In a game server hosting discord. People there don't see a problem with exposing every ports directly to public. reddit / selfhosted ---------------------------------------------------------------------- SwimmingHat8351 · 2023-10-01 02:57 I mean not just 80 and 443 or something. They have probably 100s of exposed ports to the internet and were trying ro argue that's the way to networking. ---------------------------------------------------------------------- ThePixlPirate · 2023-10-01 03:03 Ok ---------------------------------------------------------------------- Lancaster1983 · 2023-10-01 03:07 They are idiots. Why do we care? ---------------------------------------------------------------------- Oujii · 2023-10-01 03:10 TheCubeNOOB is right. That's why we have SSL. A lot of people here in this sub also expose their ports to the public, not sure what the issue is. ---------------------------------------------------------------------- zedkyuu · 2023-10-01 03:16 It’s about reducing the attack surface by picking and choosing what you expose, not exposing everything by default. Unless you use server certificate verification to limit who can connect, I also don’t see why SSL matters at least as far as that aspect is concerned. ---------------------------------------------------------------------- ericesev · 2023-10-01 03:26 I have TCP(22/80/443)/UDP(443) open on the WAN. And TCP(22/53/80/443)/UDP(53/67/443) open on the LAN. The place where I work has open ports for their web servers too. Open ports have never really been the issue. Exposing insecure, vulnerable, or incorrectly configured services is the root issue. ---------------------------------------------------------------------- Oujii · 2023-10-01 03:28 If you are exposing your reverse proxy, SSL does matter. For everything else, I'm sure people are aware of that, if they are not, unlucky. But for game servers (as this is a discord about it), I think it's pretty normal. Also, it doesn't really matter unless you are actively exposing a service. For me it matters the most the actual service and not the port. ---------------------------------------------------------------------- SwimmingHat8351 · 2023-10-01 03:29 The thing is, idk if their dns records are proxied. If they aren't. Their whole house relies on the security of the software that's listening on their exposed ports. And having 100s of applications running with different ports exoposed. It's just a ticking time bomb. Internal ports are very different that you're talking about here. Those are mapped to their public ip. ---------------------------------------------------------------------- Mr_SlimShady · 2023-10-01 03:32 You’re not supposed to expose every thing just for the lolz. If you have a reason and a (properly secured) server behind it, then what’s the issue? That’s exactly how a website works. That’s how the internet itself works. Now if you expose rdp or some other idiotic thing, then yeah you’re an idiot. ---------------------------------------------------------------------- SwimmingHat8351 · 2023-10-01 03:32 You don't understand. They don't expose ports internally and reverse proxy stuff. They just open ports out publicly. If their dns records aren't proxied their whole home network relies on the softwares listening on exposed ports. And with 100s of software running on 100s of port with no regular maintenance is a ticking time bomb. ---------------------------------------------------------------------- SwimmingHat8351 · 2023-10-01 03:33 They believe in exposing ports for services instead of reverse proxy or tunneling. ---------------------------------------------------------------------- ericesev · 2023-10-01 03:41 Agreed. The port isn't the issue though. It's just used to establish a TCP connection. Is the software exposed on the port written in a memory safe language? Does it provide access to files on their computer? The details are important. ---------------------------------------------------------------------- Accomplished-Lack721 · 2023-10-01 03:42 When you reverse proxy, you're depending on the security of your reverse proxy solution. When you tunnel, you're depending on the security of the service on the other end of the tunnel. There is no perfect security. It's good not to expose things when you don't need to, and to use measures like reverse proxy that limit your attack surface (while making it harder for a port scanner to suss out what's on the other side of the proxy). But there are no perfect solutions. ---------------------------------------------------------------------- DueDiscussion2 · 2023-10-01 03:42 What is Dns record proxying or what is that supposed to do? I read that term for the first time. ---------------------------------------------------------------------- puppetjazz · 2023-10-01 03:47 My God, they know the minecraft port!! ---------------------------------------------------------------------- Oujii · 2023-10-01 03:48 > relies on the security of the software that's listening on their exposed ports Yeah, that's the whole point. Ports are not the issue. Security by obscurity is not security. Someone mentioned port 443, this is common practice when you have a reverse proxy. You mentioned that they are exposing 100s of ports, but this statement is not backed up by your screenshot. The person mentioned only three ports. Minecraft one, which has to be exposed unless you use a VPN and HTTP and HTTPS. HTTP can be exposed with the purpose of getting SSL certificates and HTTPS would be exposed to actually provide access to the services. ---------------------------------------------------------------------- SwimmingHat8351 · 2023-10-01 03:53 Agreed. But rproxies or tunnels dedicate and specialise in web related securities. Even if a vulnerability is found they are quick to fix it. On the other hand. Random softwares don't even think about web related securities for the most part. ---------------------------------------------------------------------- SwimmingHat8351 · 2023-10-01 03:57 [Proof here lol. ](https://ibb.co/RCLsQ2n) Thing is reverse proxied takes measure for open port vulnerabilities. When you expose a port of a software directly. For the most part they don't even care for such vulnerabilities. ---------------------------------------------------------------------- SwimmingHat8351 · 2023-10-01 03:58 Cloudflare has this option. Idk if any other dns provider allow you to proxy. But it essentially hides your actual ip a dns record is mapped to. Quite useful for home servers to hide their public ip. ---------------------------------------------------------------------- ericesev · 2023-10-01 03:59 >I read that term for the first time. I've also never heard of DNS record proxying. Is this a load balancing or caching technique? ---------------------------------------------------------------------- ForHuckTheHat · 2023-10-01 04:08 Details that are likely going over the head of most minecraft players. No one cares how skilled you are at computer security if you're telling children to open ports for mysterious software. The details are very important. I'm not questioning your technical skills, I'm just questioning your social skills xD Expert blindness can hit sys admins pretty hard. ---------------------------------------------------------------------- iC0nk3r · 2023-10-01 04:09 Did you just learn about Cloudflare Tunnels and think that is the end- all-be-all to security? As long as: * Edge firewall is up to date * Web Server / Game Server is up to date * Log monitoring * IDS/IPS on edge firewall is configured Then there's really no issue directly exposing services to the internet. Tunnels CAN be great, but it doesn't invalidate the other set up. ---------------------------------------------------------------------- lukewarmlament · 2023-10-01 04:11 > TheCubeNOOB is right. That's why we have SSL. A lot of people here in this sub also expose their ports to the public, not sure what the issue is. And a lot of people here don’t understand security. If you don’t see the issue here you’re one of them. SSL protects data in motion that doesn’t mean the application listening on the port isn’t going to do something dangerous when it receives a crafted packet. As was said it’s about reducing attack surface and exposing an application like SSH or OpenVPN that have been audited into oblivion is not the same as some random docker application. ---------------------------------------------------------------------- Oujii · 2023-10-01 04:12 Thank you for the source. Again, as someone else mentioned, you are missing the point. The issue are not the ports, but the software. What you are saying is that most software are insecure by default, this is debatable, but again, exposing ports is not an issue, exposing insecure software is. If you get an insecure software proxied by a reverse proxy, an attacker might still get access to your network, even if the first entry point was not the software itself. ---------------------------------------------------------------------- StewedAngelSkins · 2023-10-01 04:15 exposing the port itself isn't a problem really. the problem comes from whether the software listening on the port is secured properly. ---------------------------------------------------------------------- Oujii · 2023-10-01 04:15 Who would've though that exposing insecure software could lead to disaster? The point OP is making (just check their replies) is that exposing ports directly is unsafe, which is not true. Ports are not the issue, but what you are exposing on them. If you have an insecure application being proxied by a super secure and up to date reverse proxy, it doesn't matter, the attacker will reach the application and be into your network anyway. ---------------------------------------------------------------------- Oujii · 2023-10-01 04:16 You know that an attacker doesn't need your public IP to get into your network, right? If you are proxying an insecure application through Cloudflare, they can get to you anyway. ---------------------------------------------------------------------- anon108 · 2023-10-01 04:17 Not a big deal. ---------------------------------------------------------------------- ericesev · 2023-10-01 04:24 >Details that are likely going over the head of most minecraft players. Always answering with "open ports are unsafe" doesn't help fix the root issue. They'll assume that the port is the issue and just move the port to a Cloud provider/VPS as the OP is suggesting. This provides no value if the service is still unsafe. ---------------------------------------------------------------------- microlate · 2023-10-01 04:25 How else are you supposed to connect to an app? Obviously don’t expose everything ---------------------------------------------------------------------- StewedAngelSkins · 2023-10-01 04:26 proxying doesn't do shit. it's just port forwarding over a vpn tunnel. you're still exposing the same port to the internet. if the software on your end is secure, it's secure. if it's not, you've got a problem regardless of whether the dns terminates at cloudflare's servers or yours. ---------------------------------------------------------------------- SwimmingHat8351 · 2023-10-01 04:39 Never said that. They don't even use reverse proxy. They just expose ports on the public internet and use srv records to point subdomain to respective ports. I'm not saying tunnels is end-all-be-all but that's not how you expose ports. If you gotta expose ports you need to map them properly. A reverse proxy is required to expose services on port 80 and 443. Not just leave an open port on a security of a random software that has no motivation to look up on open port vulnerabilities. ---------------------------------------------------------------------- gryd3 · 2023-10-01 04:40 You're dangerous to others. Please stop recommending this as 'the safe way' to do things. Keep your stuff up to date. If it's not required, don't use it. Monitoring and Alerts for 'when' you get broken into, not 'if'. Applications have flaws, these flaws allow for 'hacks', and many times a simple proxy or tunnel can't fix the flaw. All you're doing is spreading information that may mislead others into opening vulnerable services up via proxy which leads them to being open to compromise. ---------------------------------------------------------------------- SwimmingHat8351 · 2023-10-01 04:41 Show me a single professional server where people use publicly exposed ports and modified srv records to point domains. I'm not saying it's a particular problem with softwares or security but had an arguement with them where they think using reverse proxy is "complicated and unnecessary" compared to their current setup. ---------------------------------------------------------------------- Scoth42 · 2023-10-01 04:56 And what are you expecting a reverse proxy to add to this situation? ---------------------------------------------------------------------- Scoth42 · 2023-10-01 05:13 Reverse proxy doesn't inherently do anything for port vulnerabilities. As its name suggests, it's a proxy. It's primarily used as a way to host multiple services on the same IP and port with vhosts, maybe do some port redirection, maybe some load balancing, and potentially even terminate SSL. If you want to protect against vulnerabilities you'll need to integrate some kind of scanner like maybe Akamai's WAF. There's literally no difference in exposing a port directly and using a basic reverse proxy setup, and even a somewhat more advanced one using SSL or whatnot is still going to be more about vulnerabilities in the software being run. A reverse proxy isn't going to any thing about that. ---------------------------------------------------------------------- Nagashitw · 2023-10-01 05:20 This is the way ---------------------------------------------------------------------- SwimmingHat8351 · 2023-10-01 05:24 Are you really recommending a setup with publicly exposed posts and modified srv records over reverse proxy and/or tunnels? I'm not saying reverse proxy or tunnels are the 'secure way' but that's the industry standard and far better than the current setup imo. ---------------------------------------------------------------------- ericesev · 2023-10-01 05:25 >\> Show me a single professional server where people use publicly exposed ports I'm fairly confident that the servers behind [reddit.com](https://reddit.com) are publicly exposed. And they use ports and DNS too. >and modified srv records to point domains Do you have an example of this? I'm not following how [SRV records](https://en.wikipedia.org/wiki/SRV_record) are used in this context. >where they think using reverse proxy is "complicated and unnecessary" compared to their current setup. Given the services that they are running they very well could know exactly exactly how to secure their services. ---------------------------------------------------------------------- Scoth42 · 2023-10-01 05:28 For a basic Minecraft server being run by a kid or something? Sure. Same for a lot of self hosted stuff too. These are kids running game servers on their home computers, there's no reason for them to follow "industry standards." And again, a reverse proxy, tunnel, whatever isn't going to add any inherent security if the underlying service is insecure or improperly set up. They just route network traffic and nothing else. I still don't get what you're expecting a reverse proxy to add to the equation security- wise or why they're "far better" for someone running a game server at home. ---------------------------------------------------------------------- ElevenNotes · 2023-10-01 05:31 Opening ports bares no risk if you know what you are doing, but since most on this sub don't know what their are doing it's better if they don't and be happy with their tailscale tunnels. ---------------------------------------------------------------------- SwimmingHat8351 · 2023-10-01 05:37 Yes, but those are on port 80 and 443 for the most part. Reddit isn't using an ungodly port like 25000 or something exposed to the public. Also the connection on 80 and 443 are receiving/listened on by some reverse proxy/web server. Not a 3rd party FOSS software that doesn't focus on open port vulnerabilities for the most part. https://ibb.co/dckMwLJ Here's how they use SRV. It's a support server for a game hosting panel. The support team provides such lousy solution for exposing game servers on the internet. I was shocked to see them fighting with me saying reverse proxy "overcomplicates the setup" compare the the current solution they have. ---------------------------------------------------------------------- SwimmingHat8351 · 2023-10-01 05:42 I think I missed the point with this post. It's a self-hosted game server panel' support discord (think like cPanel but dedicated to game servers) The documentation of the software clearly states to use a reverse proxy if they require to publish stuff on the internet. However these people (I believe they are pretty old in the community as well) believes reverse proxy only overcomplicates stuff. They suggest people to expose every private port to the public, then use srv records to modify the subdomain's port to the one specified. How does that make sense over something like reverse proxies/tunnels. I wanna ask to those who downvoted my comments. Do you really recommend their way of exposing stuff to the public over the standard reverse proxy on tunnel methods? ---------------------------------------------------------------------- diet_fat_bacon · 2023-10-01 05:45 And exposing directly you ip, it can be a nuisance if some kid want to DoS it. Behind a vps ou cloud server you can enjoy the protection our just shutdown the server until thinks calm down. ---------------------------------------------------------------------- SwimmingHat8351 · 2023-10-01 05:47 Idk what you do. But if you were a Network Engineer. Would you really recommend or setup a server yourself where you have over 100s of applications listening on different ports. Which are exposed to the public then you modify 100s of srv records to modify the port queries of the domain. Or would you rather use a reverse proxy or a tunnel? This isn't some lone kid doing this to his setup. It's a full discord support group with thousands of people who have 0 knowledge of networking being asked to expose their internet wide open to the public. ---------------------------------------------------------------------- mourasio · 2023-10-01 05:49 There's multiple levels at which this is incorrect. VPN has nothing to do with this, and by reverse proxying, you can limit the IPs that are able to connect to you to those of the proxy provider. In addition, these providers base their business model in selling you "clean" traffic. I swear it gets ridiculous how this sub bases their whole security posture on "vpn good" - having any other port publicly exposed "ticking time bomb" ---------------------------------------------------------------------- ericesev · 2023-10-01 05:56 >Also the connection on 80 and 443 are receiving/listened on by some reverse proxy/web server. A reverse proxy is irrelevant here though right? Your Reddit comment posts aren't being handled by the reverse proxy, they're being handled by Reddit's backend. If the backend had a vulnerability that could be reached from their comment service the reverse proxy wouldn't stop it. >Not a 3rd party FOSS software that doesn't focus on open port vulnerabilities for the most part. I haven't seen details from the screenshot that indicates the exact software being run. Could you share the exact software? >I was shocked to see them fighting with me saying reverse proxy "overcomplicates the setup" compare the the current solution they have. If the reverse proxy forwards everything to the backend service what value is it providing. It seems to me like it'd be an overcomplication too. Could you share how the reverse proxy improves security? What value is it providing beyond forwarding requests to the backend server? ---------------------------------------------------------------------- BeYeCursed100Fold · 2023-10-01 06:02 >Opening ports bares no risk >since most on this sub don't know what their are doing You're one of the biggest idiots on this sub. You have multiple grammatical and spelling errors in your dumb af comment(s). People should not only not take advice from you, but you shouldn't be operating computers/devices/vehicles. You're like the only helmet- wearer on the shortbus of r/selfhosted...and reddit. ---------------------------------------------------------------------- BeYeCursed100Fold · 2023-10-01 06:03 You're fine. 11Notes is an idiot and a troll. Disregard their comments. ---------------------------------------------------------------------- Scoth42 · 2023-10-01 06:07 I'm a syseng/infrastructure engineer/devops/senior data engineer/whatever they feel like calling me this week. I do quite a lot of networking although not quite to the level of a full on network engineer. You're describing two drastically different use cases though. In one case, you have people trying to run game servers generally from home. Set up some port forwarding to the specific port or three a game might need and call it a day. They're not "exposing their internet" any more or less than if they were using a reverse proxy or tunnel. SRV records are specialized DNS records and can simplify configuration and service discovery (especially if you're running a service on a non-standard port) but they're rarely required for general stuff. If I'm a business hosting hundreds of applications on different ports then... well, it depends on what I'm hosting and what the use case is. If I'm, say, a game server hoster where I'm hosting instances of games for people, then it's quite likely I'm going to expose the ports separately. Realistically I may run it through some kind of DDOS/threat detection protection service like Cloudflare or Akamai but there's no great requirement. On the other hand, if I have hundreds of applications and I don't feel like dealing with mucking with SSL certs on each application (and/or just use self signed to keep encryption going internally and not have to deal with renewing tons of certs) then sure, I'll stick a reverse proxy in front of it mainly to handle SSL termination and maybe simplify reaching the applications with vhosts. Maybe add some authentication too if the applications don't support it themselves. But again, SRV records are generally not necessary for most services. I actually do run a (obviously much smaller) setup somewhat like that on my home stuff. Public IP -> TCP port 443 forwarded to my public facing docker host -> nginx container -> fanout to my internal services. This includes Nextcloud, Kibana, web server, SIP phone PBX admin page, and a couple other random things all running on different ports and a handful of other VMs. Works great. You still haven't explained what a reverse proxy or tunnel is supposed to add for people running random game servers at home like these people seem to be trying to do. ---------------------------------------------------------------------- ElevenNotes · 2023-10-01 06:17 Read my statement again, especially the “but since most on this sub don't know what they are doing» this includes any random people on any random Discord servers. Open a port and forwarding it to whatever, is no problem, if you know what you are doing. If not, you are better of using cloud services. ---------------------------------------------------------------------- SwimmingHat8351 · 2023-10-01 06:31 Exactly your point. Srv shouldn't be used for regular stuff. Also for games, they aren't planning to play with ip:port. Most game servers nowadays support domains and dns resolving. So assuming you want the players to connect with a domain like 'game.example.com' you gotta setup a web server for it. And since there are multiple services required on the public domain (the gaming panel, then the games) you need 2 domains to be mapped at the very least. In such cases you not only need a web server but also a reverse proxy unless you want people to use domain:port to connect. The way they were talking seemed like they are using srv records as a alternative of reverse proxy. I've already explained how their recommended setup looks. I guess you get the idea. Even in your home setup, you are routing the connection via nginx and exposing only 443 to the public. Imagine not doing that, instead exposing various ports for all your services. Let's say you open port 8080 for nextcloud, maybe 8090 for kibana. Does that setup sound reasonable? ---------------------------------------------------------------------- SwimmingHat8351 · 2023-10-01 06:33 At what point did I state 'Reverse proxy is a protection against every malicious attempt' ? I am quite forgetful could you remind me again? ---------------------------------------------------------------------- ElevenNotes · 2023-10-01 06:37 As I mentioned previously you belong to the *“I don’t know what I’m doing group”*, be happy with your tailscale and CF tunnels and reverse proxies, there is no shame in using them. There is a reason why these businesses expose their ports for you, with almost no problem. They do the work you should have done for you. ​ If there are people on Discord who expose their ports directly without any security regards, how is this your problem? Let them be part of the next botnet, maybe that way the learn? And maybe you can learn how to secure an infrastructure so that you can actually expose a port directly and don’t rely on Tailscale, CF and more to help you. ---------------------------------------------------------------------- ElevenNotes · 2023-10-01 06:40 Mega cool, und etz? Scho mal überleit das nöd jede Änglisch als Muettersproch hät und das es Lüüt git wo uf em Handy halt mal Tippfehler machet? Wohrschinli no nie überleit du huere tschooli. Usserdem wenn dis einzigä Argument isch «er hät en Grammatikfehler gmacht, meeeeeeeeee», dä häsch eh verlore. ---------------------------------------------------------------------- BeYeCursed100Fold · 2023-10-01 06:41 That's all you got Chet? ---------------------------------------------------------------------- BeYeCursed100Fold · 2023-10-01 06:45 You can't even comment in German without errors. Go home. ---------------------------------------------------------------------- iC0nk3r · 2023-10-01 06:52 Do you know what a reverse proxy is and what it's used for? ---------------------------------------------------------------------- SwimmingHat8351 · 2023-10-01 07:04 Never recommended it as the 'safe way' but it's definitely better than having 100s of port exposed to the public by port forwarding. Just open 80 and 443 and let your reverse proxy and web server handle the rest like a sane person. ---------------------------------------------------------------------- SwimmingHat8351 · 2023-10-01 07:06 If you think a reverse proxy is not required. I wonder how'd you do the setup? Would you do the same as them where they open random ports to the public then use srv records to map domains with the random port? ---------------------------------------------------------------------- ElevenNotes · 2023-10-01 07:09 I'm glad I speak multiple languages unlike some other people. Bye. ---------------------------------------------------------------------- Vogete · 2023-10-01 07:09 No, reverse proxies are not "required". They also don't necessarily increase security. They CAN add extra benefits in the majority of cases (eg. load balancing, SSL termination), but there are plenty of services and companies who don't use reverse proxies, and are completely fine. Especially since at the end of the day, the reverse proxies will just forward the request to the end service, so they won't really protect from an attack. Saying "that's not how you expose ports" is just utterly wrong. If you for example host the DVWA or WebGoat services publicly (two projects that are designed to be insecure), no amount of reverse proxies will save you, or even increase your security. Feel free to try it, but I'd have a disaster recovery plan first. Now, they CAN help in some cases with security, but it's not guaranteed, and it's dangerous to think it will always give you extra security. I'm sorry to say, but you're just simply wrong, and instead of repeating "you shouldn't just expose, and use reverse proxy", you should dig into the security of reverse proxies ---------------------------------------------------------------------- SwimmingHat8351 · 2023-10-01 07:10 The software recommends you to open port 22 *to the public* of your main server. So can you can access ftp files of the game. And the answer to all 3 of your questions is no. It's a panel dashboard type software think like cPanel but dedicated for game server hosters. ---------------------------------------------------------------------- BeYeCursed100Fold · 2023-10-01 07:10 Bye. I speak seven languages and I don't wear a helmut...helmut. "bye bitcha boy" ---------------------------------------------------------------------- Scoth42 · 2023-10-01 07:11 >So assuming you want the players to connect with a domain like 'game.example.com' you gotta setup a web server for it. Why? If I'm connecting to a game's default port, generally they don't require you to specify a port and you don't need a web server for it. Like if I'm connecting to a Minecraft server set up on the default port 25565 I can just stick the server address alone in the Minecraft multiplayer connector spot and it works. Most games (and non-game services) work this way - for example if I'm connecting to a Windows server over RDP that's running on the default 3389 port, I can just stick in the IP/hostname without a port and it connects fine (let's not get into the issues with running that publicly, that's neither here nor there). ​ > In such cases you not only need a web server but also a reverse proxy unless you want people to use domain:port to connect. If the game control panel is something standalone, it's going to be running some kind of web server already. One would hope it'd have SSL support (even if self-signed). If not, this is a scenario a reverse proxy would be helpful to ease public SSL support although it's technically not required. Otherwise you use port forwarding to forward in port 80/443 for the game control panel and then whatever port(s) whatever game it is uses and players should be able to connect to both/either with the IP/domain with no ports specified. ​ >Imagine not doing that, instead exposing various ports for all your services. Actually, I only expose my layer 7 stuff through my reverse proxy since I make heavy use of vhosts. Nginx can handle plain layer 4 proxying but it doesn't really add a lot unless you need to redirect ports or do load balancing, neither of which I need with my random other services. So I just do that through standard port forwards. So, yes, that sounds reasonable? ---------------------------------------------------------------------- SwimmingHat8351 · 2023-10-01 07:13 The root issue here is people in a game server panel is recommending 80's technology of classic exposed ports with no web server or reverse proxy to host their game servers. You can definitely open ports safely if you know what you're doing. But suggesting such a thing in a mass scale to those who have 0 networking knowledge. It's not just stupid, it's dangerously stupid ---------------------------------------------------------------------- SwimmingHat8351 · 2023-10-01 07:15 I think I missed the point with this post. It's a self-hosted game server panel' support discord (think like cPanel but dedicated to game servers) The documentation of the software clearly states to use a reverse proxy if they require to publish stuff on the internet. However these people (I believe they are pretty old in the community as well) believes reverse proxy only overcomplicates stuff. They suggest people to expose every private port to the public, then use srv records to modify the subdomain's port to the one specified. How does that make sense over something like reverse proxies/tunnels. I wanna ask to those who downvoted my comments. Do you really recommend their way of exposing stuff to the public over the standard reverse proxy on tunnel methods? ---------------------------------------------------------------------- SwimmingHat8351 · 2023-10-01 07:20 I should've sentenced it better. I'm not saying 'exposing ports directly is unsafe' but unless you know what you are doing. It can be a huge risk. The way people hide exposed ports is by using internal network and a web server that listens on port 80 and 443. But these people directly opens all ports for services and use srv records in domain to modify the traffic. Not just that they recommend a bunch of people (especially kids) to expose their ports publicly on their discord. It's plain stupid and dangerous ---------------------------------------------------------------------- ericesev · 2023-10-01 07:23 >I wanna ask to those who downvoted my comments. Do you really recommend their way of exposing stuff to the public over the standard reverse proxy on tunnel methods? That's not what is being downvoted. It's the implication that the standard reverse proxy provides value in this situation. A standard reverse proxy just forwards traffic (like a port forward) by default. Same with Cloudflare, it just forwards whatever traffic is sent to the domain name by default. That does nothing to protect a vulnerable backend from attacks. I think you're genuinely trying to help increase security. But you're not providing enough details to describe how. How do you recommend the reverse proxy be configured such that it prevents the vulnerable backend services from being reached? ---------------------------------------------------------------------- SwimmingHat8351 · 2023-10-01 07:26 If your backend has issues. It's unrelated to open port vulnerabilities and out of scope of our discussion here. It's called Pterodactyl. The documentation of the software is far more logical than what the Discord support recommends. Again as I said. A reverse proxy doesn't protect you from vulnerabilities on your existing app. But it reduces the chance of attack in the first place by reducing the number of open ports. Also and the web server are build with open port vulnerabilities in mind. Other softwares are not. ---------------------------------------------------------------------- iC0nk3r · 2023-10-01 07:31 That didn't answer my question. Do you know what the purpose of a reverse proxy is? How would I do what set up? If you're talking about the picture you posted, then you would do that with either SNAT or port forwards. I don't understand what you're stuck on here. I think you need to improve your knowledge on common ports and firewall best practices. 25565 is the default Minecraft port. You wouldn't pipe that through a proxy OR a tunnel. It introduces a needless hop in the route and is just something else to introduce latency. Do they need to forward 80/443 for Minecraft? Probably not, but maybe they're also running a webserver. Who knows. You don't give a lot of context. But it doesn't appear they're mapping 80/443 to multiple hosts, which would be the reason to introduce a reverse proxy. ---------------------------------------------------------------------- SwimmingHat8351 · 2023-10-01 07:47 It's a game server panel. Think like cpanel but dedicated to game servers. So you get a web ui panel that works on regular http or https protocol. The game server part comes after that. We use a reverse proxy to forward multiple services on a single port of an ip (port 80) so your domain/subdomains can access the proper service. Without you having hundreds of ports opened to the public internet. ---------------------------------------------------------------------- mourasio · 2023-10-01 07:51 > Show me a single professional server where people use publicly exposed ports and modified srv records to point domains. Boy would you be in for a treat if working in the industry ---------------------------------------------------------------------- ericesev · 2023-10-01 07:56 It sounds like ports aren't the issue here. The backend "Pterodactyl" is the issue. How will closing ports and exposing the same Pterodactyl backend through a reverse proxy on a pubic domain fix the problem. ---------------------------------------------------------------------- ericesev · 2023-10-01 08:03 The game server has a public DNS name. The reverse proxy will forward requests for that name to the game server's panel. The port isn't the issue. The buggy game server panel is the issue. ---------------------------------------------------------------------- dddd0 · 2023-10-01 08:04 Reverse proxies do absolutely nothing for game servers. ---------------------------------------------------------------------- iC0nk3r · 2023-10-01 08:04 Personally, I would move any management web UIs off of common ports. Wouldn't want someone door knocking and finding a management portal. Why do you keep saying "hundreds of ports". The example you posted is 3 ports. Maybe they only have 1 service that is using HTTP/HTTPS, which means setting up a proxy is not needed. Sounds like you have multiple webservers running, so a proxy makes sense in your case. Main point: either way is fine. There is nothing wrong with port forwarding without a proxy/tunnel if you are aware of how to secure it. ---------------------------------------------------------------------- mirandanielcz · 2023-10-01 08:11 Sounds pretty normal to me (if you meant port 21 and not 22) ---------------------------------------------------------------------- TheRigbyB · 2023-10-01 08:18 What’s the issue? ---------------------------------------------------------------------- Vogete · 2023-10-01 08:25 > So assuming you want the players to connect with a domain like 'game.example.com' you gotta setup a web server for it. I don't think you understand anything about networking based on this one line. ---------------------------------------------------------------------- gryd3 · 2023-10-01 08:28 Sorry.. but I've gotta say it. This is an oversimplified boardline stupid way of looking at the problem. You are only considering http/https traffic. You are not considering the stability or security of any of the code that \*is\* being presented via http/https. You do not seem to understand the reverse proxy roles in the environment. What you are talking about is simply reverse http/https proxy so you can host multiple sites from a single set of ports and fan the connections out to different hosts that hold the 'real' website files.. that said, vhosts can host multiple pages on the same ports too... The problem comes up when you want to host non http/https traffic like minecraft on port 25565, perhaps terraria on port 7777, DIY Teamspeak server on 9987... You can't just shoehorn all of these different applications into a port 80/443 proxy... There are a number of services you simply can't consolidate behind a proxy either, as the application simply does not send identifiable information that a proxy can interpret to determine the proper host to forward traffic to. What I can say, is that reduction of your footprint is a sound security measure. Security through obscurity is not. Different applications and services have different needs, and to be available to the public, the ports must be accessible. It makes little difference to your security if the target port is proxied or not. Go lookup what a Web Application Firewall is. What you need is edge security, intrusion prevention and detection, logs and alerts. Bonus points to isolated network segments and proper care of login credentials and keys. What you don't need to be hung up on is the fact that an open port is not dangerous. It's not the port you need to worry about. It's the application using the port that you need to worry about. ---------------------------------------------------------------------- graphics101_ · 2023-10-01 08:33 When I was younger, I've opened ports because of people like lucky the server I was hosting was up-to-date and wasn't exploited, but people should stop saying "It's okay to port forward if it's just for your friends" ---------------------------------------------------------------------- JakeSully-Navi · 2023-10-01 08:33 SSL does not protect it, SSL only makes so you can load a website over HTTPS or other services where certificate verify it. It also can encrypt data buy that is it. It does not protect you from DDos attack and other things. ---------------------------------------------------------------------- g-nice4liief · 2023-10-01 08:44 But they could. ---------------------------------------------------------------------- SwimmingHat8351 · 2023-10-01 08:52 I'm not sure how a standard/default reverse proxy work compared to what I understand. My experience with reverse proxies is limited to NPM, they work with ports internal on my network and proxy them to port 80/443. So when my domain points on my publicip:80 it redirects to the respective service. Therefore you don't need to expose other ports out to the internet. Why shouldn't the software be accessible on the internet? Let's say I want a friend to be an admin on my server so that he can control the server? The panel even comes with a UAC with default roles like Admin, Moderator etc for it. So I'd like my friends to go to a certain domain and access the server control panel. The panel comes with an inbuilt user authentication but asking people to remember ports is difficult. Open ports can cause risk. Close ports can't cause risk. Therefore reasonably ports should stay closed unless they are properly configured and absolutely necessary. ---------------------------------------------------------------------- SwimmingHat8351 · 2023-10-01 08:59 How's the backend the problem here? Not just a reverse proxy. A reverse proxy with a web server so domains can reach the service on a specific port (80 and/or 443). You don't require to open multiple ports publicly if you need multiple (sub)domain for multiple services. I did not say configuring a reverse proxy will help prevent attacks. I'd say you don't require to have multiple exposed ports on ips. So even in case of open port vulnerabilities, you are far more secure this way. Authentication is inbuilt on the panel frontend. Regardless of the ip/domain you access it from. ---------------------------------------------------------------------- ericesev · 2023-10-01 09:03 The issue isn't with making it accessible on the internet, it's that making it accessible **publicly** to everyone isn't adding much value over an open port. An attacker can connect to the public URL the same as they can connect to the open port. I haven't used NPM. My understanding is that it has an "Access List" feature. That'll lock down the software so it is only open to those you trust. I think that'll keep you safe. https://www.youtube.com/watch?v=G9voYZejH48 ---------------------------------------------------------------------- SwimmingHat8351 · 2023-10-01 09:11 The panel comes with an inbuilt UAC and user authentication so accessing them with a domain is no problem imo. But I'd still prefer not to run them on common ports like you. That's the exact reason why I'd use a reverse proxy. I'd expose the panel internally on a random port (let's say 9443) then I'd use a reverse proxy to map it with port 443 which is mapped to my public ip with my port forwarding, so That my domain can still reach the panel. This way it's scalable as well, you can run even 1000s of game servers or other unrelated application without exposing anymore ports to the public. Most of the people there are self-hosters. One of person I was talking to, sent me some screenshots with at least 20 applications all exposed to different ports publicly. I've shared the screenshot somewhere in here you can try to find it. ---------------------------------------------------------------------- DarkIrata · 2023-10-01 09:12 Please link me the documentation. The way you said it, means you know which one ---------------------------------------------------------------------- SwimmingHat8351 · 2023-10-01 09:14 So you're saying I can reach your publicip:21 in an ftp client? ---------------------------------------------------------------------- ericesev · 2023-10-01 09:18 >Authentication is inbuilt on the panel frontend. Regardless of the ip/domain you access it from. Why do you trust the authentication when it is hosted on a public URL behind the reverse proxy and not trust it when it is on a port? How are the two different? HTTP traffic from an attacker reaches it just the same either way. ---------------------------------------------------------------------- Anposter · 2023-10-01 09:19 You didn't provide much details beside the screenshot and it seems you are misunderstanding the role of reverse proxy. It seems obvious you are talking about reverse http(s) proxy while raising issue that they are exposing tcp and presumably some udp ports as well. Reverse proxy is to simplify management of APIs and services behind which includes ssl termination. It is not firewall or anything of such sort to prevent all sorts of malicious attacks for which there are dedicated WAF solutions to apply. When you talk about tcp/udp "reverse proxy" it means you are mostly doing port forwarding and again you need to secure the service and traffic regardless, which in your example is Minecraft server. ---------------------------------------------------------------------- SwimmingHat8351 · 2023-10-01 09:20 What you're saying is correct if I am using an ip. But most people nowadays prefer domains. The control panel is standalone and requires an Nginx or Apache configuration with or without ssl to work according to the documentation. However the people in the support discord say a webserver is not required instead you should just expose ports and use srv records on your domain to access stuff. ---------------------------------------------------------------------- mirandanielcz · 2023-10-01 09:24 Sure. Are you saying that for example ftp.debian.org is badly configured? ---------------------------------------------------------------------- Fuzzy-Chef · 2023-10-01 09:30 Do you believe the number of open ports is relevant to the level of security? ---------------------------------------------------------------------- DarkIrata · 2023-10-01 09:33 Did you also graduated top of your class in the Navy Seals? ---------------------------------------------------------------------- Fuzzy-Chef · 2023-10-01 09:43 You seem to think that just because you send a package through a proxy before the target application adds security. Is that right? \> Reddit isn't using an ungodly port like 25000 or something exposed to the public. Ok. Now this is getting hillarious. ---------------------------------------------------------------------- DarkIrata · 2023-10-01 09:46 Damn, this is thread is a train wreck. No opening ports to the public is not necessarily dangerous. If you want others to access your service / game / website, you need to open them. Websites (http(s)) have advantage thats based on the given address it can serve different content. Using reverse proxies you can combine it through one service, ignoring if the website behind is hosted through custom software, apache, nginx or else. Since every webhosting software would need an own port to be reached. Thats the trick. This want work for game / service servers. Not all game servers supports srv domain records. Minecraft and Teamspeak for example does. This removes the need of giving a specific port when connecting, since its getting read from the srv entry. If you got 3 Gameservers running on Port x y and z, you cant combine them through 1 reverse proxy. The proxy still would need to know which port you want since games always connect to IP:PORT. You still can have a proxy as a man in the middle server which listens for X1 and forwards to X2 on an internal service. You still would have X1 open. ​ Open Ports can be dangerous when you use default ports for common software (security by obscurity for SSH (22) by changing it to something else is a good start (please use fail2ban everyone)). But its really dangerous if you got unused ports open. Only open the ports you need and know which software uses that port. ---------------------------------------------------------------------- azukaar · 2023-10-01 09:56 If they expose 80 / 443 then it's probably a reverse proxy with properly setup HTTPS (as they mentionned), and may be authentication, etc... It's not a big issue to expose those ports if you can ---------------------------------------------------------------------- SpeedcubeChaos · 2023-10-01 09:59 A simple reverse proxy is nothing more than a mapping between a (sub)domain or path to a service:port/path combination. If traffic hits the reverse proxy, it is forwarded to the service as if the traffic could reach the service directly. Attackers don't care, if they run their tools against https://domain:443/serviceA instead of https://domain:serviceAPort. If we only talk about forwarding traffic, a reverse proxy actually does not increase security but does increase the complexity of your setup. However, that is not all most reverse proxies can do for us. They can load balance traffic, simplify the setup of TLS for multiple services, provide access control by IP subnet, enforce HTST, block brute-force attacks etc. But you have to be aware of all those measures, configure them correctly, and also make sure to secure your downstream services in case the reverse proxy gets compromised or bypassed. ---------------------------------------------------------------------- Spuxilet · 2023-10-01 10:00 They simply do not have any other way. Well if you create vpn server and hand client configs to each person who wants to connect to your game server to play, of course you can do that. :) In our case i am doing exactly that but by connecting to my vpn my family can upload photo/video/contacts/calendar to my nextcloud or use my jellyfin instance to watch TV shows/movies. These are 2 different things. I also exposo from time to time cs server port to the public so that i can play it with my coworkers. ---------------------------------------------------------------------- Cirx0808 · 2023-10-01 10:21 This thread was a hilarious read. OP stop pretending you know what you're talking about and pick up a book on networking. Also for gods sake mask those usernames in the image if they didn't give you permission to drag their personal tags into this mess. ---------------------------------------------------------------------- DyceFreak · 2023-10-01 10:58 You don't seem to be able to get it through your head that an open port is technically an open door, but there could be a brick wall behind that door... meaning the door is meaningless. The port being open is absolutely meaningless, yet you're hung on it like a fanatic child who just read a CompTIA Security+ textbook and are anxious to put their textbook knowledge to use. Sad really. ---------------------------------------------------------------------- DyceFreak · 2023-10-01 11:05 >If you are exposing your reverse proxy, SSL does matter. As someone who hosts old school retro HTML4 websites with zero security, can you explain why; or does my use-case negate the need? ---------------------------------------------------------------------- DyceFreak · 2023-10-01 11:11 >Not just that they recommend a bunch of people (especially kids) to expose their ports publicly on their discord. It's plain stupid and dangerous OK explain to me how opening 1-65535 to a kid's gaming PC running Windows 11 with the firewall enabled is dangerous. Give me a single attack vector, a single usable exploit, I dare you. Should be easy to produce an attack vector, right? ---------------------------------------------------------------------- SwimmingHat8351 · 2023-10-01 11:31 Why do you think the kids pc with windows 11 be the attackers target? You can be a part of a botnet, your entire home network can be a risk depending on how the configuration is setup. ---------------------------------------------------------------------- afloat11 · 2023-10-01 11:44 But how? If your gamekeeper depends on UdP you can’t simply reverse proxy the traffic. You need to open another port for every game server and assign those ports to sub-domains per records. If you find a way to proxy UDP traffic, please tell me (btw MC uses TCP and is therefore proxy‘able) ---------------------------------------------------------------------- Bonsailinse · 2023-10-01 12:14 It’s hilarious to see this kiddo (Op) being confidently incorrect and still trying to defend themselves in the comments. My guess would be a fresh cs student, learning about self hosting as a side project. Thought it would be edgy to expose others being so dumb not to properly protect their infrastructure. Well, they probably don’t, but this screenshot just embarrasses Op themselves. ---------------------------------------------------------------------- StewedAngelSkins · 2023-10-01 13:47 >VPN has nothing to do with this does the proxy not establish a private link to your home network? that's how I've always set it up when ive done this sort of thing with a vps, though i guess you could just rely on tls. >you can limit the IPs that are able to connect to you to those of the proxy provider. but the proxy provider is going to forward anything it gets over the tunnel, so in effect you're still getting the same connections from the public internet. this isn't a problem in and of itself of course, it's in fact necessary if you want your stuff to be public, but it's exactly the same as if you had just exposed the ports on your home firewall. >In addition, these providers base their business model in selling you "clean" traffic. you're talking about cloudflare and friends? yeah, they ostensibly do *something*. that's way beyond a proxy though. > swear it gets ridiculous how this sub bases their whole security posture on "vpn good" - having any other port publicly exposed "ticking time bomb" You kind of jumped the gun with this rant. I didn't say anything about VPNs (aside from characterizing the link between your home network and the proxy as one). Is there some sort of partisan bullshit going on that I'm not aware of? ---------------------------------------------------------------------- JustNathan1_0 · 2023-10-01 14:47 Why is the img not loading ---------------------------------------------------------------------- mourasio · 2023-10-01 17:31 I might have taken out my frustration with the uninformed security advice on this sub on you, apologies! I'm guessing there's probably hundreds of these types of services, but a reverse proxy wouldn't naturally set up a private tunnel to you, but send the traffic over regular old Internet. Cloudflare (disregarding the tunnel/cloudflared option) is a reverse proxy with additional security benefits (WAF, DDoS, etc), but any proxy service vastly improves posture over direct access, by blocking out a lot of simple TCP based stuff - granted that unless you have some sort of WAF, it won't stop specific vulnerabilities. I don't know Tailscale which commonly gets mentioned in these discussions as well, but setting something like Cloudflare up IS more secure than having a VPN (imo - each approach exposes you to some risks while blocking others - no silver bullet unfortunately).