I think I have the same protectli as you and it is awesome. Need it for my 2.5gb uplink. I use openwrt on it... Didn't really like opnsense. I am more used to linux than bsd.

I host lots of services and get bombarded by scrapers, scanners, and skids both at home and on my VPSs.

I use ipset for the usual blocklists which I download regularly. I also have tarpits on 22/tcp (endlessh). I pipe the IPs from the endlessh logs into fail2ban which feeds the ipsets. I have ipset blocks and fail2ban on my home firewall and all VPSs and coordinate over mqtt. So any fail2ban trigger > mqtt > every ipset block. Touch my 22/tcp anywhere and you get banned instantly everywhere. The program I use for this is called vallumd and it runs on openwrt.

I also put maltrail everywhere but I'm not totally sure how to interpret and respond to the results. Probably will implement a pipe from maltrail to my mqtt > blocklist setup.

I don't do any network-level adblocking... Might be a future project.

Nothing fancy, old ubiquiti gateway with a dedicated pihole server for my DNS.

nftables. Deny all, start adding stuff until þings work.

My firewalls are simple, b/c I run a private VPN and just shut off all traffic except over WG. I've got one exposed VPS reverse proxying services from oþer VPSes over WG.

But: nftables, and only nftables. I'm a big believer in understanding how stuff works, and þe rulesets created by firewalld and ilk are convoluted - complexity adds risk.

OpenWRT on a Linksys router, with adguard home for DNS blocking.

I used to run OPNSense on some older x86 hardware, but wanted to move to something simpler and less power hungry.

Opnsense on protectlii. Nothing but love.

Opnsense on a thin client, riser with a quad port Intel NIC.

Pfsense guy here, and professionally Palo alto guy. Can someone tl;dr the purpose of blockerng and suricata? I thought I remember the Lawrence systems folks mentioning using it for IPS but with segmentation at home "human" IPS seems more relevant than digital

OpenBSD pf

Edit: just home/hobby now, I’m not in tech anymore.

I use firewalld with a script that automatically updates a blocklist of known shady IPs.

Opnsense on dedicated device, several built in filters + several github backed filters for unbounddns.

Haven't tested it heavily, but the times I am on an outside network not using VPN into my network, or using TOR, etc, i am inundated with ads... So i guess successful internally.

I've been using Ufw but airvpn's kill switch seems to override it, should i be using something else?

Opnsense with unbound DNS here. Running on an old PC that got converted to dedicated firewall (with added NIC card for ports). Nothing crazy, just enough to control what communicates out of my network.

pfSense on this:
https://a.co/d/6WpafWQ

I also block outgoing port 53 only allowing my Pihole through.

I use Tailscale to access the network while away.

My firewall varies from installation-to-installation, as it's always client-side with a custom DNS provider. Right now, I'm using YaST Firewall on my main machine, iptables on my old ThinkPad, and my other machines are currently between operating systems. In the past, I have also dabbled in ufw, pf, and awall.

In addition to that, I generally use NextDNS (though I also get excellent results with Mullvad DNS).

My policy is simple: reject all incoming connections, except for Torrent and Syncthing.

I run iptables on Debian, on a cheap aliexpress minipc with dual NICs. Been using more or less the same config for about five years. It’s simple, boring, and works great.

Ubiquiti DM pro with its built in suricata. Honeypots, no remote mgmt, ACLs to minimum need, HA networks in isolation. DPI, multiple pi-holes. Phone alerts on intrusion wazuh just for node security compliance. ManageEngine for patches. NTFY alerts on console access.

It's not perfect

I run IPFire on a PC Engines apu4d4 (https://pcengines.ch/apu4d4.htm). I use dynDNS, WireGuard and set up a DMZ with it. I also have a WiFi card installed und use hostAPD to run that.

I think they stopped producing them because the AMD SOC they used is EOL. I was a big fan of their open platform.

OpenWRT.

Hiding behind my firewalls. Shhhhh.

Show me what you got.

you're doing the same thing i am, so there's not point. lol

Pfsense with pfblocker in a VM. Works wonders. Pipe fail2ban to pfblocker for extra goodness.