Pi-Hole: What is considered properly firewalled?

Help Community Help
1

The issue I am facing:
In quite many tutorials on https://docs.pi-hole.net/ I read a lot about

internet facing devices should be properly firewalled.

Now I wonder, what actually is considered properly firewalled?

The documentation has no Firewall section. At Firewall Configuration - Pi-hole documentation I found this about firewalling the Pi-Hole OpenVPN server:

If you are behind a NAT and not running the Pi-hole on a cloud server, you do not need to issue the IPTABLES commands below as the firewall rules are already handled by the RoadWarrior installer

It says optional, only when running in cloud, etc. But, the Road Warrior installer gives me the pretty insecure forward all - anywhere default firewall settings.

Details about my system:

The actual question

  • Is my FritzBox firewall, that only lets port 1194 into my network, considered properly firewalled?
  • Can a hacker, lets say attack open port 1194 and break out from there? Like from the Pi-Hole device into the rest of my network?
  • Lets say there an attack vector in OpenVPN which could give elevated rights and hacker gets root or whatever. Will an additional firewall on the PiHole help in such a case? Like from my understanding, to open extra ports for additional hacker shenanigans, he needed to take control over the router, or not?
  • Not sure how all this hacking works exactly, but I'm just confused it it suffices to only have FritzBox firewall for all devices on the network.

Summary

  • Do I need to firewall the Pi-Hole / OpenVPN server or do I conveniently trust my router's firewall to be sufficiently secure?
2

By your description, your configuration falls into the category you quoted:

Your questions are legitimate, but they are out of Pi-hoe's scope.
Furthermore, the answers you seek would depend on both detailed internals of your network as well as your personal preferences and background.

This much can be said: If you were happy with your FritzBox firewalling before Pi-hole entered your setup, then there is no reason why you should be concerned now.

As far as OpenVPN is concerned, you should consider consulting their forums for advice on how to best ensure secure operation of their software.

3

This topic was automatically closed 21 days after the last reply. New replies are no longer allowed.