Nervous About Opening Ports... reddit / selfhosted ---------------------------------------------------------------------- cap10canuck · 2023-10-16 23:50 ...and even wondering if I really need to. I am often guilty of making that "one tweak too many", breaking a nice, working system in the process! I have everything set up according to the best walk-throughs I can find. Have dockerized containers for Nginx Proxy Manager, Authentik and a ton of the standard \*arr apps and tools (using OMV as a NAS). Have my own domain name, hosted on Cloudflare, with CNAMES set up, proxied through Cloudflare, pointing back to my main record. I can do full domain name resolution inside my home network, with working HTTPS connections to all my app web GUIs. I also have the ability to private VPN into my home network, using Wireguard, OpenVPN or IPsec. I would *probably* be happy to continue to use my VPN connection to the home network when I am remote, BUT... I really would like to give Overseerr access to a couple of remote family members that have access to my Plex library (populated by Sonarr/Radarr). My finger often hovers over the Port Forwarding option on the router, but I ultimately chicken out. Am I being paranoid?? Should I just educate my family members on how to connect to my network via VPN? Anyone else made this choice? Looking for success (and maybe horror) stories before I potentially proceed. ---------------------------------------------------------------------- naxxfish · 2023-10-17 00:09 Depends on how confident you are in the security of the apps you're hosting. If you're proxying through Cloudflare, though - isn't that already effectively exposing your apps publically anyways? ---------------------------------------------------------------------- jerwong · 2023-10-17 00:09 You'll be fine. It's exactly what I do. Just keep any exposed services up to date. NPM also has a very rudimentary blocker that mostly relies on UA and bad strings getting passed through. You can turn that on. Open up only services that need to be exposed e.g. don't expose sonarr/radarr unless there's a good reason for it. Make sure anything you expose that doesn't have any sort of authentication can have it implemented in nginx or you can use an SSO solution. I expose strictly needed services while everything else is just internal. Exposed services include jellyfin, jellyseer (jellyfin version of overseerr), and nextcloud. ---------------------------------------------------------------------- cap10canuck · 2023-10-17 00:21 Yes, the CNAME record via Cloudflare does not leave a lot to the imagination as to what app it is pointing to, but I have not opened port 80 or 443 on my firewall, so the firewall is bouncing any probes. ---------------------------------------------------------------------- imhonestlyconfused · 2023-10-17 00:34 So are your services currently exposed publicly or not? The CNAME in cloudflare simply aliases another domain name so does that resolve to a public IP that your services are behind or how is traffic flowing from outside to your services. ---------------------------------------------------------------------- cap10canuck · 2023-10-17 01:48 No, as of now they are not exposed. I believe for that to happen I would need to open port 80 on my router which would then "open the spigot" to let incoming port 80 traffic hit NPM/Authentik, which would then proxy and authenticate incoming traffic for my internal app. And yes, the CNAME record(s) do point to the high level domain name, which resolves to my public IP address (which is dynamically updated on Cloudflare via a script on my router). ---------------------------------------------------------------------- cap10canuck · 2023-10-17 01:51 That is almost exactly what I would like to do, but with Plex/Overseerr. I am curious, do you run any type of intrusion detection s/w, or have you set up fail2ban? ---------------------------------------------------------------------- ElevenNotes · 2023-10-17 01:51 If the service is strictly only for you: don't. Use VPN to access your service remotely. If its a service for everyone (like a blog or such) there is no way around it. It does not break any security, but you should make sure that the containers/servers exposing this service are secured as much as possible. ---------------------------------------------------------------------- imhonestlyconfused · 2023-10-17 02:27 Gotcha! Yeah I think fronting all services with a reverse proxy (in your case NPM) is the way to go about it. Can setup stuff like fail2ban/crowdsec at the proxy level to cover all the services under it. Security is really down to the individual apps that are being served up then. You could also do something like Cloudflare Tunnels which doesn't require opening ports. ---------------------------------------------------------------------- jerwong · 2023-10-17 03:18 I have fail2ban for SSH but I haven't tuned it for nginx yet. I've worked with OSSEC which has a fork called Wazuh which I've been wanting to set up. ---------------------------------------------------------------------- Tourist7192 · 2023-10-17 07:20 Why don't you give Cloudflare tunnels a try? It means you don't have to open ports and you can put Cloudflare's WAF in front of it too. ---------------------------------------------------------------------- Gh0stDrag00n · 2023-10-17 07:59 Only useful till u wanna host games, that's where u gotta expose your ports as tunnel doesn't support most game ports. Unless I misunderstood how tunnel works ---------------------------------------------------------------------- cap10canuck · 2023-10-17 11:38 Thanks - will look into this. ---------------------------------------------------------------------- reklis · 2023-10-17 12:41 https://tailscale.com/ ---------------------------------------------------------------------- Tourist7192 · 2023-10-17 13:18 Cloudflare tunnels and cloudflared supports any port you care to specify - only the protocol may limit it (http, https, tcp, smb, ssh, rdp, unix, unix+tls). ---------------------------------------------------------------------- lilolalu · 2023-10-17 13:34 Yeah you should be. But you can prepare yourself. Open a ssh port and put a honeypot behind it and see how hackers would attack your system if they came in: https://linuxsecurity.expert/security-tools/honeypots ---------------------------------------------------------------------- h311m4n000 · 2023-10-17 13:48 I've had ports open for years. Just comes down to good hygiene. Whatever you access from outside should either be on an isolated network (DMZ) or access should be filtered. Typically for e-mail I have port 25 open, but only my cloud VPS is allowed to connect to it in the firewall. I also make use of geo-ip blocking in opensense. Typically 99% of my the trafic on the ports I have open should only come from one country, the one I reside in. I also make use of maltrail to keep track on what's attempting to connect. ---------------------------------------------------------------------- cap10canuck · 2023-10-17 19:34 Since I already have NPM+Authentik up and running (after more tweaking than I would have ever thought required!), I am starting to think my final solution might look like (Cloudflare Tunnel) + (NPM + Authentik). Time to start Googling... ---------------------------------------------------------------------- Tourist7192 · 2023-10-17 19:48 Taking advantage of Cloudflare's threat intelligence and reputational access control combined with your local auth sounds like a pretty bulletproof solution. ---------------------------------------------------------------------- VoXaN24 · 2023-10-17 23:28 I made a different setup due to my old ISP who give only CGNAT IP. I’ve used an VPS who’s host an Wiregaurd Sever and made a port forwarding rules to redirect port to my local machine (or other machine connected to this VPS via VPN). That a good method when you have a CGNAT IP and/or when you don’t want to give your residential IP (or want to host some thing in an IP and other in another IP has my provider sell them for 2.5 bucks one time). Now I have a full V4 IP, but I don’t switch to it has I find it more convenient to stay with that. A little plus, is if you torrenting your favorite free and legal movie your IP is hide too. The two bad thing so : latency is augmented (by 1 or 2 ms), network speed can be reduced compared to a direct connection but for plex for exemple it work like a charm.