Welcome to the Security Projects section of UniversalBit.
This document describes the layered home-lab security architecture built around IPFire, Pi-hole, and SELKS — forming a privacy-first, threat-aware micro-network.

1. Overview
2. Physical Network Topology
3. Router / Gateway Configuration
4. DHCP Allocation Table
5. Wi-Fi Configuration
6. DMZ Policy
7. Infrastructure Components
   • IPFire — The Shield
   • Pi-hole — The Filter
8. DNS Forwarder List
9. Why This Setup Works
10. Hardening Checklist
11. Featured Projects
12. Support

Asymmetric routing occurs when packets follow different paths for outgoing and incoming traffic.
This architecture centralises all traffic through a layered security stack:

Internet
   │
[ZTE ONT]
   │  (WAN)
[Router / NAT / DHCP]
   │  (LAN)
[Gigabit Switch]
   ├──[IPFire ThinClient #01]  ← Stateful Firewall · IDS · DoT Recursor
   ├──[Pi-hole ThinClient #02] ← DNS Sinkhole · Ad/Tracker Filter
   └──[APs / Extenders / Devices]

Traffic flow — DNS query lifecycle:

1. Client issues a DNS query → routed to Pi-hole.
2. Pi-hole checks its Gravity blocklist; if not blocked → forwards to IPFire DoT recursor.
3. IPFire resolves over TLS via a curated upstream forwarder list.
4. All packets pass through IPFire's stateful firewall and IDS before reaching the internet.

Network: 192.168.1.0/24 · Subnet Mask: 255.255.255.0

Default (recommended): Enable only Router DHCP (Auto) as the active DHCP service for the subnet.

Notes:

• 192.168.1.1 is reserved as the gateway/router IP.
• Keep DHCP pools non-overlapping if optional segmented scopes are enabled.
• Use static DHCP reservations for infrastructure nodes (IPFire, Pi-hole, APs).
• Do not run multiple DHCP servers on the same subnet unless strictly coordinated.

Centralized SSID: single unified name for 2.4 GHz / 5 GHz enables seamless client handoff.

Tip: Use WPA3-Personal where supported. Enable client isolation on guest SSIDs.

The ORANGE zone in IPFire acts as a DMZ (De-Militarised Zone).

Stateful firewall rule: Only return traffic for connections initiated from allowed internal sources is permitted through the DMZ.

📥 Installation Guide

📥 Installation Guide

Tip: Regularly update IDS rulesets via the IPFire web UI (IPS → Update) to catch emerging threats.

All upstream resolvers use DNS-over-TLS (DoT) on port 853.
Privacy-focused, censorship-resistant providers are preferred.

Tip: Use at least 3–5 diverse providers to avoid single-provider dependency. Prefer non-profit / European providers for GDPR-aligned privacy guarantees.

Tip: Add supplemental blocklists such as oisd.nl or hagezi/dns-blocklists in Pi-hole's Gravity to broaden coverage without impacting performance.

Design philosophy: This configuration balances Micro-networking (low latency for multimedia / real-time traffic) with Macro-networking (high security via TLS forwarding, IDS, and DNS sinkholing).

• Disable WPS on all Wi-Fi access points
• Enable WPA3-Personal where hardware supports it
• Restrict Pi-hole admin UI to a management IP / VLAN
• Set static DHCP leases for IPFire and Pi-hole (prevents IP drift)
• Schedule automatic IDS ruleset updates in IPFire (IPS → Update)
• Review Pi-hole query logs weekly for anomalous domains
• Keep IPFire and Pi-hole on the latest stable releases
• Disable IPv6 on zones where not needed to reduce attack surface
• Enable IPFire location-based blocking for high-risk ASNs (optional)
• Enable client isolation on guest / IoT SSIDs

• Website: ipfire.org
• Description: IPFire is a hardened open-source Linux distribution functioning as a router and firewall. Built using Linux From Scratch (since v2), it offers a web-based management console and an extensive add-on ecosystem.
• Key Features:
  • Stateful firewall with zone-based policy (RED / GREEN / ORANGE / BLUE)
  • Integrated Suricata IDS/IPS across all zones
  • DNS-over-TLS recursor with QNAME minimisation
  • Web proxy, traffic shaping, VPN (IPsec / OpenVPN / WireGuard)
  • Add-on packages: Zeek, ClamAV, Asterisk, and more
• Learn More: IPFire on Wikipedia

• Website: stamus-networks.com/selks
• Description: SELKS is a Debian-based IDS/IPS and Network Security Monitoring (NSM) platform released under GPLv3 by Stamus Networks. It integrates Suricata, Elasticsearch, Logstash, Kibana, and Scirius CE into a single deployable unit.
• Key Features:
  • Full IDS/IPS + NSM pipeline out of the box
  • Kibana dashboards for real-time threat visualisation
  • Docker Compose deployment (Linux / Windows) or bare-metal ISO
  • Air-gapped environment support
• Learn More: SELKS on GitHub

• Website: pi-hole.net
• Description: Pi-hole is a network-wide DNS sinkhole that blocks ads, trackers, and telemetry for every device on the network — no client-side software required. It includes the FTL (Faster Than Light) engine for fast DNS resolution, statistics, and real-time query logging.
• Key Features:
  • Network-wide ad and tracker blocking via DNS sinkholing
  • Web admin UI with dashboards, query logs, and per-client/group policies
  • Gravity blocklist engine with regex, whitelist, and blacklist support
  • Optional built-in DHCP server
  • Pairs with DoT / DoH / Unbound / stubby for encrypted upstream resolution
  • Low resource usage; Docker-friendly; REST API for automation
• Learn More:
  • Pi-hole Documentation
  • Pi-hole on Wikipedia

Help us grow and continue innovating!

• 💖 Support the UniversalBit Project
• 📖 Learn about Disambiguation
• 📚 Bash Reference Manual

This file serves as the entry point for UniversalBit's security stack documentation.
For installation, configuration, or contribution details, explore the respective project repositories and their official documentation linked above.