Networking advice reddit / selfhosted ---------------------------------------------------------------------- MNIMike · 2023-10-06 21:06 I need some self hosted network advice. I've always had a pretty standard network setup. In the last year or so, I've gotten into some internal self hosting stuff. I took the path of least resistance, so I just use my old PC as a windows 11 server with a mix of directly installed services and some docker containers through WSL2. WSL 2 was a learning experience and the poor disk throughput to the windows filesystem has meant more directly installed services than I'd like. Not how I'd do it from scratch, but it's where I am. The medium term plan is to remake this server heavily containerized, probably running on unraid. But in the shorter term, the services are all running fine. I want to expose a few of my services so I and family can access them outside the home via a domain I own. Now, I also want to protect my home network as much as I can in the event my server gets compromised, but currently I'm just running everything off a Modem/Router combo provided by the ISP. It has very few configurable options. I'd like connections from my home network to be able to connect to my server on a few specific ports (remoting in, stream some media), but my server unable to open a connection or see the rest of my home network. I'd like this to be enforced by the network rather than configuration on the server, since this is in case it gets compromised. I'd also like to protect the server from being compromized as much as I reasonably can. I currently also have two spare older routers. The way I run it through mentally, if I were to use a second router behind my first LAN->WAN, the second network would be able to access the first but the first would have to go through the 2nd router's firewall to get to the second. So for that to work the way I want, my server would have to be on the first network and everything else on the second. But then all of my devices would be double natted, which would cause some pain. Or maybe I'd be better off just buying a Unify dream router or other router with better config options, and putting my current modem/router into bridge mode and run everything off of the better router with VLAN options. I was hoping to not spend a few hundred bucks though. For all options, I think routing my domain through cloudflare will be done, to utilize the protections they can offer for free. The benefits for me outway the potential man in the middle for https that would result. Any better options? Am I crazy and overthinking it? ---------------------------------------------------------------------- ASouthernBoy · 2023-10-06 21:15 I don't know what's Windows 11 server. Server is 2022 for example. The typical way of doing what you want is forwarding 443 port to your proxy server (example nginx) , nginx then routes to whatever service you have on your "server". There are many ways to accomplish this but most important one is to make sure you have public (not behind cgnat) IP address. ---------------------------------------------------------------------- thekrautboy · 2023-10-06 21:36 Do your research into "reverse proxy servers". Also, probably /r/HomeNetworking and other subs are more ideal for you. ---------------------------------------------------------------------- NikStalwart · 2023-10-07 01:10 > WSL 2 was a learning experience and the poor disk throughput to the windows filesystem has meant more directly installed services than I'd like. Use docker. It'll still run with the WSL2 backend, but the throughput isn't that bad. You either use an internal volume (in which case there aren't any fs translation latency) or you mount host folders into containers and let docker's own drivers handle things, which is also fairly fast. > Remote Access Use a VPN for this. If you use Wireguard/innernet, you only need 1 open port - the VPN port. If you use tailscale/headscale, you need zero open ports. Then it doesn't matter what router/modem you use. Don't buy ubiquiti gear. It's the Apple of networking. Looks good, but overpriced for what it is. The problem with networking kit is that anything with a consumer pricetag will have consumer (i.e. bad) performance. For instance, you cannot get good packet inspection going on the 15-year-old Intel CPUs they are running if you want gigabit speeds. If you want a chunky router you might as well build a small server box to do it, it will be cheaper than buying a proper router that the big boys use. ---------------------------------------------------------------------- MNIMike · 2023-10-07 01:26 > Use docker. It'll still run with the WSL2 backend, but the throughput isn't that bad. You either use an internal volume (in which case there aren't any fs translation latency) or you mount host folders into containers and let docker's own drivers handle things, which is also fairly fast. I am using docker, yeah. WSL2 is a lot slower than WSL was when accessing the windows drive. It was a design tradeoff for WSL2. https://learn.microsoft.com/en-us/windows/wsl/compare-versions > Use a VPN for this. If you use Wireguard/innernet, you only need 1 open port - the VPN port. If you use tailscale/headscale, you need zero open ports. Awesome, I'll look at tailscale/headscale > Don't buy ubiquiti gear. It's the Apple of networking. Looks good, but overpriced for what it is. The problem with networking kit is that anything with a consumer pricetag will have consumer (i.e. bad) performance. For instance, you cannot get good packet inspection going on the 15-year-old Intel CPUs they are running if you want gigabit speeds. If you want a chunky router you might as well build a small server box to do it, it will be cheaper than buying a proper router that the big boys use. I don't need a TONNE of performance. I'm seeing 700 Mb for the dream router, which should be plenty for me for a while. Is there an off the shelf equivalent from a better company that can compare price wise that you recommend? Obviously plugging in a SFF pc with pfsense or something would probably be better, but I really don't have time for another learning project right now. ---------------------------------------------------------------------- MNIMike · 2023-10-07 01:29 Thanks, I'm familiar with Caddy and nginx and am using them already on the server. But I was more looking for a networking solution that would still offer separation if the whole box was completely compromised. ---------------------------------------------------------------------- NikStalwart · 2023-10-07 01:30 > I don't need a TONNE of performance. I'm seeing 700 Mb for the dream router, which should be plenty for me for a while. Is there an off the shelf equivalent from a better company that can compare price wise that you recommend? Obviously plugging in a SFF pc with pfsense or something would probably be better, but I really don't have time for another learning project right now. Unfortunately, I don't have something I can recommend. I stopped looking into router hardware after deciding to go the VPN route. I just remember the Ubiquiti specs being very underwhelming when I was looking. ---------------------------------------------------------------------- MNIMike · 2023-10-07 01:37 It's not running windows 11 server, which isn't a thing. It IS a windows 11 server. As in its role is a server, and its running windows 11. I'm running a reverse proxy on the server with a decent rule set to secure the server. But I'm looking for more of a networking solution for separation in case the server is entirely compromised. I don't have another box to spare to set up another physical proxy server if that's what you mean. I have a public but dynamic IP, but I will be updating cloudflare automatically when my IP gets updated, which is rarely. ---------------------------------------------------------------------- MNIMike · 2023-10-07 01:40 Makes sense. Thanks anyway! I was looking for alternatives, but unfortunately most of the recommendations I see for alternatives people recommend very quickly balloon in relative cost. Like anything when you start to dip your toe out of the casual consumer realm. ---------------------------------------------------------------------- NikStalwart · 2023-10-07 01:51 > most of the recommendations I see for alternatives people recommend very quickly balloon in relative cost. Like anything when you start to dip your toe out of the casual consumer realm. Ain't that the truth! Good luck VPNing!