Is socat on a VPS a good idea to hide my home IP? reddit / selfhosted ---------------------------------------------------------------------- Affectionate-Yak2 · 2023-10-14 03:51 Hi all, I'm considering using socat to expose ports 80 and 443 on the internet, on a VPS, with a VPN to my homelab, relaying TCP connections to the homelab. My goal is that data doesn't get decrypted on the VPS but on the homelab server. My idea is that the VPS would act like a pipe, nothing else. Am I wrong doing that? Is there any security issue you can spot? PS : I do not want to use cloudflared. ---------------------------------------------------------------------- geo38 · 2023-10-14 04:52 ssh tunnels are designed for this! Plus, an ssh tunnel means you won't have to open these ports in your homelab's public router. autossh -M 0 -o 'ExitOnForwardFailure yes' \ -o 'ServerAliveInterval 20' \ -o 'ServerAliveCountMax 4' \ -o 'GatewayPorts yes' \ -R 0.0.0.0:443:localhost:443 -N -f USER@PUBLICHOST.COM This sets up a tunnel listening on 0.0.0.0:443 (all IP interfaces) on PUBLICHOST.COM and forwards them to localhost:443 -- the machine in your homelab creating this tunnel doesn't have to be the one ultimately handling the traffic. Instead of localhost:443', use 'local.ip.address.or.name:443' to pass the traffic to/from some other host in your homelab Since the SSH connection originates from your homelab, there is no need for any sort of port forwarding in your home network. Repeat for port 80 - using an ssh tunnel for port 80 means the unencrypted HTTP traffic will get encrypted by SSH between the VPS and your homelab which wouldn't happen with socat. ---------------------------------------------------------------------- huntAndPeckEnjoyer · 2023-10-14 06:11 Can you explain what the benefits are of not exposing your home IP? If I understand correctly, the same services and ports are exposed to the internet, just the user-facing IP changes. But besides of getting information in what region the service is hosted and what ISP is used, nothing else changes with a different IP, or am I mistaken? ---------------------------------------------------------------------- lionep · 2023-10-14 06:14 I don’t know specifically about autossh, but you can have multiple -R options for both ports on ssh command ---------------------------------------------------------------------- geo38 · 2023-10-14 06:26 Thanks I didn’t know that. Autossh is just a wrapper around ssh to relaunch it if it dies (the internet connection goes down and comes back later), so multiple -R would work fine. ---------------------------------------------------------------------- geo38 · 2023-10-14 06:33 Many internet providers have no way to publicly expose ports forward users. E.g. most cellular internet providers, Starlink, fixed wireless and many other providers are behind some form of NAT (often CGNAT - Carrier Grade NAT). Many customers may all be using the same public IP address which makes port forwarding difficult in general. ---------------------------------------------------------------------- huntAndPeckEnjoyer · 2023-10-14 06:51 Alright, thanks for the explanation. That makes sense. ---------------------------------------------------------------------- WiseCookie69 · 2023-10-14 07:42 This. I've been using ssh tunnels for over a year now. Best decision ever and only requires ssh to be running on the VPS. ---------------------------------------------------------------------- Ariquitaun · 2023-10-14 07:46 Cloudflare tunnels ---------------------------------------------------------------------- lilolalu · 2023-10-14 07:51 Socat is not the right tool for what you want to do. ---------------------------------------------------------------------- FallenFromTheLadder · 2023-10-14 08:31 If you really don't want to use a cloud provider but just a VPS why not just a reverse proxy, since you clearly intend it to use it for HTTP traffic? ---------------------------------------------------------------------- certuna · 2023-10-14 08:31 Starlink has IPv6 now, you can host stuff. ---------------------------------------------------------------------- Affectionate-Yak2 · 2023-10-14 09:08 Thank you very much! ---------------------------------------------------------------------- HearthCore · 2023-10-14 09:08 You can realize this through multiple ways. The general approach is to use a reverse proxy like nginx, so you can attach multiple websites to your FQDN, on the vps and route the traffic through a tunnel or directly to other services in the network reachable ranges. the tunnel can be anything, basically.. most people that want results without much of a hassle use a VPN I use an OVH FQDN and VPS for 10 Bucks a month and use tailscale for internal reachability and my own public DNS settings, then have another FQDN that I route all requests to the VPS's Nginx Proxy Manager, every machine has its own Tailscale Client/Tailscale IP, so I can just have NGinx route the traffic from "[jellyfin.example.pub](https://jellyfin.example.pub)" to "[jellyfin.example.int](https://jellyfin.example.int)" where the int DNS entry has tailscale IP adresses which the Nginx can reach and safely route to without exposure. ---------------------------------------------------------------------- MistiInTheStreet · 2023-10-14 09:26 I would recommend the following software instead of socat. https://github.com/rapiz1/rathole It’s a sort of open source cloudflared that you host on your own VPS. ---------------------------------------------------------------------- phein4242 · 2023-10-14 09:55 iptables -t nat -A PREROUTING -d -P 443 -J DNAT —to :443 repeat for port 80 ---------------------------------------------------------------------- phein4242 · 2023-10-14 09:58 An ssh tunnel can be used to multiplex lots of connections, so unless you prevent the client from doing so, you still give out access to all ports. ---------------------------------------------------------------------- phein4242 · 2023-10-14 10:00 A reverse proxy does mitm, while OP wants to do the decryption at home ---------------------------------------------------------------------- HearthCore · 2023-10-14 11:19 Host the reverse proxy at home? ---------------------------------------------------------------------- ochbad · 2023-10-14 12:30 I have a wireguard tunnel between the vps and my home network. Then I use nat to port forward the incoming packets over the wireguard tunnel. Getting return traffic to route back through wg while keeping the original source ip was the trickiest part. I ended up with policy based routing on my home router to send any traffic originating on webserver:443 with a destination on the internet to go through wg. ---------------------------------------------------------------------- geo38 · 2023-10-14 14:35 The first part of that is true. The last part is not. The above command only forwards traffic inbound to the VPS on port 443 back to port 443 on the machine in OP’s homelab that issued the ssh command. ---------------------------------------------------------------------- emprahsFury · 2023-10-14 15:18 Guys nginx has supported ssl passthrough since 2019, almost 4 years ago. ---------------------------------------------------------------------- xkcd__386 · 2023-10-15 02:44 socat is fine for testing and low volume use, but ideal solution is to use iptables. I can't recall the incantation offhand but I notice /u/phein4242 has posted [this](https://www.reddit.com/r/selfhosted/com ments/177grpe/comment/k4totht/) as a comment to this thread so that's a starting point if your homelab has a dynamic IP, setting up wireguard on the VPS and homelab makes that IP address "stable" (you use the wireguard IP instead of the real one as the target IP in the DNAT) ---------------------------------------------------------------------- mamimapr · 2023-10-15 02:45 This might be the most performant solution. ---------------------------------------------------------------------- hmoff · 2023-10-15 05:28 But this approach is also going to mean you don't know the originating IP of the connections. ---------------------------------------------------------------------- phein4242 · 2023-10-15 12:12 Depends. With iptables you only modify the destination address. With a proxy, there is the x-forwarded-for header. ---------------------------------------------------------------------- hmoff · 2023-10-15 20:41 The iptables version has to override the source address too else the reply packets will be incorrect. ---------------------------------------------------------------------- phein4242 · 2023-10-16 14:52 That depends on how the network is configured, but if there are multiple routers doing outbound nat there is a good chance indeed