01 / perimeter
The edge
A single controlled way in. Everything else at the border is closed by default, not by exception.
- default-deny inbound
- rate & geo shaping
- logged, never silent
securenet is the quiet layer under a home lab full of machines that never sleep — segmented by design, watched around the clock, and built so the boring days stay boring.
A single lab, a handful of nodes, and a lot of moving traffic. The goal isn't a fortress — it's layers that each buy time, so no single mistake is the whole story.
A single controlled way in. Everything else at the border is closed by default, not by exception.
Trusted, lab, and guest traffic never share a broadcast domain. A noisy device stays a local problem.
Access follows the person, not the cable. Every remote path is behind strong auth and a second factor.
You can't defend what you can't see. Flows, logs, and health are collected and actually read.
Some doors lead nowhere on purpose. Traffic that shouldn't exist meets something built to watch it.
The last layer is time itself: versioned backups and a tested way back, so a bad day is reversible.
Design as if something is already inside. Layers exist to limit the blast radius, not to promise it never happens.
The best week is the week nothing happened — and you have the logs to prove that's true, not just hopeful.
Prefer changes you can undo. A tested restore beats a heroic fix at 3am every single time.
Credentials live in one guarded place, never in code, never in a screenshot, rotated when in doubt.