Testing My Own Homelab's Security: nmap, SSL, and What I Found

I was reading some news about security online, and it got me thinking. Is my own homelab actually secure? I run a couple of servers exposed to the internet, and I honestly wasn't sure how vulnerable they might be. So I went looking for ways to test it myself.

I tried asking Claude to run a scan for me first, but it turned out Claude runs in a sandboxed environment, so anything it tried to scan would go through Anthropic's own network gateway instead of testing my server directly. The results wouldn't have been trustworthy. So I had to test it myself instead. I'm not particularly experienced with security testing. My background is mostly just setting up networking on my own two servers, not auditing them.

My setup, in short

Here's roughly how everything is wired together. My networking chain goes Cloudflare, then my MikroTik router with a DDNS hostname (I'll keep the actual address private), then my Ubuntu Server machine, then my Unraid box. The Ubuntu Server handles proxying for both machines, since that's where Traefik lives. To make any of this reachable from the outside in the first place, I had to request a public IP from my ISP, PLDT. That's the setup in a nutshell.

Running nmap

For the actual test, I used nmap on my work laptop through WSL, running a full port scan against my DDNS hostname:

nmap -Pn -T4 -p- your-ddns-hostname.example.com

And honestly, it came out fine. Only ports 80 and 443 were open. Nothing else responded at all. I was genuinely relieved. On the server side, at least at the network level, everything looked locked down properly.

Then came SSL

SSL is a part I don't fully understand on a deep level. Traefik already handles certificates automatically through Let's Encrypt, so I figured that part was covered. I ran everything through Qualys SSL Labs to check, and the result surprised me. Everything came back rated B, even though I had TLS 1.2 and 1.3 configured properly in Traefik, all set up with some AI help when I originally built this.

Turned out the B grade wasn't a Traefik problem at all. It was Cloudflare sitting in front of those domains and handling the TLS handshake at their edge instead of my origin server. So I tested a different service that isn't proxied through Cloudflare, and that one came back rated A, with strong encryption all around.

So, is my setup fine?

I think so, at least on the parts I tested. There were no exposed vulnerabilities on the server or networking side. If there's any real weak point left, it's probably in the logic of the individual services running behind everything, not the perimeter itself. That's a comforting place to be after a night of poking at my own infrastructure.

What's your server journey been like?