Desire for tunneled mail server. Please help me accomplish this. reddit / selfhosted ---------------------------------------------------------------------- EVILxMANIAC · 2023-10-02 06:15 Hello everyone, I'm here today to ask for your assistance. Rn I have an issue. I wanted to setup Passbolt so I could move away from dashlane due to a ram leak they refuse to fix, not to mention I would like to not send all my password information off to a third party and not have to pay a monthly fee just to be able to use it on more than 1 device. Problem is it requires a mail server in order to send out confirmation emails for account creation etc. Now I previously had a mail server up and running but in an effort to reduce my attack surface to prevent any future incidents I have moved my setup to cloudflared tunnels so I don't have to port forward giving more attack surface among solving some other issues. Unfortunately this breaks my mail server and a few other key containers due to them having multiple ports among other problems. So I'm here for advice from those who are far smarter and more experienced. How can I forward the traffic required for a mail server or a service with multiple required ports through a tunnel? So far I require this for poste and wuzah but I haven't gotten through my entire stack so there may be more I need this for. I have already started the process of moving my Nginx Proxy Manager to docker network br0 to assign it's own ip address. I did this in the hopes I could listen on ports other than 80 and 443 without taking up those port allocations as other services obviously need them. I then used && docker network connect br0 containername as a post argument in the unraid docker config screen so anytime the container is started it will be added to the network so nginx can communicate with it. Note I have already enabled communication between host and custom networks but it doesn't seem to be working as intended, so I am using this method along with using container hostnames to route inside nginx since the internal ips change. So far this is as far as I have gotten as I had been awake for over 28 hours at that point and I passed out, I still haven't quite recovered so likely going back to sleep but figured I could make a post and hopefully come back to a plethora of solutions to try. Please help me. ---------------------------------------------------------------------- ElevenNotes · 2023-10-02 06:40 I can see that you are awake since 28h by the amount of gibberish you have written down here. Come back when you had some rest and simply ask:” I have an SMTP server and would like to receive and send mails via any sort of tunnels (CF, Tailscale, …), how can I do this?”. Get some sleep. ---------------------------------------------------------------------- ptarrant1 · 2023-10-02 08:27 Amen. But we have all been there. All too often we go down rabbit holes of research and end up like this. I find it's best to read, learn...then take time off to ponder and digest, and of course...Get some sleep. This is how we are wired, we need time for the CPU to process the data models. ---------------------------------------------------------------------- EVILxMANIAC · 2023-10-02 09:29 Added TLDR at top of post. Thanks for the suggestion. Unfortunately my insomnia took hold before I could pass out again so here we are. ---------------------------------------------------------------------- ElevenNotes · 2023-10-02 09:35 No worries, I understood what you wanted and need, but unfortunately that’s not possible. Maybe the best solution would be to use a free or paid relay service? ---------------------------------------------------------------------- EVILxMANIAC · 2023-10-02 09:37 if you can suggest some I'd be down to take a look but do you mean not possible for mail only or just for multiple ports in general? I have a few dockers with several ports not to mention game servers can have many ports per server. ---------------------------------------------------------------------- ElevenNotes · 2023-10-02 09:40 I’m strictly against the use of any of these tunnels for my own personal reasons but I’ve read here that basically only some functionality works and some doesn’t. CF does seem to have a TCP ingress, but I don’t think it works with SMTP. ---------------------------------------------------------------------- EVILxMANIAC · 2023-10-02 09:44 yea it has tcp and unix options but honestly speaking I'm brain dead when it comes to these protocols and how they are used etc. Just been trying to better secure my server for the time being since people have been complaining. ---------------------------------------------------------------------- ElevenNotes · 2023-10-02 09:48 Secure does not mean using CF or tailscale tunnels. Get familiar with the protocol, get familiar with network segmentation and VLAN. Get familiar with ACL and L3. Get familiar with software that provides the service you are needing (SMTP ie). Get familiar how you can secure an SMTP server. ---------------------------------------------------------------------- NikStalwart · 2023-10-02 12:38 Seconding ElevenNotes, use a pay-as-you-go SMTP relay. Amazon Simple Email Service or Mailchimp/Mailjet/mailgun/mandrill will be cheap enough for personal use - less than a dollar a month I would think. Can you use tunnels? Yes. Can you use cloudflare tunnels? Don't know but probably not. Is using tunnels a good idea for mail? Not really. ---------------------------------------------------------------------- McQueen2063 · 2023-10-02 12:41 very well said! I too run my own public mailserver since over two decades :) it does indeed boil down to understand networking, the protocols aaaand do update your software. always. my stack right now: opensmtpd, dovecot, rspamd. works awesome :) ---------------------------------------------------------------------- EVILxMANIAC · 2023-10-02 14:52 ik it's not really a good idea but I am trying to avoid having to open up ports as much as possible. ---------------------------------------------------------------------- GrumpyCat79 · 2023-10-02 22:34 I don't know if it's a selfhosted instance for just you and possibly family/friends, but what I would do: - If it's just for you: I would setup dovecot and postfix on my server and run an internal-only mail server - If you also need to send email externally to a small amount of person: I would use my personal mail provider's SMTP server. That's what I do for the tiny amount of external emails that I need to send ---------------------------------------------------------------------- iavael · 2023-10-02 23:25 BTW nginx can proxy_pass mail protocols. ---------------------------------------------------------------------- adamshand · 2023-10-02 23:39 This sub is weirdly hostile to open ports, and many think that VPNs magically make everything better. Software like SMTP servers are designed to be run with open ports facing the internet. There's nothing wrong with that, and nothing inherently "insecure" about it. You keep your services "secure" by choosing well written software, staying on top of updates, using good passwords, and having sensible network and application configuration. ---------------------------------------------------------------------- EVILxMANIAC · 2023-10-03 02:02 My server gets pretty high amounts of traffic during normal opperation and the community I serve it pretty much only cheaters and hackers. So my server tends to get an unusually high amount of attacks so reducing the attack surface as much as possible has basically been my goal for the past 3 days since there were people complaining a lot in our discord about it. ---------------------------------------------------------------------- EVILxMANIAC · 2023-10-03 02:06 I believe this is reserved for nginx plus and I couldn't find a container for it not to mention I don't use standard nginx I am using nginx proxy manager which to be honest has been a real pain in my ass on several occasions due to limitations put in place for seemingly no reason other than user friendlyness. Have been seriously considering switching to just standard nginx and doing everything manually. ---------------------------------------------------------------------- adamshand · 2023-10-03 02:49 That's a sensible reason to reduce attack surface, but unless you're trying to hide origin IP addresses, I'm not sure putting things behind a proxy gets you much real protection from a targeted attack. If there's a bug, chances are it can still be exploited through the proxy. Since it sounds like you're dealing with targeted attacks (rather than just random internet scans), I'd probably focus on things like Fail2Ban/CrowdSec, SE Linux / AppArmour which will actually provide a second level of defence. Make sure all your services run as non-root users, ideally containerised / jailed in some way. You can also do things to try and detect anyone who is poking around. Like running SSH on a non-standard port and then instantly blocking anyone who tries to access port 22. Not sure if it's still maintained, but PortSentry used to be great for this. It listens to all ports (so it looks like every port on your server is open), but actually it's just a giant honey pot and it blocks anyone who repeated accesses non-active ports (so anyone that nmaps your server is instantly blocked). This isn't "real" security, but it makes it harder for people to poke around. I used to run a mail server for a group of security professionals / hackers and so was pretty paranoid about that as well! :-) ---------------------------------------------------------------------- EVILxMANIAC · 2023-10-03 03:05 TBH this contained a lot of useful information, many good sounding suggestions that I will be sure to check out but I think I should clarify the setup currently. RN I am not just proxying (wtf is the right adjective here XD) through nginx. I have 0 ports forwarded rn and absolutely everything is being routed through cloudflared/zero trust tunnels which is also proxied by cloudflare providing some extra protection even if it's not much. So hopefully this will help reduce the attack surface by a fair bit if my hunch and lack of a properly functioning brain is right. But I also very recently setup wazuh so that should provide a fair bit more information on what is actually going on. unfortunately due to unraid being built on slackware I can't install a wazuh agent on my unraid server which is hella unfortunate, might look into how I can possibly compile from source or something to that effect. If you have any more security recommendations I'm all for it rn. ---------------------------------------------------------------------- adamshand · 2023-10-03 04:54 Cloudflare is still "just a proxy", if your applications work through the proxy they can be exploited through the proxy (though proxies can make things harder). If you're serious about hardening your box, this is how I'd think about it in rough importance: 1. Good basic operations: good software, sensibly configured, regularly updated. Strong passwords, no root login, require ssh keys. Monitor services so you know if something goes down unexpectedly. 2. Good backups so you can recover if something happens. 3. Defence in depth: assume your public services will be exploited and minimise the chances of server being rooted (strong permissions, non- root services, containers/jails/app armour to reduce post-exploit attack surface). 4. Logging: ship all logs to a safe second box, something like Tripwire so you can find modified binaries. With this hopefully you can figure out what happened when you get exploited. 5. Active defence: Honey pots, PortSentry, Fail2Ban etc. ---------------------------------------------------------------------- iavael · 2023-10-03 08:54 No, these functions are in open-source edition of nginx for a long time, even from before nginx plus emerged, I believe.