What should I do to insulate other computers on the network from my Raspberry Pi?

Question

I am going to host a small server for small text-based webservice on a RPI as I dont have funds for a remote server. Someone might pehaps try to hack it someday, and as I am only a hobbyist, I assume we are in a scenario where the hacker has access to the whole RPI.

So, how do I make it difficult for the attacker to get access to my other devices and router on the system?. Like, what security practices should I incorporate? Like for instance use a vpn, proxy or something like that?

I have read this thread also: What should be done to secure Raspberry Pi?

I am thinking about running a spring-boot and some SQL program using an ordinary user account (no root privelages) with write and read permissions.

Answer 1

Put the Pi in a DMZ.

You can create a DMZ by adding a second router

                               +----+
                               | Pi |
                               +----+
  (---------)    +-------+        |       +--------+        (----------)
(  internal  )---|router1|----------------| router2|-------(  Internet  )
 (  network )    +-------+                +--------+         (----------)
   (-------)

On router 2 you enable the portforwarding to the Pi, on router 1 you do not enable any portforwarding. This effectively protects the internal network from the Pi as much as it was usually protected from the Internet.

Of course, the Pi requires a bit more attention, being exposed to the outside world. Keep everything up-to-date, remove all software that is not required, and review the logs regularly.