Security question about hosting custom service reddit / selfhosted ---------------------------------------------------------------------- happygeek10 · 2023-10-20 09:05 I self-host a custom service that I programmed. The client program sends TCP packets to the server program in order to get a response, but all clients are outside of my local network, so I need to forward a port for their installations of the client application to communicate with my server instance, which is running on Windows Server 2016. I am concerned about the security of this configuration. Currently, I have the firewall set up to only allow incoming connections to the server via the designated port to be passed to the server instance via Windows Firewall. No other port is open on the router, and the server machine will not accept traffic from any other port, or allow it if the server instance is not running. I use a consumer grade router, with a dynamic public IP, with a script running on the server machine to update the CloudFlare DNS records on my domain as the dynamic IP changes. I don't know much about networking, so I'm unsure if my current configuration is really safe. I don't have many resources to use, as I'm limited to my home network and don't have any other real networking equipment. The server runs alongside others and everything else connected to my home network on the same subnet, which is where I'm really concerned about the security of this setup. The service I'm hosting does not serve any sensitive or personal information, and does not have access to it. I guess what I'm worried about is the vulnerability of other devices, and whether it is possible for attackers (which is probably is) to access other things than the server instance of my custom service. A VPN solution is not viable. Am I safe just with Windows Firewall and that of my router, and the fact that my service does not (to my knowledge) does not have any "backdoor" that exposes the content of my server machine, and therefore other things on the network? I'm sorry I'm using rudimentary ways to explain my situation/setup, but I'm not really good with networking. I'm just a programmer equipped with a home network that needs my service to be accessible from outside the LAN. Thanks in advance ---------------------------------------------------------------------- revereddesecration · 2023-10-20 10:57 You can open a port and allow traffic in safely, as long as the service that listens is written properly. You wrote it, so either you built in some vulnerabilities or you didn’t. If you didn’t, no problem. If you did, how will somebody find the vulnerability if they don’t know the first thing about your software? An attacker could definitely spend time sending packets and seeing what is returned until they work out how your service works, if you built it in a way that allows it. Or you use proper encryption techniques and they have no feedback to work with. ---------------------------------------------------------------------- happygeek10 · 2023-10-20 12:15 Okay, thank you. This was also my logic - the service is not publicly released yet and wouldn't yield anything of interest to hackers anyway if they found out the specific commands to send. I was just worried about a possible break out, but considering the service doesn't interface with anything outside of its instance in a way that could be exploited (to my knowledge), and your input, I'm not really worried as much now. Thank you! ---------------------------------------------------------------------- revereddesecration · 2023-10-20 12:38 There’s a couple of things to weigh up: attack surface, and incentive to attack. You’re not high on either scale so it’s not a high chance of problems. ---------------------------------------------------------------------- ButCaptainThatsMYRum · 2023-10-20 13:27 I'd recommend either only allowing specific IPs to connect (Bobs home IP, Carl's work IP, etc), or using a VPN. The downside to whitelisting their IPs is that residential IPs can change and need to be updated. The downside to VPN is they have access to everything unless your server allows you to specify access rules. With a consumer grade router you're not really getting a lot of security features. ---------------------------------------------------------------------- happygeek10 · 2023-10-20 15:11 Specific IP thing can work to some extent but not if clients are at home, where they have a dynamic, residential IP. Unfortunately VPN does not work for my specific use case. I have a list of malicious IPs that I found on GitHub that I've blocked, so maybe that helps with bad actors/bots a little? ---------------------------------------------------------------------- ButCaptainThatsMYRum · 2023-10-20 15:13 I wouldn't count on it. Blacklists only block known bad ips. This is the reality of self hosting. You can't have your cake and eat it too. Either you have manage a security plan or you don't and accept greater risk. ---------------------------------------------------------------------- ProfessionalAd3026 · 2023-10-20 20:24 Look into certificate based authentication. If the clients don’t present a certificate issued by your CA, the connection won’t be fully established.