Written 9 Sep 2026. This is a how-to, not a product card.

A firewall box can wait

ufw on the leftover box is enough. Don't buy a Protectli tonight.

Allow the house jobs through a simple firewall: turn on a simple firewall without locking yourself out. Keep SSH on the house network: keep the computer on the house network. A Protectli, a pfSense appliance, or a rack firewall does not make those two looks more true. fail2ban still waits: fail2ban can wait.

When a box is later

Come back to a dedicated firewall only after ufw is on, port 22 is not forwarded, and the leftover box has been boring for a week. NAT still drops inbound SSH: NAT is why SSH stays inside. A mesh kit still waits: a mesh kit can wait.

What next

Weekend path: SSH from the couch. Tick Lab plan after OpenSSH is allowed and a phone still resolves names. Don't punch a hole.

Optional: the allow list as a sandbox in ByteRush — same Labthrift passkey as Plan. Skip if you just want to keep reading.

Skip

• Skip Protectli, pfSense, OPNsense, and a “lab firewall” appliance this weekend.
• Skip a rack firewall so ufw has a node.
• Skip forwarding port 22 because a box will “catch them.”