Yes, I believe that's correct. If any of the services that you are opening/exposing in this way contain vulnerabilities, those could be exploited to gain unauthorized access to the hosting machine. Attackers could then use the compromised machine as a staging area to launch attacks against other systems on your home network.

Putting the hosted machine in a separate VLAN (like a guest network) can mitigate that, but it means you have to do that configuration correctly.

(I am not confident enough in my own abilities/knowledge with respect to these vulnerabilities to try it, and so it may turn out to be very straightforward. I hope to do something along those lines someday but so far the risk has outweighed the reward for me.)

VLAN is not intended to be used like that. You want to rely on a trusted firewall you own, with separate interfaces and appropriate firewalling rules. This can provide an isolation between networks.

Behind this, any pirated server could decide to send VLAN tagged packets that may go trough the firewall if the rules are bad, or read any of them arriving to it.

VLAN's are useful if you want to "tag" packets with ID's going trough specific interfaces for segmentation purposes. The tag is applied from the interface standpoint, so this gives a virtual segmentation between ports of machines you are supposed to always control, like between a port on your router and ports on a managed switch.

In this case VLAN's are configured on the router's interface and the switch interfaces, but the exposed server is not aware about it, and can't change it, so you can know the ID is right.

This is often believed this is required to isolate networks, this is wrong, you just need to have separate interfaces.

It depends on how you technology/security savvy you are.

For instance, here is everything I do:

- Use an open source firewall+router (== Opnsense) and not commercial routers (such as Netgear, Tp Link etc.) - Open up port 80 and 443 on the firewall. - Both the ports go to a Traefik reverse proxy that is configured to always redirect port 80 to 443. - Traefik then reverse-proxies requests to relevant Docker containers. - Auto-update Traefik every day (through Watch Tower). - Use Authelia, with 2FA, where I can for the publicly available services.

I assume I am reasonably secure but I've also built this over a few months. You may not get there right away, so start small and slow and don't go crazy early on.