Hide your IP with a VPS reddit / selfhosted ---------------------------------------------------------------------- Beautiful-Log5632 · 2023-10-10 21:58 To hide your own IP address could you rent a cheap VPS and use it to proxy to your servers that are hosting https applications? Your domain would have the VPS IP instead of your own and all traffic would be routed through the VPS to your servers. Would rather do it this way than use cloudflare because they block my browser a lot. And there are up to 20 people that have accounts on the applications I host so I don't want them to be blocked or have to do any configuration on their end to access it. Nothing should change for them. What would I need to set this up on the VPS? I don't want to terminate SSL on the VPS so can I still use nginx or would it have to be something like iptables? Would it require any changes on the servers hosting the applications or all configuration would be done on the VPS? ---------------------------------------------------------------------- natermer · 2023-10-10 22:05 I would setup a wireguard tunnel between my VPS and my home server. The only people that would know about your IP is your hosting provider and your server. Then setup a reverse proxy (nginx, apache, whatever you like, etc) on the VPS. Then configure virtual hosting on the reverse proxy to point to whatever you have hosted on your home server. For SSL you can just use letsencrypt in the normal manner. ---------------------------------------------------------------------- thekrautboy · 2023-10-10 22:11 You cannot hide your IP. Someone always knows it. You can only shift that from one entity to another. You cannot be 100% anonymous on the internet. Accept it. If you want to go freaky with it, go to /r/cybersecurity and /r/conspiracytheories ---------------------------------------------------------------------- i_am_art_65 · 2023-10-10 22:16 I did something similar without a VPN. I installed a reverse proxy in a VPS and had it forward to my web server. On my web server, I configured a firewall rule to only allow TCP 443 traffic from my reverse proxy. ---------------------------------------------------------------------- fyijesuisunchat · 2023-10-10 22:41 You can stream incoming requests via Nginx to a reverse proxy on your home server, yes. You do not need to interrupt SSL if you stream, and it is transparent to an end user. Others have mentioned that this is not absolute security, but is a reasonable measure and has strong other benefits, such as an effective static IP. ---------------------------------------------------------------------- GrumpyCat79 · 2023-10-10 22:45 There's like 10 post about that per week here. Yes, it would work and it's a solution that people with CGNAT uses (along with CloudFlare Tunnels) to expose services on the internet You can decide to run the reverse proxy on the VPS or just forward the port (80 and 443 for instance) to your home server and run the reverse proxy at the server. Make sure you enable MASQUARADE if you decide to forward the port directly to your home server You can use any VPN to keep your home server connected to the VPS. I like Wireguard but people here also use Tailscale and ZeroTier to achieve the same thing ---------------------------------------------------------------------- _ncko · 2023-10-10 22:59 You cannot make your house impenetrable. Someone will always be able to break in. You can only add layers of security to your house. You cannot make your house 100% secure. Accept it. ---------------------------------------------------------------------- Cygfrydd · 2023-10-10 23:10 This is exactly my config, and it's been near-flawless. ---------------------------------------------------------------------- thekrautboy · 2023-10-10 23:16 I didnt say otherwise? ---------------------------------------------------------------------- _ncko · 2023-10-10 23:22 I can see that. ---------------------------------------------------------------------- thekrautboy · 2023-10-10 23:22 Cool, then maybe tell OP and not me? ---------------------------------------------------------------------- Beautiful-Log5632 · 2023-10-10 23:43 What reverse proxy did you use? Do you need to terminate SSL on the VPS or does that happen on the web server? ---------------------------------------------------------------------- Beautiful-Log5632 · 2023-10-10 23:45 How does wireguard help here? Won't it work without that? ---------------------------------------------------------------------- Beautiful-Log5632 · 2023-10-10 23:47 Is streaming just using the regular proxy_ directives in nginx or it's something different? ---------------------------------------------------------------------- i_am_art_65 · 2023-10-10 23:59 I just used nginx as the reverse proxy with a SSL cert on both the reverse proxy and web server. I also enabled caching in nginx to further improve performance. Nginx does a port 80 to 443 redirect just in case. ---------------------------------------------------------------------- bubbayo21 · 2023-10-11 00:04 Keeps traffic in an encrypted tunnel and then you won’t have to open ports at home. ---------------------------------------------------------------------- bubbayo21 · 2023-10-11 00:07 Tailscale is just so easy and choosing exit node on the fly is really nice ---------------------------------------------------------------------- Beautiful-Log5632 · 2023-10-11 00:10 Is it effectively same as opening a port and using firewall to only allow connection from the VPS? ---------------------------------------------------------------------- Beautiful-Log5632 · 2023-10-11 00:13 Instead of having SSL certs on both could you have just put it on the web server and just forwarded traffic from the VPS to it? ---------------------------------------------------------------------- bubbayo21 · 2023-10-11 00:18 That would depend on if you keep traffic from the vps to home as ssl. WireGuard is VERY secure and fast. WireGuard is stronger than ssl ---------------------------------------------------------------------- Acadia1337 · 2023-10-11 00:46 I used to do this. WireGuard or OpenVP works if you need encryption. If not, open a GRE tunnel from your router to the VPS. ---------------------------------------------------------------------- iavael · 2023-10-11 00:49 Yes, you can use DNAT (aka port-mapping) for that. ---------------------------------------------------------------------- Beautiful-Log5632 · 2023-10-11 00:56 The VPS wouldn't even have nginx installed so the VPS wouldn't be able to see the unencrypted http requests to the web server? Since SSL is terminated on the web server not the VPS. ---------------------------------------------------------------------- talent_deprived · 2023-10-11 01:10 \> To hide your own IP address could you rent a cheap VPS and use it to proxy to your servers that are hosting https applications? Your domain would have the VPS IP instead of your own and all traffic would be routed through the VPS to your servers. Yes \> What would I need to set this up on the VPS? [https://www.linuxbabe.com/debian/wireguard-vpn-server- debian](https://www.linuxbabe.com/debian/wireguard-vpn-server-debian) ---------------------------------------------------------------------- talent_deprived · 2023-10-11 01:11 Mine too, works awesomely once I understood how to get Wireguard working. ---------------------------------------------------------------------- talent_deprived · 2023-10-11 01:13 I would do this as well, it's one less component but I host my own email and my ISP and most residential ISP's block port 25. ---------------------------------------------------------------------- skmcgowan77 · 2023-10-11 01:14 Quick note, remember that if you route all your traffic over the VPN, you'll be using your VPS' metered bandwidth. If you've never self- metered your internet usage at home, you might be surprised by your bill from the hosting provider. ---------------------------------------------------------------------- talent_deprived · 2023-10-11 01:19 In the context of how the OP phrased the question, Wireguard (or OpenVPN) redirecting all or desired traffic to a backend IP over a tunnel absolutely hides their home public IP providing they have no ports open on their home IP. ---------------------------------------------------------------------- adog_1314 · 2023-10-11 01:26 This is how I use iptables to basically port forward from VPS to my home server. https://gist.github.com/adog1314/97bf494d74f56bfff51da9bb4bff8ed0 ---------------------------------------------------------------------- PaintDrinkingPete · 2023-10-11 02:13 You can do it without that, but IMO setting up wireguard is just easier… no need to open any ports to your home network (because your home server initiates and maintains the connection to the VPS), no need to deal with ddns or port forwarding, and you can terminate SSL at the vps because all proxied traffic from your server to the VPS is already encrypted (which makes managing certificates easier). This wasn’t as popular an option prior to wireguard because most VPN solutions are slow and increase network overhead, but wireguard is very fast and efficient, has simple configurations, and is quite secure. ---------------------------------------------------------------------- FaTheArmorShell · 2023-10-11 02:35 This is what I've been looking at doing but have yet to get wireguard setup on my server correctly. ---------------------------------------------------------------------- tygerwolf76 · 2023-10-11 03:44 Use Cloudflare tunnel as a reverse proxy. ---------------------------------------------------------------------- thekrautboy · 2023-10-11 03:45 > hides their home public IP Yes. But they asked "To hide your own IP address". And they need to be aware that they cannot hide their VPS IP either. ---------------------------------------------------------------------- sonofchocula · 2023-10-11 03:52 Which is registered to them lol ---------------------------------------------------------------------- another-new-user · 2023-10-11 04:02 Install on ur VPS openvpn, setup portforward with iptables and a couple of scripts. that's all u need. ---------------------------------------------------------------------- thekrautboy · 2023-10-11 04:03 Exactly. ---------------------------------------------------------------------- PaulEngineer-89 · 2023-10-11 04:14 Not exactly. Tailscale only allows 80, 443, and 10,000 publicly. Cloudflare tunnels allows pretty much any port but restricts the protocols to https and http only. ---------------------------------------------------------------------- GrumpyCat79 · 2023-10-11 04:24 > publicly I don't use tailscale, but the VPS would be routing/forwarding to the homeserver privately peer-to-peer so I don't see a port problem here, but I could be wrong I don't understand where I said otherwise anyway? ---------------------------------------------------------------------- Beautiful-Log5632 · 2023-10-11 04:48 The VPN should be installed on the VPS not the web server? ---------------------------------------------------------------------- Beautiful-Log5632 · 2023-10-11 04:50 The VPN should be installed on the VPS not the web server? With this setup can can you still terminate SSL at the web server instead of the VPS and forward encrypted https requests? ---------------------------------------------------------------------- HearthCore · 2023-10-11 05:29 The VPN makes you able to still connect to anything manually, if the need arises in remote locations, is an additional encryption layer, enables dragging and dropping your hardware without setting everything back up and configure another router, change settings on the VPS.. I use a mixture of Tailscale/wireguard and clourdflared All machines are on the VPN individually, some additional local appliances are reachable through exit nodes aswell. I have 2 FQDNs, one is basically for DNS and hostname registrar, plus exposes MX records The other one runs on cloudflare and cloudflare serves all public appliances. I own a VPS but barely use it thanks to reliable cloudflared LXCs on ProxMox Using Tailscale all hardware is basically drag and drop at this point. All my host and LXCs need are valid internal IP addresses. I could basically run them all on DHCP natively, or better yet - add an additional NIC and separate the need for DHcP through a router VM and a singular need for configuration of my virtualiser, proxmox ---------------------------------------------------------------------- pilunpilunnnn · 2023-10-11 05:52 Personally I am only forwarding ports (80,443) from VPS to homelab (via VPN tunnel) and doing reverse proxy locally. I setup local dns to point my domains to the local reverse proxy so when I’m on my LAN I can skip going through the VPS altogether and also have some subdomains that are only available when I’m on VPN or LAN. Only those domains that I want to expose publicly have their records pointed to the VPS IP. ---------------------------------------------------------------------- GamerXP27 · 2023-10-11 07:29 i do run a cheap vps and connected it via vpn to my homelab at home so my domain routes trough the vps that has npm and sends the traffic inside a wireguard to my homelab. ---------------------------------------------------------------------- geek_at · 2023-10-11 07:41 And BTW OP: If you want your services to be less public, don't use individual certificates for each service but rather one wildcard cert and use that for all. I [wrote a guide how to do it with DNS no matter the DNS provider](https://blog.haschek.at/2023/letsencrypt-wildcard- cert.html) Background: All certificates (paid and free) are published in the certificate transparency report and are public for everyone to see. ---------------------------------------------------------------------- Nokushi · 2023-10-11 08:38 i'm doing that for all the services i host on my homelab and need to publish i'm using tailscale as it's the simplest wireguard integration you can use imo, it's as simple as installing it and running it i have a cheap vps on hetzner, their new ARM one, with traefik installed traefik let me forward all the traffic to my homelab through tailscale, and it also can redirect tcp & udp ports, so it can also be used if you host game server like minecraft, etc to this day, i can't see a better way to protect myself than using this kind of setup ---------------------------------------------------------------------- BouncyPancake · 2023-10-11 09:03 >What would I need to set this up on the VPS? I don't want to terminate SSL on the VPS so can I still use nginx or would it have to be something like iptables? You can use Nginx as an L4 reverse proxy. Basically termination isn't being handled by the VPS or reverse proxy since layer 4 of the OSI model just handles transportation of data not SSL termination (L7 activities). And to prevent users, bots, scanners, etc from seeing the web server from your home public IP, you can block all IPs from connecting to the webserver except for your VPS IP; this would essentially make it seem like your network at home doesn't have anything special on it. ---------------------------------------------------------------------- PaintDrinkingPete · 2023-10-11 09:13 wireguard is end-to-end, so it's installed in both places, but optimally, you would do the initial setup on the VPS as the "server", and then web server would be the "client", again, because this way no ports need to be open on your home network. Yes, I'd you wanted/needed to, you can still terminate SSL at your home web server. ---------------------------------------------------------------------- TBT_TBT · 2023-10-11 09:16 Just to be clear: you can’t „hide“ „your“ IP. You can replace your home IP with some external IP for services which are served to the internet. But if you rent a VPS to do that, it’s IP will still be connected to your person and the VPS company will forward whatever legal trouble might come to you directly. ---------------------------------------------------------------------- BouncyPancake · 2023-10-11 09:16 server { listen 443; proxy_pass 12.23.45.67:443; } There you go. Install Nginx on the VPS, open the port you want on the firewall (443 in this case), drop what I wrote into 'nginx.conf' which is located at '/etc/nginx' then finish the basic set up tasks. What that does is: when a user requests a page from your VPS, (example: 76.54.32.21:443) the reverse proxy sends the request to your web server on your network on behalf of the user then it gets the data from the web server and sends it back up to the end user. Mind you, no SSL termination is being done because you're using Nginx as an L4 reverse proxy. Nothing is read or understood except where the data needs to go. ---------------------------------------------------------------------- valdecircarvalho · 2023-10-11 09:33 Why this thing about “I need to hide my Ip” is popping up so much ? ---------------------------------------------------------------------- bigahuna · 2023-10-11 10:09 Cheap VPS, Wireguard in a docker container and nginx as reverse proxy. We use this setup with 15 people on a machine with 2 cores and 2GB RAM and even with all of them connected the it idles and has no load at all. ---------------------------------------------------------------------- GolemancerVekk · 2023-10-11 10:26 The tunnel makes it so your home machine and the VPS look like they are "next" to each other and are directly accessible (regardless of firewall, NAT etc.) ---------------------------------------------------------------------- schklom · 2023-10-11 11:03 > nginx, apache, whatever you like, etc The only way right now to avoid terminating TLS on the VPS is to have HAProxy on the VPS and Traefik/Nginx/HAProxy on the home server, make use of HAProxy's capacity to pass the TCP traffic as-is along with a Proxy Protocol packet. See https://www.reddit.com/r/selfhosted/comments/13t4faz/comment/jlw338o/ for how to use HAProxy on the VPS ---------------------------------------------------------------------- leoklaus · 2023-10-11 11:53 I‘m guessing people are still paranoid because of how IPs work in movies? Or because VPN commercials make it seem like your IP is something worth hiding? ---------------------------------------------------------------------- iavael · 2023-10-11 13:39 Yes, that would be the case if you use DNAT, because portmapping would be done by firewall (iptables or nftables). ---------------------------------------------------------------------- valdecircarvalho · 2023-10-11 13:59 gotcha! VPN commercials ---------------------------------------------------------------------- keivmoc · 2023-10-11 14:16 Also consider that many services actively blacklist the IP ranges associated with VPS providers. This is still a fun exercise though. ---------------------------------------------------------------------- WildestPotato · 2023-10-11 14:22 If you don’t know what you are doing, please take care in setting up access rules, use UFW, learn iptables, learn selinux. ---------------------------------------------------------------------- 836624 · 2023-10-11 14:28 There are still close to unlimited vps providers out there for little money. Don't go ape and you'll be fine. I'm paying 3 or 4 euro PCM (can't remember exactly) and I'm getting 80 tb traffic per month, supposedly. ---------------------------------------------------------------------- Medium_Theat · 2023-10-11 14:43 Hahaha, and It's the most common way to connect the INTERNET when people live in China. ---------------------------------------------------------------------- rcampusa · 2023-10-11 14:43 How do you think about upload/download limits? ---------------------------------------------------------------------- azukaar · 2023-10-11 14:49 Hello! I am the dev of Cosmos ([https://github.com/azukaar/Cosmos- Server/](https://github.com/azukaar/Cosmos-Server/)) And it integrate the Reverse-Proxy + the VPN to do all this very easily: [https://cosmos-cloud.io/doc/61%20Constellation%20VPN/#cgnat-and- various-multi-server-setups](https://cosmos- cloud.io/doc/61%20Constellation%20VPN/#cgnat-and-various-multi-server- setups) ---------------------------------------------------------------------- OTonConsole · 2023-10-11 15:39 Cloudflare: exists. ---------------------------------------------------------------------- OTonConsole · 2023-10-11 15:41 Can someone help me understand why cloudflare is not mentioned in this post. ---------------------------------------------------------------------- OTonConsole · 2023-10-11 15:44 Hmm why not cloudflare ---------------------------------------------------------------------- OTonConsole · 2023-10-11 15:45 How is this better than just using cloudflare. ---------------------------------------------------------------------- Nokushi · 2023-10-11 16:02 i'm using cloudflare in addition to all of that, but it only works with HTTP as i run multiple game servers, i didnt want to expose my home ip to everyone and i dont trust my ISP router firewall capabilities, so with that setup i can have a better control of whats happening with the incoming traffic before it goes to my homelab ---------------------------------------------------------------------- brando2131 · 2023-10-11 16:12 CloudFlare is mentioned in the post by OP. ---------------------------------------------------------------------- brando2131 · 2023-10-11 16:16 >And they need to be aware that they cannot hide their VPS IP either. Why are you raising up issues that OP never even said? ---------------------------------------------------------------------- OTonConsole · 2023-10-11 16:24 I see, But it's nonsense, OP haven't shared any details, something about clousflare blocking a browser? ---------------------------------------------------------------------- OTonConsole · 2023-10-11 16:28 Mm exactly, what I meant was for web, websites, ports 80 and 443. So if it's a website, why would someone need something besides cloudflade, what is cloudflare lacking? Or what other services offer much more, For this use case. ---------------------------------------------------------------------- _____root_____ · 2023-10-11 16:47 So I do this exact same thing but my VPS has a data cap which stops me from using the same method for sharing jellyfin, any suggestions? ---------------------------------------------------------------------- azukaar · 2023-10-11 17:18 It's fully self-hosted, it does not rely on a cloud service (as what OP wanted) ---------------------------------------------------------------------- Silencer306 · 2023-10-11 17:30 Is haproxy similar to nginx? ---------------------------------------------------------------------- MrShared · 2023-10-11 17:43 I once owned a server in Belize exactly for such a purpose. ---------------------------------------------------------------------- Beautiful-Log5632 · 2023-10-11 17:54 Is there an advantage of using nginx on the VPS to proxy insteaad of iptables rules for port mapping? ---------------------------------------------------------------------- Beautiful-Log5632 · 2023-10-11 18:00 > optimally, you would do the initial setup on the VPS as the "server", and then web server would be the "client", again, because this way no ports need to be open on your home network If the web server is the wireguard client and the VPS is the server, can the traffic still be initiated from the VPS to the web server because that's the opposite direction (VPS is proxying the request so it's the client and the web server is the server of that request)? ---------------------------------------------------------------------- Beautiful-Log5632 · 2023-10-11 18:01 How are you forwarding the traffic through the tunnel from the VPS to your homelab? ---------------------------------------------------------------------- Beautiful-Log5632 · 2023-10-11 18:04 > enables dragging and dropping your hardware without setting everything back up and configure another router, change settings on the VPS.. Is that only if you're using tailscale? Because with regular wireguard, changing the IP address of the server still requires configuration changes just like the option to open a port and use firewall to only allow connection from the VPS. ---------------------------------------------------------------------- PaintDrinkingPete · 2023-10-11 18:19 Yes, I actually put "server" and "client" in quotes there because wireguard simply creates an end-to-end encrypted network between 2 (or more) hosts, it technically doesn't have a client/server type of architecture, *however*, when setting it up, usually you have one "server" host that is configured to listen on an open port for incoming connections, and one or more "client" hosts that initiate the connection(s) to the "server" on that open port. You can, however, have BOTH endpoints listening on an open port and then either could initiate a connection. Otherwise, often the clients will include a "PersistentKeepalive" setting in the configuration to ensure that the connection remains open on both sides for communication between the two hosts. The remote IP addresses that are allowed through the tunnel are also defined on each side's configuration, so assuming the local IP address of each of the server and client are allowed to each other through the wireguard tunnel, traffic can flow in either direction between the two hosts. Hopefully that makes sense. (and yes, wireguard uses UPD, so it's not really "listening", but I'm leaving that there for simplicity sake) ---------------------------------------------------------------------- FormerPassenger1558 · 2023-10-11 18:25 tailscale.com ---------------------------------------------------------------------- Nokushi · 2023-10-11 18:50 well in that use case, you don't *need* that kind of setup, cloudflare will totally do the job if you're paranoid about your websites, specifically your web apps, you could still use that setup to increase security on the vps-reverse proxy side, but i'm not sure about the real value there, cloudflare would be plenty enough at our scale only point would be if someone doesn't like cloudflare services, mainly for privacy reasons, then it would be better to go with that setup, but that's more of a personal choice than a technical need ---------------------------------------------------------------------- Beautiful-Log5632 · 2023-10-11 18:54 I thought you can only get wildcard letsencrypt certificates when you have access to an API for your DNS provider because you need to update the TXT records as part of the verification certbot does every 90 days. How does your process get around that? > Forward port 53 (UDP) to the machine requesting the certificate and make sure there is not already a DNS server running, otherwise the wildcard request will obviously fail. What does that part mean? I can run these scripts from my local workstation if I forward port 53 from the web server to the workstation? Where does acme.example.com nameserver come from? Is it something my DNS provider gave me after I registered the domain or it's a machine I control? ---------------------------------------------------------------------- Beautiful-Log5632 · 2023-10-11 19:04 > You can, however, have BOTH endpoints listening on an open port and then either could initiate a connection. Does this mean the VPS and web server would both be wireguard servers and wireguard clients? > Otherwise, often the clients will include a "PersistentKeepalive" setting in the configuration to ensure that the connection remains open on both sides for communication between the two hosts. Can you give an example of when you would need peristentkeepalive? In my case the VPS would be the wireguard server and the web server would be the wireguard client, but if there's no requests being proxied from the VPS to the web server for a while then the connection will close and the next requests will fail? But if I reverse it and make the VPS the wireguard client, then it will always establish the connection again when a request comes in that needs to be proxied? ---------------------------------------------------------------------- maevian · 2023-10-11 19:54 Only one that I know of is Plex, which can easily be replaced by jellyfin ---------------------------------------------------------------------- TripletStorm · 2023-10-11 19:55 You just need to be able to put a file on the server so they can verify you have access. Nginx proxy manager does this for you out of the box. Some people mistake this functionality as a wild card cert. Honestly, it makes little sense to use wild card certs at all if a reverse proxy is involved. The wild card cert made sense because it was cheaper than buying ten individual certs. If all certs are free then what’s the point? ---------------------------------------------------------------------- geek_at · 2023-10-11 20:04 sadly nginxproxymanager does not support dns standalone. Only with specific providers. ---------------------------------------------------------------------- geek_at · 2023-10-11 20:08 > I thought you can only get wildcard letsencrypt certificates when you have access to an API Not with the DNS Standalone method I discribed in the article > What does that part mean? I can run these scripts from my local workstation if I forward port 53 from the web server to the workstation? You can run the script from your workstation if Port 53 UDP is forwarded to it, and the A record for `acme.yourdomain.com` points to it (and the other two records are set as well) > Where does acme.example.com nameserver come from? Is it something my DNS provider gave me after I registered the domain or it's a machine I control? You have to go to your DNS provider and create the record for `acme.yourdomain.com` as described. Then you can request wildcard certs for any domain you have configured the records for ---------------------------------------------------------------------- EconomyWalrus · 2023-10-11 20:35 Simplest option is to use `ssh -R`. More options in my old comment. https://www.reddittorjg6rue252oqsxryoxengawnmo46qy4kyii5wtqnwfj4ooad.o nion/r/selfhosted/comments/111hqwg/comment/j8tilka/?utm_source=share&u tm_medium=web2x&context=3 ---------------------------------------------------------------------- PaintDrinkingPete · 2023-10-11 20:48 > Does this mean the VPS and web server would both be wireguard servers and wireguard clients? In a sense, yes. With wireguard, each VPN peer will have a configuration with 2 sections: "Interface" and "Peer" For the **SERVER**: the "Interface" section will have a defined "ListenPort", which tells it to accept connection requests on that port. The "Peer" section will have the public key of any authorized "clients", as well as which IP address each peer are allowed to access. For the **CLIENT**: The "Interface" section does NOT contain a "ListenPort", as it is not *accepting* incoming connections. The "Peer" section, however, will include the "Endpoint" of the server defined as either a static public IP or DNS name of your server along with the port to connect to. As far as I know, you can setup your wireguard interface on either side with a "ListenPort", and your peer with defined "Endpoint", which would mean that either side could act as server or client...however even if so, ultimately, the system that first initiates the connection is going to be the "client". >Can you give an example of when you would need peristentkeepalive? > In my case the VPS would be the wireguard server and the web server would be the wireguard client, but if there's no requests being proxied from the VPS to the web server for a while then the connection will close and the next requests will fail? This is the exact reason to use "PersistentKeepalive"...to ensure that the server can continue to reach the client even if there hasn't been any recent traffic. > But if I reverse it and make the VPS the wireguard client, then it will always establish the connection again when a request comes in that needs to be proxied? Yes, but most folks don't set it up this way because: - Their home network doesn't have a static public IP address - You would have to open the ListenPort on your home router At this point, I highly recommend looking into the actual documentation, because I am certainly NOT an expert here...just providing info based on how I've used Wireguard in the past. I personally think it's great because once you've set it, you can essentially forget about it, and it's much faster with less overhead than most other VPN solutions (i.e. OpenVPN), and quite secure as well. It's also technically baked into the Linux kernel, so you don't even need to install it, though on most distributions you do need to install the "wireguard-tools" package to be able to manage wireguard connections. ---------------------------------------------------------------------- Beautiful-Log5632 · 2023-10-11 20:53 Can this be automated if you're running the script from a laptop that can change networks all the time? I think that would require manually fixing port forwarding on the router depending where you are when the script runs? If I run the script from the web server itself instead of another workstation would that simplify things so there's no port forwarding needed? Just run a DNS server on the same device as the web server? I think I'm still missing a piece of the puzzle. I thought certbot has to have DNS API access because it updates the TXT record with a secret token https://letsencrypt.org/docs/challenge-types/#dns-01-challenge when it does the check so it can be sure you control the domain. Is that not how it works? ---------------------------------------------------------------------- Beautiful-Log5632 · 2023-10-11 21:02 > This is the exact reason to use "PersistentKeepalive"...to ensure that the server can continue to reach the client even if there hasn't been any recent traffic. > the SERVER does not know how to reach the CLIENT if there's not already an active connection made What determines when a connection is no longer "active"? Is that a timeout specified in default wireguard settings or does it have to do with some network settings you set in the OS on the client or server? I suppose you can guess and experiment what to set persistentkeepalive to, but is there a way you can actually find out based on checking some default timeouts? ---------------------------------------------------------------------- PaintDrinkingPete · 2023-10-11 21:19 I *think* at that point you’re at the mercy of the tcp/ip stack…I’m not sure what the default timeout is on an established connection, but most documentation I find suggests a PersistentKeepalive time of 25s, which seems to work great for the tunnels I’ve setup. ---------------------------------------------------------------------- mushyrain · 2023-10-11 21:41 Or because he doesn't want to be hit off by some loser ---------------------------------------------------------------------- GamerXP27 · 2023-10-11 21:44 when i example click on of my public services it goes to first npm thats connected to my wireguard client on the vps so npm can acsess my local network and then the traffic goes trough the vpn to its final destination. and both npm and wireguard are docker containers ---------------------------------------------------------------------- BouncyPancake · 2023-10-11 22:15 Simpler configuration and setup. HOWEVER if you know how to use and can use iptables, I see no reason not to use iptables ---------------------------------------------------------------------- NeuralNetDev · 2023-10-12 01:03 this is pretty much what i do, i even run a second reverse proxy internally to route between game servers, websites etc ---------------------------------------------------------------------- leoklaus · 2023-10-12 05:53 What do you mean “hit off“? What would “some loser“ do with their IP? ---------------------------------------------------------------------- liocer · 2023-10-12 11:23 Yep Wireguard VPN and Traefik [https://traefik.io/traefik/](https://traefik.io/traefik/) as it will manage all of your SSL stuff. ---------------------------------------------------------------------- ButterscotchFar1629 · 2023-10-12 12:57 One could also use zerotier so a port doesn’t need to be open. ---------------------------------------------------------------------- mushyrain · 2023-10-12 14:55 >What do you mean “hit off“? denial of service ---------------------------------------------------------------------- leoklaus · 2023-10-12 15:11 Why would someone try to ddos OP, who has the ressources to do this? There's plenty of ways to mitigate this that don't rely on cyber- snakeoil, proper rate/connection limiting, honeypots, fail2ban... ---------------------------------------------------------------------- mushyrain · 2023-10-12 17:05 >who has the resources to do this? You don't need a lot of resources >There's plenty of ways to mitigate this that don't rely on cyber- snakeoil, proper rate/connection limiting, honeypots, fail2ban... VPNs are not snake oil, they have legitimate use cases. Rate limiting, honeypots and f2b won't really help that much against L4 attacks, especially not if your isp/hosting provider decides to null route you upon an attack ---------------------------------------------------------------------- waterbed87 · 2023-10-12 17:15 You could do this, yes. My question is though what are you gaining by hiding your IP address? Contrary to VPN advertisements there is nothing especially valuable about hiding it as a home user unless you’re trying to cover your footprints for some reason but that’s a different discussion and not something a VPS solves. ---------------------------------------------------------------------- leoklaus · 2023-10-12 17:39 A VPN doesn’t help against SYN flooding or any other DoS attack either. ---------------------------------------------------------------------- mushyrain · 2023-10-12 18:04 How does it not? You aren't directly getting hit, the VPN is, so even if it happened to go offline, you'd still be fine, and in the case of VPN services, most have mitigation in place. Here, try and hit me off if you'd like: 185.195.233.193 ---------------------------------------------------------------------- leoklaus · 2023-10-12 18:44 >How does it not, feel free to explain. The VPN just forwards any TCP packets to your server. The VPN server doesn't care for or acknowledge any SYNs. As long as packets from outside can reach your server, it is vulnerable to DoS attacks. Your connection is always fine, there's no way to DoS a connection. ---------------------------------------------------------------------- cubesnooper · 2023-10-13 05:26 Yes, VPN companies exaggerate the security benefits of their product, mostly in hanging onto the once important fact that open wifi was incredibly unsafe before widespread HTTPS. But masking your IP is something that’s actually useful. - On its own, your IP can be used for rough geolocation, and contributes to ease of correlating your browsing activity even across multiple sessions. - Once you start hosting services from your home IP, that address becomes even more directly identifiable. A site owner can see your IP, run a port scan, start inspecting services, determine domain names from TLS certificates, maybe even determine your identity, and correlate *that* to your browsing activity. - It’s really easy to switch VPS providers at any time. In contrast, it’s really *hard* to switch ISPs, maybe even impossible if there are no alternatives in your area. Hosting services increases the likelihood of certain kinds of attacks. Even surprisingly innocuous things like running a Minecraft server really up the risk of DDoS. If your VPS gets DDoSed, the worst case scenario is probably that the VPS provider drops you as a customer. If your home IP gets DDoSed, you might have to find a new ISP. ---------------------------------------------------------------------- waterbed87 · 2023-10-13 07:07 You're not wrong but it's an incredibly paranoid position to worry enough about it to go through the hassle and added expense of proxying through a VPS unless you're hosting something you wouldn't want associated to you. Use the Tor Browser when you're browsing shady websites, use best practice network security measures and setup a decent firewall capable of mitigating at least light DDOS attacks in case a lone wolf runs LOIC against you and call it a day, no botnet is going to risk further exposure by coming after you and even if they did your ISP's firewalls will likely detect and mitigate it the same way the VPS's would, I suppose if your ISP has a no hosting clause they may ask what you're doing but many do allow hosting that isn't email. A VPS doesn't necessarily even mitigate a DDOS attack in the OP's requested configuration because it's forwarding the traffic back to you anyways. But the VPS's firewall might block it you say? True! But so would your ISP's in quick order once it was detected and they'd renew your DHCP lease so you get a new IP while they're at it (almost no home addresses are static). The benefits don't even add up to 10 dollars a month in my eyes. ---------------------------------------------------------------------- HearthCore · 2023-10-13 14:05 That’s because you need one central hub for the connection to be initiated between the clients only, and Tailscale either provides that or one can deploy the open source server headscale Other than that I have never had to open any port. If your headscale equaling server runs on a cheap vps I would think you wouldn’t need to open any ports either