Is a reverse proxy necessary to access remote services when I already use a vpn? reddit / selfhosted ---------------------------------------------------------------------- Rafa130397 · 2023-10-31 23:13 Hey! Sorry for the repeating question, I have a very specific question though. For context, I access my services using a vpn, and that's been great. However, I've been a lot of people mentioning reverse proxies. Are they necessary or more of a convenience thing? I ask because I don't see something that I cannot do with my current vpn setup. Thanks! ---------------------------------------------------------------------- clintkev251 · 2023-10-31 23:25 They're a necessity if you're planning on exposing services directly to the internet, they're a convenience otherwise just because you don't need to memorize a bunch of ports and IPs ---------------------------------------------------------------------- Crazy-Hall8823 · 2023-10-31 23:26 I access all my services behind a VPN but I use traefik to add domain names to my services and secure them with an SSL certificate. If you're accessing your services via http and the ip address then there's no need for a reverse proxy. If you would like convenient URL's for your services secured behind https use a proxy. Because you're accessing locally don't expose the ports on your router. You then have all the benefits of a rev proxy but no stress of it being open to the big bad internet. If you decide to expose it use something like authelia or authentik to secure your services. If you do this I'd suggest purchasing a yubikey or something to use with authelia or authentik. (I'm also not a pro on reverse proxies so don't rip me a new one if my wording isn't great here) ---------------------------------------------------------------------- Gabe_Isko · 2023-10-31 23:33 If you are going to host websites on the same port, than yes. This is a good idea - you should get used to host any web portal on the standard http/s ports. If you plan to use VPN, then it is just for organizational purposes. But still a good idea. There are certain services that I don't like to put behind a reverse proxy. ---------------------------------------------------------------------- Rafa130397 · 2023-11-01 00:59 What is the benefit of a ssl certificate if I use a vpn? Also, can I have custom domain names without exposing my services to the internet? ---------------------------------------------------------------------- Rafa130397 · 2023-11-01 00:59 What services you dont put behund a reverse proxy and why? ---------------------------------------------------------------------- Rafa130397 · 2023-11-01 00:59 And can I achieve this without exposing them to the web? Like internal names? ---------------------------------------------------------------------- Naths16 · 2023-11-01 01:07 The benefit of a ssl cert is pretty much to prevent browsers from complaining and some apps like vaultwarden requires a valid ssl cert. You absolutly can have a custom domain with dns records for private ip’s only. Personaly is use pihole to manage my dns records. ---------------------------------------------------------------------- Gabe_Isko · 2023-11-01 01:20 Mostly non http stuff. I don't expose that stuff to the internet anyway. I also don't have portainer behind the reverse proxy. You shouldn't be able to access that from outside my network. I think of it as stuff that I want tobtreat like any other website goes behind the reverse proxy, and everything I want to use specifically on my network isnt. ---------------------------------------------------------------------- clintkev251 · 2023-11-01 01:25 Sure, you just need an internal DNS service. Could be something as simple as PiHole or Adguard. Then you create a DNS record that points to your proxy, configure the proxy as normal to point to your services, and you're good to go ---------------------------------------------------------------------- Crazy-Hall8823 · 2023-11-01 01:59 Https is http but with encryption. It's much more secure. Yes you can. I said that in my original post. You set it up normally you just don't expose 8080 and 443 on your router. If you don't expose those ports on your router it will remain completely locally. I would suggest using nginx proxy manager to play around. It is the simplest proxy I have used and what I used when learning. Traefik is much more complicated. I'd suggest following this video to set up your first reverse proxy. Jjst skip the part where he exposes the ports on the router. Don't do that if you want to keep it local. https://youtu.be/GarMdDTAZJo?si=W6ltT-FkZ6Ka3v7s ---------------------------------------------------------------------- Crazy-Hall8823 · 2023-11-01 02:00 Also be aware you will need to purchase a domain name to use a reverse proxy. You can get them for as low as 2$ a year depending on how picky you are. Check out porkbun or godaddy or something like that. I use porkbun ---------------------------------------------------------------------- Rafa130397 · 2023-11-01 02:17 So by default they do get exposed to the web unless I do what you suggested right? ---------------------------------------------------------------------- Rafa130397 · 2023-11-01 02:19 I know http and https, but isn’t a vpn secure as well? So what would be the problem of accessing an http inside a vpn which is of course encrypted? Also, thanks for the video! ---------------------------------------------------------------------- Rafa130397 · 2023-11-01 02:19 Even if I want to do it locally I need to purchase something? ---------------------------------------------------------------------- clintkev251 · 2023-11-01 02:23 Nothing gets exposed to the web unless you choose to expose something to the web. You would have to set up a port forward in order for anything to be exposed to the web ---------------------------------------------------------------------- Rafa130397 · 2023-11-01 02:25 Oooh, I see. So I can just set up a reverse proxy locally to avoid dealing with ips and ports, that’d be awesome ---------------------------------------------------------------------- Crazy-Hall8823 · 2023-11-01 02:32 The vpn you're using is only allowing you into your internal network whilst you're away from home. Unless you're referring to like nordvpn or surfshark or something like that. That's a different story. But I assume youre talking about wireguard, tailscale, or twingate type vpn. It basically means you're at home when you're not at home if that makes sense. You're still visiting unencrypted webpages. Not a big deal if you're local but an ssl certificate will come packaged with a domain name when you register it on nginx. ---------------------------------------------------------------------- Crazy-Hall8823 · 2023-11-01 02:32 If you want to use a reverse proxy you will need a domain name yes. ---------------------------------------------------------------------- Rafa130397 · 2023-11-01 02:34 You assumed correctly, I am using Tailscale. What so you mean by unencrypted pages? Isn’t the traffic between my external device (using the vpn) and my service encrypted even if it is http since the vpn is encrypted? Also, these services of mine are all local ---------------------------------------------------------------------- Rafa130397 · 2023-11-01 02:35 Got it, thanks! ---------------------------------------------------------------------- Crazy-Hall8823 · 2023-11-01 02:40 I don't use tailscale so I'm not 100% sure i tried it once but found it odd to use being it seemed to route to different internal ip's. You do pose a good question and I don't feel confident enough with tailscale to answer it. But as far as I am aware if the page is http its unencrypted. I believe tailscale is just creating an encrypted tunnel into your local network. This doesn't correlate to what pages you're viewing. But I could be completely wrong here. Anyone who knows better please correct me! ---------------------------------------------------------------------- Crazy-Hall8823 · 2023-11-01 02:47 Also for me the ssl cert isn't the reason for using a reverse proxy. I use a reverse proxy so I can put domain names on my services like portainer.mydomain.com and prowlarr.mydomain.com instead of visiting 192.168.0.1:9443 or 192.168.0.1:9696 (ip's are just generic my static ip is not that ahhaah) ---------------------------------------------------------------------- AltLawyer · 2023-11-01 03:33 The main thing is you have to specifically setup each client device if you're using a VPN to access your client. I use it like you do to get to my own server when I'm remote as well. I put certain ports behind a reverse proxy to share access with others, either in the form of accessible links for family and friends (ie sharing files with nextcloud) or for running apps that receive data from outside my server/control (I can't tell Spotify API to install openvpn and use this certificate to connect to my router to update the app running on my server that tracks my Spotify history, I can tell them the callback url is Spotify.myserver.com though) ---------------------------------------------------------------------- UnrealisticOcelot · 2023-11-01 05:00 Not for local only. But the cert would need to be from a local CA. ---------------------------------------------------------------------- LoungingLemur2 · 2023-11-01 05:07 Check out duckdns. It’s free and real simple to setup; loads of guides online too. Works like a charm as long as you don’t mind domains that have this form “subdomain.mylocaldomain.duckdns.org” ---------------------------------------------------------------------- Psychological_Try559 · 2023-11-01 05:42 If you're keeping everything within a VPN you won't NEED a real domain, but you'll need to use something. To take an absurd example: you could, on your own network, use google.com to go to your own webserver. While this is technically possible, this is obviously a terrible idea for many reasons--not the least of which is "good luck knowing where google.com will take you when you type it in", there's also things like HSTS & certs that make this much more difficult. The point is that you can use any domain you want, but it's best practice to make sure the domain is really yours. While there are reserved domains like ".local" it turns out that's a bad idea because some other things assume it's unused. So to make sure you have your domain and nobody else grabs it, it really is recommended that you buy the domain. I say this having tried to ignore this advice and had to rebuild my entire network back in the day. If a few bucks a year is really a problem, you can get away with not buying a domain but assume it'll bite you later. ---------------------------------------------------------------------- JaJe92 · 2023-11-01 07:51 Curious, I don't use reverse proxy yet and I plan on learning doing so, at the moment I need to memorize local IP and ports for my services on Pi, Basically it will act like a dashboard for all services? or why you mentioned to not memorize these ip/ports? Or you can make links such as [service1.domain.com](https://service1.domain.com), [service2.domain.com](https://service2.domain.com) and so on? ---------------------------------------------------------------------- PhilipLGriffiths88 · 2023-11-01 09:23 Yes, if you are using a VPN or overlay network you are encrypted and external actors cannot snoop on traffic across the internet. The only thing a reverse proxy gives you is you browser will think its secure and give you a nice green lock, while using VPN it will not as it only sees HTTP. That said, if your VPN terminates in local network, rather than on your device, you do have unencrypted connections in your LAN. Also, you can have custom domain names if your overlay network provides a private DNS. ---------------------------------------------------------------------- DopeBoogie · 2023-11-01 09:26 I have some sites on my nginx proxy configured to only accept connections from IPs on my Tailnet and deny any other connections so that's an option too ---------------------------------------------------------------------- DopeBoogie · 2023-11-01 09:44 Yes your traffic over the VPN is secured by WireGuard so you don't really need it to be https. I would still do it for two/three reasons tho: 1. It's good practice, learning how to use a reverse proxy is a useful skill. 2. If you're traffic ever does leak it would be nice to have the https as a backup. 3. Browsers don't really like http, they make it more and more difficult with every update, even for local traffic. Plus you only need to set up the certificate stuff for your reverse proxy and then every site you configure through it can benefit from that encryption without the hassle of getting each site its own certificate. ---------------------------------------------------------------------- DopeBoogie · 2023-11-01 09:47 > (ip's are just generic my static ip is not that ahhaah) Even if those were your real IPs they are local ones so they are really meaningless to us and not a security risk ---------------------------------------------------------------------- DopeBoogie · 2023-11-01 09:52 You can use the one from tailscale if you don't care about what it is. Go to the DNS page on your tailscale admin and look at the Tailnet name, that's your tailscale domain. SSL certs are generated automatically and by default it's only accessible from within your tailnet ---------------------------------------------------------------------- AlexisColoun · 2023-11-01 10:07 The second one. Let's say you have one host with the up 10.0.0.10 with three services running. Service 1 is listening for port 80 http Service 2 is listening for port 8080 http Service three is listening for port 9000 http Within your reverse proxy you now write a config that connects a domain with subdomain for each service to the hosts IP and the port Like you said service1.domain.tld forward 10.0.0.10:80 service2.domain.tld forward 10.0.0.10.8080 service3.domain.tld forward 10.0.0.10.9000 The reverse proxy (in my example probably hosted on another internal IP) always listens for port 80, catches the subdomain and forwards traffic to the specified up and port. ---------------------------------------------------------------------- Prodigle · 2023-11-01 11:01 A reverse proxy will let you write domain name -> IP. People use them even in private networks to remove the need to remember a bunch of IPS. They can be used in conjunction with exposed services but exposing them you would do somewhere else (port forwarding in your router) ---------------------------------------------------------------------- Do_TheEvolution · 2023-11-01 11:27 >Are they necessary or more of a convenience thing? Convenience. Dunno why top answer is necessity, you absolutely can rock open multiple ports that go to different things, same as OP does now through VPN. But convenience is a big thing... I love caddy reverse proxy for its simplicity and robustness. [Here is a docker guide](https://github.com/DoTheEvo/selfhosted-apps- docker/tree/master/caddy_v2) if you wanna try it. ---------------------------------------------------------------------- Do_TheEvolution · 2023-11-01 11:31 yeah the subdomain one.. they are usually for webtraffic and you can have only one webserver listening at port 80/443. With reverse proxy its that reverse proxy that listens there and based off the url in the http requests it sends traffic to some other webservers running in docker container or some other ip on the network.. [I like caddy for its siplicity](https://github.com/DoTheEvo/selfhosted-apps- docker/tree/master/caddy_v2) ---------------------------------------------------------------------- PowerfulAttorney3780 · 2023-11-01 11:52 Could you just use a hosts file if you don't wanna set up a reverse proxy? ---------------------------------------------------------------------- europacafe · 2023-11-01 12:11 If you use your services for yourself or family, you don't need a reversed proxy, but to share some of your services to the public or your friends, you need a reversed proxy in order to let them use/remember your domain name without knowing your public ip given by your isp; for convenience and security reason. ---------------------------------------------------------------------- DopeBoogie · 2023-11-01 12:25 I don't think hosts files support specifying ports? And it won't get you the https proxying and other features. ---------------------------------------------------------------------- Kalindro · 2023-11-01 12:42 Agree with the above, I have exactly this setup. Just to be remembered, if you want internal DNS with a "made up" name (nothing exposed), you cannot get regular SSL as well, it's made up and not exposed! You need to get your own cert (a lot of ways, if you access the site mainly via your main PC, it's easiest done with "mckert" on this main PC). So tldr, DNS (pi hole, adguard etc) with DNS overrides that point to reverse proxy IP (caddy, NPM etc), this reverse proxy has the same cnames and points them to a certain IP:port and on top of that you select custom cert made that was made with mkcert for SSL. ---------------------------------------------------------------------- trobinpl · 2023-11-01 13:15 You don't need to buy any domains if you just want to expose services in your local network and access them through VPN remotely... People often use domain .local (like service1.local) - not something you can actually buy. Simply speaking domain name does nothing else than being a easy to remember way of accessing resources which otherwise you would need to remember IP address for. It's done through DNS servers which have information about this domain -> IP connection. If you deploy your own DNS server (like PiHole or whatever else) you can add DNS records for any domain to any IP. You could add record for google.com pointing to some random IP if you want. You don't need to own a domain to do that On a machine level you could modify hosts file which can be also used to tell your computer how to resolve different domain names So no - you don't need to purchase anything if all you're concerned about is being able to access your services from local network ---------------------------------------------------------------------- nyrosis · 2023-11-01 13:24 It's convenient for some services like jellyfin that have a companion app. It's much easier to just point the app to a domain name you control to get everything working without vpn. The certificate support is nice too. Say for instance you have a family member that you know won't be taking the time to setup vpn configs to access this device. It's easy to just say here is the link the app is asking for and here is your username/password. ---------------------------------------------------------------------- clintkev251 · 2023-11-01 14:34 I say it's a necessity not from a technical standpoint (of course you can just forward random ports directly to services), but from a "doing things the right way" standpoint. Especially if you're intending to expose services which aren't expressly designed with internet exposure in mind, a reverse proxy is hugely important for security as far as implementing SSL and authentication ---------------------------------------------------------------------- JaJe92 · 2023-11-01 15:33 Great! Thanks! ---------------------------------------------------------------------- Kaikidan · 2023-11-01 18:18 or go the lazy route like me (that also uses a VPN for outside acess) and create a dashboard (like gethomepage/homepage) as the first page on your server IP and add links for all your services as bookmarks.