Reverse Proxy or Not ? reddit / selfhosted ---------------------------------------------------------------------- sohailkhan46 · 2023-10-12 12:15 I've setup a Homelab recently and I'm quiet new to it so pardon my ignorance. I haven't exposed my Homelab to the internet (apparently) yet, therefore I'm using *Tailscale* for remote access, my question is what's the purpose of using Reverse Proxies (RP) like **Nginx**, **Traefik** etc. as in my understanding it exposes you (securely) to the internet, but still there are risks... Everybody on YT and Reddit seems to use RP and I don't understand why, So is there a good reason to use it or should I just rely on Tailscale. Are there other benefits of using a RP I would like to get enlightened about Reverse Proxies... Thanks in Advance. ---------------------------------------------------------------------- Dalem246 · 2023-10-12 12:31 I guess a good question would, do you plan on having any services where you want others that don’t have excess to your VPN to use? Or is this all just used by you and nobody else? ---------------------------------------------------------------------- Pesfreak92 · 2023-10-12 12:36 A reverse proxy do not expose services to the internet by default. You still have to set it up that services are reachable from the outside. The benefit and why most people use a reverse proxy is that they don’t have to remember multiple IP and Ports. For example: If I have a service like Portainer. I can enter this service with the IP let’s say 192.168.10.20 and the port for Portainer which is 9443. So I have to enter 192.168.10.20:9443 to enter Portainer. This is difficult to remember. With a reverse proxy you set up a domain example.com and maybe subdomain for your service. If we stick to the example with Portainer you can call the url portainer.example.com. It’s a lot easier to remember because if you want to access Portainer you just type portainer instead of a number you associate with portainer. The Reverse proxy is the link between the url and the IP. ---------------------------------------------------------------------- mendosux · 2023-10-12 12:38 Using a reverse proxy is beneficial for multiple Szenarios. Primarily, from a security point of view, a reverse proxy sits behind a firewall in front of your webserver(s). A reverse proxy intercepts traffic and decouples your server from frontend access. You can deploy a dedicated proxy server on Linux (nginx, haproxy etc) but you can also use your firewall (pfsense, opnsense etc) to act as a proxy. This provides you with additional security as you can use ips/ids mechanisms to look inside the encrypted traffic, automate certificate creation (acme) etc. Secondary, from a management perspective a reverse proxy helps you organizing your web exposed services. As a rule of thumb: expose as little services as necessary to the www and use a vpn whenever you can. Hope this helps. ---------------------------------------------------------------------- certTaker · 2023-10-12 12:47 The biggest feature of RPs is hosting multiple (web) services on the same port. A port can be bound by max one running process. You can run multiple web services on a single host (=single IP address) but then you'd have to use a different port for each service. Typically those ports would be 8080, 3000, etc. Even with static host entries or DNS for each of your services, you'd still need to use the port number in URLs, e.g. [grafana.mydomain.com:3000](https://grafana.mydomain.com:3000). A RP runs a client-facing web server and uses TLS SNI to know what "backend" service is being accessed. The URLs then don't need to use the port number and are just [grafana.mydomain.com](https://grafana.mydomain.com). There are some security advantages in using RPs (they tend to be well- tested mature services, as opposed to whatever each individual service may be using for its web interface) but they are irrelevant for small internal environments not exposed to the public Internet. ---------------------------------------------------------------------- ThatsNASt · 2023-10-12 12:58 I would just use cloudflare tunnels. ---------------------------------------------------------------------- pielman · 2023-10-12 13:27 I tested Traefik (which is good) but I settled for NGINX. However I deployed another location a second docker environment and I exclusively went with Cloudflare tunnel because it’s so mind boggling easy. ---------------------------------------------------------------------- RedditNotFreeSpeech · 2023-10-12 13:29 I use haproxy for things like super fine shaping of what requests go where. For instance if you hit my domain you go to my web server, if you hit my domain with a specific URL you go to home assistant callback URL on a different lxc. ---------------------------------------------------------------------- Accomplished-Lack721 · 2023-10-12 13:32 If you are only accessing these services from your own devices, using Tailscale or any other VPN, then there isn't much security need for a reverse proxy. If you're looking to expose the services to the Internet, to access them from other devices without a VPN client installed, a reverse proxy can be an important part of your setup. It lets you route traffic for a given domain or subdomain, being requested from one of those external devices, to anywhere on your LAN -- either with only opening ports for the reverse proxy itself or without any ports via something like a Cloudflare tunnel. That has the benefit both of letting you expose multiple services on your network without a bunch of open and forwarded ports at the router, and of making it harder for port scanners to notice services you're running when scanning your IP (all they'll find is the ports for the RP itself). It can usually handle requesting/renewing and applying SSL certificates for you more easily than managing them independently with each service you may want to run. ---------------------------------------------------------------------- sohailkhan46 · 2023-10-12 13:34 I'm the only one using my server atm! but I will be giving the access to my friends and family in the future once I upgrade my Server and also improve my understanding of it. ---------------------------------------------------------------------- sohailkhan46 · 2023-10-12 13:37 I see, I'm currently using shortcuts to organise my services but this sounds so much more convenient, I'm definitely looking into it. ---------------------------------------------------------------------- sohailkhan46 · 2023-10-12 13:39 this solved a lot of my confusions regarding reverse proxies, thanks for helping me out :) ---------------------------------------------------------------------- PaulEngineer-89 · 2023-10-12 14:01 Here is the problem…it’s easier!! Think about your first application. It’s easy…set it up and it works. Your second is just as easy on well known ports so that gives you say https and say DNS. So far so good. But say you have two https applications. Now there is a problem. With a reverse proxy you can use the “domain/application” syntax or alternatively create a CNAME on the DNS (if you can access a domain name) which is application.domain which effectively works the same way. Or manually type domain:port which bypasses the reverse proxy. You can of course buy more IPs and if we are all on IPv6 that’s the ideal situation. But we’re not and dedicated IPv4s are expensive. So reverse proxy means one IP or one tunnel for everythjng. ---------------------------------------------------------------------- Dalem246 · 2023-10-12 14:15 Yeah of course if you wanted to give others access you would need a reverse proxy then. Just as u/mendosux said, he gave good advice. ---------------------------------------------------------------------- philotic_node · 2023-10-12 14:18 If you want to start easy, I'd recommend using Caddy. It's super simple to set up for the simple use cases. It even handles certificate management, if you happen for have a domain. ---------------------------------------------------------------------- sarkyscouser · 2023-10-12 14:26 If you're just starting out then I'd recommend Caddy as the easiest reverse proxy to set up. Nginx is very powerful, but quite complex and overkill for home usage. ---------------------------------------------------------------------- billiarddaddy · 2023-10-12 14:38 Always. ---------------------------------------------------------------------- blckshdw · 2023-10-12 14:59 Think of it like having groceries delivered. You could go to the store knowing the specific aisle (port #) an item is in and select the item yourself. Alternatively you could have the groceries ready for pickup. You just tell them you want a banana. You don’t have to know which aisle bananas are in. Someone else knows where they are and they’ll go get it for you. If your the shop owner this gives you a few advantages. You could move the bananas to somewhere else in the store and not have to inform every customer that they’re in a new location. If you have a lot of customers coming in you could source bananas from multiple locations.. maybe even a different store - customers don’t care they just want their banana, however you got it isn’t important to them. ---------------------------------------------------------------------- Simon-RedditAccount · 2023-10-12 15:11 Benefits: * running multiple "websites" (=services) on the same port and the same IP * TLS termination. Let a dedicated software manage it instead of whatever TLS library built in the image. +Efficiency. +Timely security patches. * authentication. From dead simple HTTP Basic to mTLS and/or SSO * complete control of your HTTP requests. Need URL rewriting or adding an extra HTTP header/cookie? Just add a couple of lines in the config Tailscale/VPN is great, but it solves only one issue (allow outside access only to you, and not strangers), while leaving all other issues unsolved. Hey, do you like seeing "insecure site" warnings for your http://192.168.1.100:8080 ? Personally, I prefer working with [http**s**://cloud.home.arpa](https://cloud.home.arpa) or [http**s**://cloud.example.com](https://cloud.example.com) ---------------------------------------------------------------------- m1ndfuck · 2023-10-12 15:29 Its simple: Do you need to provide access to "unknown" people? Proxy! Do only you (and maybe people living in the house) need access? VPN! ---------------------------------------------------------------------- MaxKulik1 · 2023-10-12 15:31 A lot of people here talking about the benefits already so I’m not going to repeat the same thing. However if you are looking for a great way to run an RP - look into [Nginx Proxy Manager](https://nginxproxymanager.com/). You get all the benefits of the super powerful Nginx web server and an incredibly simple web interface to manage all your proxy applications. I have done this a million ways and for home lab use this in my opinion is just the best. Super easy to install also! ---------------------------------------------------------------------- SamSausages · 2023-10-12 15:42 Tailscale acts as a reverse proxy. Don't use something like nginx to open it to the www. But I do use nginx internally so I can get domains and ssl. Only access your network from the www with some type of robust vpn, preferably managed at your firewall (pfsense) for full control. ---------------------------------------------------------------------- Defiant-Ad-5513 · 2023-10-12 15:54 You could do a local RP with a valid domain to a private IP so only you + Tailscale clients can access it and still have a valid cert with dns challenge and if you want to make it public after that it is just changing the IP in the dns record to the public one and using a 2FA provider like Authelia to protect yourself from unwanted access. ---------------------------------------------------------------------- certuna · 2023-10-12 15:55 The big advantage of a reverse proxy is that it’s one centralized point of entry, you only need to set up TLS certs in one place, open one port, etc. ---------------------------------------------------------------------- BuzzKiIIingtonne · 2023-10-12 16:14 I do expose some things, but really the biggest thing is I can access all my services using http redirected to HTTPS internally so that I don't have to type port numbers, and the DNS names can be either subdomains or sub directories of the main site. I can then make my main site whatever I want and can potentially put links that go to other pages. Eg. Example.example.com Eg. Example.com/example I can also have my certificate from letsencrypt automatically apply to my reverse proxy and with a wildcard cert it can apply to all my sites, allowing me to use HTTPS without having my browser complain about it being untrusted. Being able to expose only one server and only http and HTTPS on that one server to the internet is also an advantage, but it's honestly not the primary advantage, not is it the only one. ---------------------------------------------------------------------- Yanni_X · 2023-10-12 16:30 Everything already said except a tiny thing: https is much easier to setup for a single endpoint on 443. You don’t have to configure https for every service separately and still benefit from the encryption (from client to proxy, not between proxy and the service, but that’s LAN anyways) ---------------------------------------------------------------------- Jonty16117 · 2023-10-12 16:46 I am using the same...its easy to setup and free ---------------------------------------------------------------------- dnt_pnc · 2023-10-12 17:00 >Don't use something like nginx to open it to the www. But I do use nginx internally so I can get domains and ssl. How does that work? Maybe I am researching the wrong way but all I can find always includes an external domain. I really want SSL internally and domains for my services instead of IPs without an external domain. Can you recommend a guide, video or similar ? ---------------------------------------------------------------------- thcduck · 2023-10-12 17:01 I want to add that it could be fun to setup a reverse proxy for the learning experience, but if you don't mind the :port numbers on the URL and just want it to work then Tailscale is just fine. Also, [Ngrok](https://ngrok.com/) is really easy to setup too, just don't really know the difference between it and Tailscale to be honest. ---------------------------------------------------------------------- weirdinibba · 2023-10-12 17:13 A good reason to use a RP would be like this example: I have multiple domains which run multiple things. So I set up all domains with A records pointing to my server, even with subdomains. So like I want home.myserver.com to go to myserver:8080, myserver.com to go to myserver:443 and so on, I can implement this using a RP, which will listen on port 80, and passes traffic based on certain set of rules. Additionally, I have my homelab connected to my remote server over VPN (since I was behind a CGNAT), so I set up a reverse proxy for my remote server to pass traffic like TCP streams (for ssh, vnc) and other HTTP traffic over some other ports. So I could just ssh with hostname as my remote server, with port say 222, I would connect to my homeserver directly. ---------------------------------------------------------------------- SamSausages · 2023-10-12 17:36 Couple of layers to this and different approaches, so tough to just give a guide that works. A lot of it has to do with your network setup and DNS, the way domain names are associated with IP addresses. This guy has some good videos, but he mainly focuses on pfsense. Still, the concept of DNS and proxies is the same. Only the apps you'll use will differ. He's using HAPROXY on the firewall, but instead of haproxy you could use nginx on a different device. The concept of proxying the connections is the same. [youtube.com/watch?v=gVOEdt-BHDY](https://youtube.com/watch?v=gVOEdt- BHDY) ​ If you have a good firewall like pfsense, or something that handles your local DNS queries like pihole, then you can use that to resolve your IP's to domain names. But it does work best if you have your own domain, I suggest you get one. You can find some cheap, especially if you don't get a .com and do something like a .me. Heard you can even find some for free, but haven't tried. Cloudflare is a good place to hold your DNS settings. My general setup, IMO, the way to go but complicated and needs more hardware. Essentially: pfsense firewall handles all my DNS and is the entry point for a Tailscale VPN tunnel. From there I control access of that tailscale tunnel into my network. Then inside of my network I run a Docker Container called "nginx proxy manager" This is used to proxy the ssl connection to nextcloud and other docker services, using the docker network on the server running docker. Another good option if you don't have a robust firewall: tailscale or cloudflared docker container and create a connection directly to the docker container, or have it go to nginx first. latter works very well and is easier to setup. But you lose some control and security as access to your network is best handled by your firewall. But here we are essentially bypassing the firewall with a tunnel, like it isn't even there. Easier, but less control. If you decide a bit more on the hardware and programs you are running, can probably give more specific guide to that, as I have tried quite a few methods before deciding on the one I'm using. ---------------------------------------------------------------------- thisiszeev · 2023-10-12 17:56 I will give you my use case... I ave some services running on ports outside of port 80 and 443 as they either have their own webserver built into them, such as Gitea and Calibre Web. In order to make my life easier, I use RP in my Apache webserver for this services. This also make my life easier with using Let's Encrypt, as I can use SSL on port 443 and then standard http from the Apache webserver to the localhost on port whatever. ---------------------------------------------------------------------- ericesev · 2023-10-12 18:09 Why to run a reverse proxy: * Similar to a VPN, it can be configured to authenticate the user with 2FA before allowing access to any service. * Unlike a VPN it doesn't require any software to be installed on clients. * Traefik (and Caddy) is written in a memory safe language. So some classes of exploits just aren't possible. * Access can be limited on a per-person/per-URL basis. * Nobody is in the middle of the https connection. It has end-to-end privacy. * It interoperates well with services like the Google Assistant smart home actions, which require Google to be able to connect to your host name via HTTPS. The downside of this is reverse proxies can take a while to configure and maintain. By comparison a VPN is easy to setup and provides an authenticated and private connection by default. ---------------------------------------------------------------------- RedFive1976 · 2023-10-12 18:25 The other element that I haven't seen mentioned directly in the comments is that, without the reverse proxy, if you want to expose some of your services to the internet (i.e. you want to be able to access them from outside as well as inside), you'd have to open and forward ports in your firewall for every one of those services. The reverse proxy removes that complexity by needing only ports 80 and 443 open and forwarded to the proxy host. ---------------------------------------------------------------------- CactusBoyScout · 2023-10-12 18:28 The biggest thing for me personally, and this could be niche, is that some of my devices don't support running VPNs. So for example I run a Calibre ebook server that I'd like to be able to access from my Kindle even when I'm not at home. Kindles do not support installing VPNs. So a reverse proxy was my only real option. Apple TV until recently didn't support VPNs either. So if I wanted to access JellyFin from my mom's house (she has an ATV) then I had to use an RP. ---------------------------------------------------------------------- irate_ornithologist · 2023-10-12 18:30 You can also use a homepage like Heimdall or Homepage or Homer to do this if you don’t mind the extra step of clicking on the service you want ---------------------------------------------------------------------- VaderJim · 2023-10-12 18:31 I do this using caddy (RP) and a GoDaddy script that updates my. DNS records, caddy sorts the SSL certs out automatically send everything is really quick to setup, new service on docker takes 5 mins to setup and have "securely" exposed. Still need to practice good security measures, keep software updates, use long tokens / MFA on services where available. ---------------------------------------------------------------------- jmeador42 · 2023-10-12 18:39 It depends on your use case and threat model. RP's and overlay networks are meant for two completely different use cases. Ultimately, you have to decide how many people should have access to something. If you're hosting multiple websites or services that are meant to be accessed publicly by many people from many places, a reverse proxy is what you want. You're taking on more risk with a RP because anyone on the internet can scan and poke at your proxy and all it takes is one misconfiguration or a fuck-all exploit then you're toast. Most places that have a legitimate need for RP's have a much more complex backend infrastructure such as routers, firewalls, IPS's, DMZ's, etc. to accommodate for that risk. On the other hand, if you are the only person that has any business accessing you "stuff", use an overlay network and just take all the risk of exposing anything to the internet out of the equation period. ---------------------------------------------------------------------- highedutechsup · 2023-10-12 18:43 There are a couple of benefits. I use it on my local network so I don't have to remember and type in stupid port numbers. Webapp1, Webapp2 running on the same machine, so I run a proxy for those so they are now known as webapp1.lan and webap2.lan. Super easy for me to remember. Also if I take down the webapp1 server and name it something else or change its port, like for a new version, all I need to do is change the proxy server so I don't have to remember the new information. I also use on my external network for hosting my own sites since I have static IP on gig fiber and I don't want to pay some hosting company. Typically you punch 80 and 443 through to your proxy on a seperate vlan from the rest of the network. The proxy decides which machine is serving the content inside your vlan network. That way if someone hacks the webserver they are locked into the vlan. The other is for monitoring traffic and removing exploits. If it is local in your lan then this is not such a big deal. But if you are on the internet, using cloudflare for your rp or a selfhosted one that can sniff out common exploits is very useful, because a lot of these apps are programmed pretty poorly and not audited for security. ---------------------------------------------------------------------- jmeador42 · 2023-10-12 18:44 It's worth noting that all the overlay networks can do DNS resolution too. So you can still access everything via [nextcloud.domain.com](https://nextcloud.domain.com) or [plex.domain.com](https://plex.domain.com) it just stays local within your Tailscale or Nebula network. ---------------------------------------------------------------------- Tuckerism · 2023-10-12 18:53 Adding two cents on my own setup because I didn't see anyone call this out specifically-- I use a reverse proxy AND Tailscale together. In the DNS records for my domain, I setup a wildcard A record for a subdomain (*.lab.mydomain.com), which points to the Tailscale IP of my server which is running the reverse proxy (I'm just using the built-in one on my Synology). In the reverse proxy, I configure all of the redirection and force HTTPS so browsers stop complaining about security issues when I'm using my self-hosted services. Since the Tailscale IPs aren't accessible to anyone not connected to my Tailscale network, I'm not exposing any services to the internet unnecessarily AND I get proper URLs for my internal services (once I setup the wildcart certs with Lets Encrypt). ---------------------------------------------------------------------- nightmareFluffy · 2023-10-12 18:55 Nginx Proxy Manager is a good little front end to Nginx. Pretty limited, but it's pretty much plug and play. I moved to that after using Caddy, just because it's simpler and gets the job done. I was just having too many issues with Caddy on two separate networks (home and office). Needed to go on forums to troubleshoot it. It was a huge headache. When Caddy was working, it got the job done. When it wasn't working, I used Nginx Proxy Manager and it got the job done. ---------------------------------------------------------------------- sarkyscouser · 2023-10-12 19:03 I used to use nginx, too many breaking changes so moved to caddy via npm. Caddy just seems to work for me hosting plex, immich and jellyfin ---------------------------------------------------------------------- mrpops2ko · 2023-10-12 19:20 i think its largely because of how docker started - in the beginning things like ipvlan and macvlan weren't a thing, so people had to use reverse proxies to get things out after that people just got used to them... i'm personally a fan of just using ipvlan and tunnelling it over a vpn for access but reverse proxies can sometimes be more secure depending on how much access you are letting out. I still need to set a reverse proxy up, its been something i've been meaning to do for quite some time ---------------------------------------------------------------------- PhilipLGriffiths88 · 2023-10-12 19:36 And if you want to self-host an open source option, there are a bunch on [https://github.com/anderspitman/awesome- tunneling](https://github.com/anderspitman/awesome-tunneling). Personally, I work on [zrok.io](https://zrok.io), which is both open source and has a free SaaS. It also has a cool 'private sharing' feature (which means both sides can be private with no inbound ports) ---------------------------------------------------------------------- Do_TheEvolution · 2023-10-12 19:59 No reverse proxy * you go to `blabla.org` it takes you through ports 80/443 to a web server, running on your machine With reverse proxy * you go to `blabla.org` it takes you through ports 80/443 to your reverse proxy that decides to which of many web servers running on your machine the traffic should go, so that `map.blabla.org` goes to to map of your minecraft server, and `mov.blabla.org` goes to your jellyfin server showing shows and movies,.. and some such... I tested several reverse proxy setups, the one I liked the best was Caddy for its simplicity while being very feature rich. [Here](https://github.com/DoTheEvo/selfhosted-apps- docker/tree/master/caddy_v2) is a guide to its setup. Plain nginx is kinda old timer, too much boilerplate and too much work compared to caddy. Traefik is extremely complicated with several abstraction layers, very powerful but more for very dynamic setups. I was not a fan of how it polutes compose-files with labels making them uglier. NPM is very popular and a good choice for beginners since it offers web-gui for managemnt. But it hides stuff from users, is pain to backup compared to backing up single readable clean config file. ---------------------------------------------------------------------- EconomyWalrus · 2023-10-12 20:05 If your selfhosted app has any javascript trackers/analytics enabled by default (or due to malicious patch). You can disable by setting CSP header in reverse proxy. E.g. I have below in my Caddy config: header { Content-Security-Policy "default-src 'self' 'unsafe-inline' data: ;" Referrer-Policy same-origin } ---------------------------------------------------------------------- djbon2112 · 2023-10-12 20:16 Reverse proxies have several main benefits. 1. They allow you to use virtual hosts (different hostnames) for the same IP/port combination. So you could point "servicea.domain.tld" and "serviceb.domain.tld" at the same reverse proxy, but have the proxy direct them to their respective backends. This can help avoid needing to use annoying port numbers, doubly-so if you have to change some due to conflicts. 2. They can simplify SSL termination. Different services handle SSL in different ways, some annoyingly so. A reverse proxy can let you use a single SSL certificate in a single place for a variety of different services, and on replacing it (e.g. with Let's Encrypt automatically) reload only a single service for minimal interruption. 3. They can effectively hide the technology and shortcomings of the backend from clients. For instance, Node.JS applications often listen on 3000; if an attacker sees a service listening on 3000, they're able to conclude it's Node.JS and attack it with that knowledge. But if it's just some other thing behind NGiNX listening on 443, it's harder to find that information. This goes for various other crubs of data in the HTTP headers, like SSL versions, HTTP versions, etc. It's like putting a nice strong metal gate in front of your flimsy front door. 4. The more common reverse proxy apps are designed for - and thus really good at - serving HTTP traffic. Thus, they tend to be much better at it, in the sense of security vulnerabilities, bugfixing, performance, etc. than tons of individual apps, often with solo developers, are. For instance a vulnerability in how software handles HTTP/2 requests might leave your directly-exposed app vulnerable for a while as the developer struggles to fix all the dependencies and push out a new version, but NGiNX likely has a fix before it's even released or extremely soon after. So you basically get the added security from the popularity and ubiquity of the tool. They can also speed things up by caching static assets for the backend, saving on work especially if the backend app is inefficient. 5. They can let you load-balance among multiple backend instances. For small selfhosters and homelabbers this isn't usually a big concern, but for redundancy or scalability it can be helpful to run multiple backend instances of a (relatively slow) app behind a single (relatively fast) reverse proxy, letting it direct clients to the least-busy backend, caching assets as mentioned above, etc. Because, as with 4, this is what they're designed primarily for, they tend to be a lot better at it. For instance a single HAProxy instance can handle upwards of 10Gbps of web traffic on a relatively old quad-core CPU and barely break a sweat. ---------------------------------------------------------------------- Big_Hovercraft_7494 · 2023-10-12 20:25 If you are going to stay not exposed, for me, the advantage of using RPs is not having to add port numbers or ip addresses to get to my services. E.g. mystuff.example.com vs mystuff.example.com:3037 ---------------------------------------------------------------------- Celesae · 2023-10-12 21:08 Naw, look into better technology: SASE. Check out Twingate, don't expose your services to the Internet at all. ---------------------------------------------------------------------- [deleted] · 2023-10-12 21:16 [deleted] ---------------------------------------------------------------------- xstar97 · 2023-10-12 21:17 I use a reverse proxy locally. I resolve my services with a dns server so i can access them via a domain that isn't exposed to the internet aka split dns. For remote access, i use my own personal vpn server to access my domains, originally wg-easy but switched to Firezone. I don't forward my reverse proxy port and only the few services that i need forwarded, like plex and my vpn are open. I can access my domains with my vpn client since i can set the dns server in the config. I closed all my services up so they can't be accessed via ip and port. The reason for that is because i have additional protections like forwardAuth middleware, that offer auth on top of the services via Authelia and lldap as its backend and ipwhitelist middlware that keeps my services accessible local only _if_ i ever forwarded the port accidently or something. I prefer proper ssl and certs; a domain is overall easier 😅 imo. Checkout my [links](https://links.xstar97thenoob.com/) and [docs](https://docs.xstar97thenoob.com/), i originally self hosted these sites but moved them to cf pages instead. ---------------------------------------------------------------------- kevdogger · 2023-10-12 21:29 Honestly a remote vpn solution...wireguard..openvpn, tailscale isn't remotely similar to reverse proxies..traefik, caddy, nginx, haproxy, and if you need to something complex you really need control of your dns records so you'll need some local dns server..for example pfsense, op sense or other solutions. I don't have anything open to the world at large except wireguard but a run a lot of rvs locally and use https with ssl certificates for all my local running servers..many running on different vms. ---------------------------------------------------------------------- nightmareFluffy · 2023-10-12 21:48 Yeah, it was the opposite for me. I guess everyone will have different experiences for their particular environment and applications. ---------------------------------------------------------------------- 5N4K3ii · 2023-10-12 22:14 I would also add that a reverse proxy exposed to the internet is also more practical if you want to share your services with a large group of friends or family because it does not require installing/configuring Tailscale on all the client devices. ---------------------------------------------------------------------- Poooturd · 2023-10-12 22:26 What about cloudflare tunnels? ---------------------------------------------------------------------- PhilipLGriffiths88 · 2023-10-12 22:35 client-basedDepends. Twingate is great if you want client based connections with zero trust. I would argue there are better solutions that do that, particularly those which can be self-hosted and FOSS. Still, more importantly, there could be use cases where you do not want client-based communication - i.e., you want a clientless, public SaaS-type experience. ---------------------------------------------------------------------- mdcbldr · 2023-10-12 22:44 You guys are making me feel bad. I did not find Cloudfare tunnels easy. If you are familiar with the cloudflare milieu it may be easy. It still gives me some fits and starts. In general my home server is not exposed. I will expose for a specific purpose for a limited time then I shut it down. Yeah. I am chicken. You can use pihole as a quick and dirty home lab proxy for dns resolution. You put the lookups in a file in the config area of pihole. I don't remember the exact details. Pihole incorporates the DNSs lookups in the file and will "route" traffic appropriately. Not recommended. But it works ---------------------------------------------------------------------- PumaXCS · 2023-10-12 23:19 So then wouldn't this break other port functionalities for local use since the RP forces the service port if called by host name? How would you still be able to access ssh or sftp using a proxy? ---------------------------------------------------------------------- ZealousidealDot6932 · 2023-10-12 23:24 Since OP has Tailscale already running: https://tailscale.com/kb/1223/tailscale-funnel/ ---------------------------------------------------------------------- Gabe_Isko · 2023-10-13 00:18 It's for if you want to reach hosted services over the public internet, without a vpn. If you are fine with tailscale, you should stick with that. I have some services that I need to be able to access from random computers, so I use a reverse proxy to expose them. ---------------------------------------------------------------------- Gabe_Isko · 2023-10-13 00:28 For remote use, you have to explicitly set up reverse proxy rules per port. This is a good thing - you generally don't want ports exposed to the internet. I usually recommend that you only expose HTTP/S with crowsec controls, and then a VPN port if you have to. For local use, you don't use your public DNS to connect anyway. You should be using a locally hosted DNS server, or just modifying your `hosts` file. ---------------------------------------------------------------------- PrasadReddy_Utah · 2023-10-13 01:19 This is the best solution I came across. While this is similar to Caddy, it’s more like GUI option rather than CLI. ---------------------------------------------------------------------- ZaxLofful · 2023-10-13 01:45 Yes ---------------------------------------------------------------------- reercalium2 · 2023-10-13 06:16 An RP is an extra layer in front of your service. Multiplexing is one, security is another. You can ensure no requests go to your service without being logged in. ---------------------------------------------------------------------- reercalium2 · 2023-10-13 06:17 Enshittification is good. ---------------------------------------------------------------------- reercalium2 · 2023-10-13 06:17 cloudflare ---------------------------------------------------------------------- reercalium2 · 2023-10-13 06:17 What if I want convenient access on the go ---------------------------------------------------------------------- ithakaa · 2023-10-13 08:38 f you're not planning on exposing your services to the internet, and I wouldn't unless you have a very compelling reason, you don't need a reverse proxy Stick with tailscale ---------------------------------------------------------------------- homelabfanatix · 2023-10-13 14:18 Tried traefik and caddy...ended up with nginx pm. Only issue I'm facing is ip access due to being behind cloudflare. Can't seem to figure out how to get the real ip to show instead of cloudflare. Other than that, one of the easiest ones to setup and use. ---------------------------------------------------------------------- MaxKulik1 · 2023-10-13 14:29 I don’t think I understand what you’re getting at. You’re using CloudFlare for DNS but you want to be able to still aced your services via your IP address? Typically that’s one of the benefits of using CL is that it can obfuscate your IP address. If you want to only use CF for DNS and not their proxy, just turn the switch on the orange cloud to off on the DNS page next to any of the records you created. ---------------------------------------------------------------------- homelabfanatix · 2023-10-13 14:34 Sorry...I need npm to get the real ip from cloudflare instead of cloudflare ip. This way npm knows which ips to allow in. I know that I can manage ip access thru cf, but wanted to control that more by whitelisting ips to specific sub domains. I've seen some guides about this some time ago, but can't find them again. ---------------------------------------------------------------------- MaxKulik1 · 2023-10-13 14:46 Ahh, I see. Sorry, I misunderstood what you were saying! To be honest I am not entirely sure how you would handle that. I think a [CF tunnel](https://developers.cloudflare.com/cloudflare- one/connections/connect-networks/) would be better suited for that. Close the network off entirely and then just tunnel all the traffic in that way. Way easer than trying to create a massive whitelist/blacklist. Might also be better application for what you are trying to accomplish. ---------------------------------------------------------------------- SpongederpSquarefap · 2023-10-15 12:16 Don't expose your services to the internet unless you absolutely have to And when you do, your public facing stuff should be in a DMZ network Use a reverse proxy anyway because internal SSL is really nice (no more cert warnings and actually secure connections) My model is Remote user --> WireGuard VPN server running on home server in DMZ VLAN --> Pin hole firewall rules to services and 80 and 443 to reverse proxy --> Reverse proxy forwards securely to service ---------------------------------------------------------------------- SpongederpSquarefap · 2023-10-15 12:17 Just remember that Cloudflare have plain text access to your traffic ---------------------------------------------------------------------- Reply_Stunning · 2023-11-25 12:14 I'm not sure why subdomain is preferred to subpaths here, you can easily pull that off with go httputil.NewSingleHostReverseProxy ---------------------------------------------------------------------- Reply_Stunning · 2023-11-25 12:16 why not sort out the ssl with go, instead of some go daddy script ---------------------------------------------------------------------- Reply_Stunning · 2023-11-25 12:20 unless you're getting hundreds of thousands of simultaneous connections you can safely rely on Go to do even the TLS termination, and everything else. Write a middleware for auth, one for tls termination, whatever ---------------------------------------------------------------------- VaderJim · 2023-11-25 17:51 The GoDaddy script was just to update my DNS record with my IP when my isp changed it, since moved to cloudflare for name server hosting but same concept. Caddy can be used for reverse proxy and sorts out the tls for each domain you configure it for automatically ---------------------------------------------------------------------- Reply_Stunning · 2023-11-26 12:02 ah yes, makes sense. I do the same thing, got dynamic DNS setup with Google Domains, a quick shell script over crontab -e running every hour keeps the show going, my ISP changes it so frequently so we have to keep up with them :/