost cause there however.
#Homelab #Mikrotik #InfoSec
Replies (1)
-
@rachel@transitory.social 2026-06-06 16:03
Previously, I used Cilium's Hubble feature to do this in the kubernetes cluster. That project took a very similar approach, but actually was able to go into more detail, because it was trivial to do domain matching on egress policies. It was followed by a aggressive lockdown of kubernetes containers to minimize every container to the absolute privilege/capabilities needed to function, which required some new tooling and quite a bit leaned, along with some open PRs and honestly simple MRs that I should get off my ass and submit