Sorry for the delay in reply, I don't check these forums as often as I should.
I don't have a guide for that yet, I'm afraid.
I've got an action item on my list to build a firewall system into RetroNAS in order to provide some extra security for users who are concerned by legacy protocols. There's some skeleton stuff built currently, but we need to do a lot more work and testing. When it's done I hope to be able to offer
- An optional "standalone" mode, where RetroNAS can work entirely offline for people who want it air-gapped, and/or need to take RetroNAS with MiSTer while travelling, including providing DHCP to your retro network.
- A segregated router/NAT mode, where RetroNAS can act like a second firewall in between your home and retro network, and your choice of whether or not the retro network can get to the Internet or not
- Within router/NAT mode, several profiles of varying security/paranoia that optionally allow only secure protocols through, or completely lock down the network depending on what individual users want.
- Within router/NAT mode, the option to have RetroNAS connect to your home WiFi as a client, and then to your retro network via wired connection, to ensure retro systems get a low-latency connection (useful for MiSTer PSX games loading over SMB3, for example), but then still give you the ability to connect to RetroNAS wirelessly for maintenance or file uploads.
Still loads of work to do though, and no ETA (work and health issues combined are dominating my free time lately). But we've at least started.
All of that is also the building blocks for various network/PXE boot tools that I want to offer for retro computing enthusiasts. But I have to walk before I can run.
On the security front, I personally don't have any issues running RetroNAS directly on my home network. I do this with several RetroNAS installs for both development/testing as well as my own personal usage. A lot of people get freaked out about things like SMB1 existing on their network at all, but it's worth remembering that the vulnerabilities found in SMB1 on old Windows installs don't apply to Linux/Samba. Your home network won't spontaneously catch on fire and evil outsiders won't break in just because you installed the service. All the same, people have asked for the extra firewalling options, so I'm happy to build it if it brings them peace of mind. That, and the extra features I'm planning can build off it, so it's useful for a few upcoming purposes.