Rule of thumb for MOST of you right now ———-> don’t expose anything to the internet.
- Close all those ports
- Put everything behind a firewall
- Use VPN for access
Keep coding all that personal software but keep your attack surface small.
- Close all those ports
- Put everything behind a firewall
- Use VPN for access
Keep coding all that personal software but keep your attack surface small.
Oct 23, 2026 · 2:27 PM UTC
59
78
1,131
41,150
@NetworkChuck Easy thing to say when most ordinary family and neighbors never update anything then they Scream at the customer-facing advisors because their phone or internet doesn’t work or want to pay anyone to fix it.
We need Bots… oh wise one. ☝️
We need Bots… oh wise one. ☝️
0
0
0
29
@NetworkChuck I installed skynet on my Asus merlin router too, blocked a bunch of countries IP address ranges and updated threat feeds.
0
0
0
24
@NetworkChuck close the ports yes. how many vibe coders can even tell you what's listening on their machine right now?
0
0
0
40
@NetworkChuck Use tunnels!!! @Cloudflare has a really good one, and its free!
0
0
2
645
@NetworkChuckonnections blocked by the firewall. Ssh services off by default. Ssh password authentication disabled (ssh key authentication only).
Via kvm console, open port 22 for a specific incoming IP, start sshd for a few seconds, just long enough to establish an ssh key authenticated connection, then ssh is blocked again and ssh services stopped.
Once an ssh session is established, sshd services can be stopped without impacting the existing session. The firewall permits established sessions while blocking any new connections. You can tunnel any ports you like over ssh.
Take it a step further and change the default ssh port, but probably overkill at that point.
Better than tailscale IMO but does require more user overhead.
Via kvm console, open port 22 for a specific incoming IP, start sshd for a few seconds, just long enough to establish an ssh key authenticated connection, then ssh is blocked again and ssh services stopped.
Once an ssh session is established, sshd services can be stopped without impacting the existing session. The firewall permits established sessions while blocking any new connections. You can tunnel any ports you like over ssh.
Take it a step further and change the default ssh port, but probably overkill at that point.
Better than tailscale IMO but does require more user overhead.
0
0
1
369
@NetworkChuck Good rule. Mine for the homelab: if it needs a port forward, it needs a written reason. Tailscale or WireGuard for getting in, nothing listening on the WAN. And turn off UPnP on the router, it will happily open ports you never asked for.
1
0
3
807
@NetworkChuck Hate to break it to you bro... nothing is safe
0
0
2
527
@NetworkChuck What about all the shitty unpatched routers most people are behind?
0
0
1
277
@NetworkChuck You know it's probably best to just not even turn on the computer at all.
0
0
0
117
@NetworkChuck Honestly, I feel like using @Cloudflare is a must these days, ngl.
1
0
0
583
@NetworkChuck Perhaps a large trap layer of sneaky open ports that attack sniffing animals like the mote or lead them down a mysterious rabbit hole while it silently gathers information. 😂
1
0
0
21
@NetworkChuck If possible SSL Proxy .. Cloudflare is awesome but need to lockdown FW on host to just cloudflare cdn IPs/whitelist .. They probably saved so many sites shoutout @Cloudflare
0
0
2
977
@NetworkChuck there arent any vulnerabilities in openvpn right?
2
0
2
847
@NetworkChuck open all those ports
raw dog the Internet
open RDP and add 'Everyone' to the authorized user group
???
profit
raw dog the Internet
open RDP and add 'Everyone' to the authorized user group
???
profit
0
0
0
103
@NetworkChuck Wireguard requires port to be opened. But yes everything else closed.
0
0
0
164
@NetworkChuck And for some of you:
Put everything behind the firewall (non bypass ports only)
Power off the the firewall
Go outside and touch grass
Come back and do as Chuck says
Put everything behind the firewall (non bypass ports only)
Power off the the firewall
Go outside and touch grass
Come back and do as Chuck says
0
0
0
174
@NetworkChuck I'm not even keeping my tailnet up until things calm down
0
0
0
200
@NetworkChuck My phone has a work VPN in the only slot, so only more love for cloudflare. So much free stuff.
0
0
0
417
@NetworkChuck Outbound firewall may be a good idea in case you run agents and something does get through.
0
0
0
391
@NetworkChuck Ahhh most routers do that already chuck. I personally use Pfsense on netgate boxes.
0
0
0
713
@NetworkChuck In my case I added a secondary firewall. I call it an External WAN firewall that focuses on the WAN side. I basically lock it all down and only allow certain IPs I am familiar with to connect to VPN. Other than that it blocks everything else.
0
0
1
215
@NetworkChuck This has been true for a very long time. I've notoriously had a lot of ports open on my network, but recently closed as many as I possibly could just to tighten things up for security reasons. Love my @Ubiquiti for the firewall though
0
0
0
626
@NetworkChuck Yeah my wife thought I was crazy when I started self hosting. Now she understands
1
0
0
530
@NetworkChuck Good rule. I'd add one practical check: scan your own public IP from outside the network. People close ports on the router and forget UPnP, an old NAT rule, or a service exposed through IPv6. Verify the exposure instead of trusting the config.
0
0
1
53
@NetworkChuck Womp womp
🚨 Hackers breached enterprise firewalls and VPNs worldwide in a campaign linked to k0t.
Over 70,000 exposed credentials identified.
Fortinet and Palo Alto devices targeted. Persistent access established. Data exfiltrated.
Inside the attack chain and suspected ransomware 6zQ4ZTj
0
0
2
133
@NetworkChuck I feel like the people that will find this useful the most likely don’t know how to do it
0
0
0
35
@NetworkChuckbut “use a VPN” isn’t the same as “implement least-privilege access.”
I mean something like Tailscale: identity-based access to specific services, without requiring a publicly exposed VPN gateway or inbound port forwarding, not just putting everything on a private network and trusting whatever connects.
And no this isn't a paid promo. Just advice
I mean something like Tailscale: identity-based access to specific services, without requiring a publicly exposed VPN gateway or inbound port forwarding, not just putting everything on a private network and trusting whatever connects.
And no this isn't a paid promo. Just advice
0
0
0
32
