DIY Networking Project: VPS Rental, VPN, and Device-Specific Access -
Thoughts and Guidance?
reddit / selfhosted

----------------------------------------------------------------------
valaised · 2023-11-16 10:52

Hi!

I have an idea of Device-Specific Access to my cloud-based apps, but
I'm not sure whether it's useful and secure to struggle with it. If it
makes any sense, please suggest ways to implement it:

The idea is: To rent a VPS, blocking all incoming/outcoming
connections, but standard HTTP ports, port for VPN, and creating a VPN
profile that, so only you from your devices (Mac, iPhone, etc) could
access your VPS network and its services from anywhere.

Questions:

1. How safe and useful this is and is there a reason to implement this
project if you want only your specific devices to access your self-
hosted apps?
2. Could you suggest guidelines on how to set up this network stuff
with a VPN?

----------------------------------------------------------------------
jamesckelsall · 2023-11-17 22:27

You only need to open HTTP(S) ports for access *without* the VPN. If
you don't want any HTTP(S) services to be accessible to the world, you
don't need those ports open.

I'm presuming that your reference to safety is about security:

The security of a system is dependent on the weakest link. A VPN can
strengthen security in some aspects, but it's irrelevant if you leave
SSH on port 22 with password access and root:root credentials.

If you're storing highly sensitive files without encryption (or with
server-managed encryption), your VPS provider can see all of those
files without needing to bypass your VPN.

You need to work out what threats you're trying to defend against
before you decide what defences to use.