Port forwarding reddit / selfhosted ---------------------------------------------------------------------- West-Impression4452 · 2023-10-09 13:52 So I want to make server with me and my friends I want to try port forwarding but I heard that’s a security risk I’ve tried ngrok but it doesn’t seem to work is port forwarding actually dangerous? ---------------------------------------------------------------------- Solkre · 2023-10-09 13:59 Depends what you’re forwarding. Is this Minecraft or something? That’s fine. ---------------------------------------------------------------------- AnnualOasis · 2023-10-09 13:59 Short answer: no Long answer: no, as long as you understand what you’re doing the harden the machine and services exposed are sufficiently hardened / designed to be exposed. ---------------------------------------------------------------------- InfluentialFairy · 2023-10-09 14:02 just make sure the Minecraft server is up to date, last thing you want is log4j ---------------------------------------------------------------------- Flipdip3 · 2023-10-09 14:03 Only forward ports you need. Try to not use the default ports. Exposing SSH as something other than port 22 drastically cuts down the amount of random attempts made against your system for instance. Keep things up to date. Security patches and what not are important. If at all possible use authentication on those services. A good VPN is probably safest if you are wanting to grant them access to stuff. Though probably not ideal for a game server. ---------------------------------------------------------------------- crinstifins · 2023-10-09 14:42 I agree with your points about updates. Very important. A VPN is definitely a good idea, though maybe not for a gaming server. However, the idea of running a service on a non-standard point is often referred to as Security by Obscurity. It is not an effective method of securing an environment. Threat actors would run a port scan of the target before attempting an attack to see what is and is not open and will see that, though port 22 is closed, port 6969 is open and SSH traffic is running through it. Additionally, though this is probably not applicable for this user, the default profiles in an IDS/IPS would be likely to flag the SSH traffic over a non-standard port as malicious, citing the non-existent hackers attempt to hide their SSH access on the alternative port. ---------------------------------------------------------------------- Flipdip3 · 2023-10-09 17:27 Changing the port doesn't actually change the security. You are right there. There is also a measurable drop in automated attacks just checking every IP address they can for common ports. Ideally if you have other defenses set up you'll be fine, but you might as well not have them poking your services in the first place. ---------------------------------------------------------------------- West-Impression4452 · 2023-10-10 02:48 So does that mean it’s safe? ---------------------------------------------------------------------- Sivarion · 2023-10-10 11:33 I change default SSH port on all my servers and never experienced any complications caused by incorrectly attributed my traffic as malicious activity. Sure it is security by obscurity, but it highly reduce number of unwanted login attempts. Yes, they were all failed, but this is still something, that your system has to handle one way or another. And changing the default port leaves port 22 free, which in turn allows you to set up a honeypot ;) ---------------------------------------------------------------------- Flipdip3 · 2023-10-10 12:20 Imagine instead of locking your door you just hung a sheet in front of it that made it look like the rest of your siding on your house. The door isn't /actually/ more secure. Anyone who looks behind the sheet(Port scanning) would be able to walk right in. But less people are even going to come up and try because it isn't easy to see from the street. Automated scans are looking for standard services on standard ports because those are the ones most likely to be in a default configuration. They want to use whatever out of the box exploit was recently found and use it on unpatched systems. Moving to a different port keeps you off their radar a bit and that means when there is an exploit found you are less likely to get attacked until you can patch it. It still needs to be done in addition to other security measures. For SSH disabling passwords and only using SSH keys, etc.