[User23]

Hey, just wondering what people set as default rules on their VMs for security?

ufw default deny incoming


Or is it just better to use WHONIX?

[rc445]

My setup is

Primary VM --------------> pfsense VM ----------> Internet

my pfsense has a rules to only allow VPN connections and it connects to my VPN provider.
That way all traffic from my Primary VM, gets routed through the VM and will limit accidental data leakage.

And you should periodically sample your network traffic between the pfsense VM and Internet to make sure that all is working as it should.

[User23]

Agreed - what rules do you need to tunnel all traffic from primary to Pfsense? And do you use fail2ban etc?