Confused about self-hosting networking reddit / selfhosted ---------------------------------------------------------------------- Mangovnik · 2023-11-17 19:29 Hey, I am looking into self-hosting to try out something new, learn a bit, and perhaps do some useful self-hosting in the future. However, with my previous knowledge of networking and the stuff I read about self-hosting, I am left confused. As I currently understand it: If I want to connect to my self-hosted service while being connected to my local network, then everything should be as simple as typing in the local IP of my service. If feeling fancy, I could touch up `/etc/hosts` so I don't have to always type in IP or run and configure DNS server. By the nature of NATs, if I wanted to connect to my self-hosted service from outside of my local network (directly or with reverse proxy), I would have to do some port forwarding in my router and call it a day. But that would only work if my router is the only NAT between my local network and the internet, wouldn't it? After some prolonged staring at the output of `traceroute` and likes of [`whatismyip.com`](https://whatismyip.com), I got to assume that my router isn't the only NAT on the way to the internet (I haven't confirmed with my ISP atm, this is just my assumption). If that is true, then there would have to be port forwarding set up on all router(s), that only my ISP can access, which may be difficult to coordinate with my ISP and may break at any time they decide to update, restart, or do anything else with their routers. Am I right? If I understand IPv6 correctly, it may help me bypass the port forwarding on multiple routers, that I cannot access. My ISP supports IPv6, but my router does not. But if my router would support IPv6, I should be able to get a public IP for it and then just set up port forwarding to access my service. Or perhaps even get a public IP for my device, that would run my services and connect to it directly or with a reverse proxy. Is there any error or misunderstanding in my train of thought? What would be the correct/best way to tackle my situation? Or am I just overcomplicating it? Any advice is appreciated. ---------------------------------------------------------------------- ttkciar · 2023-11-17 19:47 That all looks right to me. What I've done is rent a cheapy VM instance ($10/month) and set up ssh tunnels from my homelab to the VM. The ssh connection is initiated from my homelab, so NAT doesn't matter. Once the connection is established, sshd on the VM end listens on specified ports and when it accepts a connection the connection is relayed through the tunnel to the homelab's sshd port. Thus I can ssh into my homelab from anywhere on the internet. To make ssh tunnels work this way, you'll need to tweak the VM's /etc/ssh/sshd_config thus: GatewayPorts clientspecified .. and then run a command like this on your homelab system: ssh -v -N -g -R '*':4321:127.0.0.1:22 vmusername@vmhostname Then to ssh into that homelab system from abroad, you would ssh to port 4321 on the VM host: ssh -p 4321 labusername@vmhostname You probably want to monitor your sshd logs on the homelab, because when the botnets find an ssh port like this they pound it incessantly, trying to brute-force it. Note that these tunnels are ephemeral. If they fall over during a network outage or if either the VM host or your homelab host reboot, you'll have to re-run the ssh tunnel command. ---------------------------------------------------------------------- j0nathanr · 2023-11-17 20:17 I'd echo what u/ttkciar has said, however instead of using SSHD I'd establish a site-to-site vpn from your VPS to your router (you could also establish it with another linux instance if your router doesn't support that). Strongswan works quite well with minimal configuration, just be sure to use up-to-date encryption methods and enable perfect forward secrecy. Then create firewall rules that only allow desired ports through the VPN from the VPS side to mitigate security risks. Now you can run a reverse proxy from your vps and point it to any internal services your running on your local network. ---------------------------------------------------------------------- Mangovnik · 2023-11-17 20:21 You are giving an example of using ssh tunneling so you could connect to your home lab with ssh, but I assume I could use ssh tunneling for other things too? Just some simple webpage for a starter? When I think of it, isn't this similar to if I would set up a VPN on a rented VM, and to it from my homelab? But then I would have to connect to the VPN from any device that I would like to access my homelab from? In terms of bots trying to brute force my ssh port, wouldn't help to disable password login and use only RSA keys or similar? ---------------------------------------------------------------------- ttkciar · 2023-11-17 20:29 > You are giving an example of using ssh tunneling so you could connect to your home lab with ssh, but I assume I could use ssh tunneling for other things too? Just some simple webpage for a starter? Yes indeedy :-) by replacing that "22" in the ssh command with your homelab server's http or https port, you can forward web services in the same way. > When I think of it, isn't this similar to if I would set up a VPN on a rented VM, and to it from my homelab? But then I would have to connect to the VPN from any device that I would like to access my homelab from? Yes, this is exactly right. The ssh tunnel approach is more fiddly, but also allows for more flexibility, as you don't have to change your routing config to use it, but if you're more comfortable using a "proper" VPN solution, you should do that. Relatedly, ssh also provides a SOCKS server capability, providing VPN- like functionality for proxying web browsing. The command I use is: ssh -v -g -D 8234 labusername@vmhostname Then by configuring my browser to use the SOCKS proxy on local port 8234 all of my browser traffic is proxied through the VM. > In terms of bots trying to brute force my ssh port, wouldn't help to disable password login and use only RSA keys or similar? Yep, that would certainly help. All relevant security measures apply. Lock it down as best you can. ---------------------------------------------------------------------- Mangovnik · 2023-11-17 20:56 My router doesn't support VPN connections, but I was thinking about getting a new router sooner or later anyway because my current one is a bit old, misbehaving, and seems to be nearing its passing into silicon heaven. I have checked local PC parts sellers for new routers, but they are not very descriptive about them. Would you have any pointers to some good brands/models? I am thinking of something that would do IPv6, configuring DNS, and mentioned VPN connections. Don't worry if you don't know, I will have to do my own read up on routers anyway. ---------------------------------------------------------------------- j0nathanr · 2023-11-17 21:19 Consensus here is going to be pfsense or openwrt since they’re both FOSS and fully capable routers. They can both run as VMs so if you wanted to set them up in a test environment you can easily do so. Personally, I use a SonicWall tz-600 really only bc I originally acquired it for free and I’m used to SonicWall routers at work. Generally speaking tho, go with a well respected company that caters to businesses rather than consumers. Apart from features, the system should have a a long term support window from its manufacturer for things like software updates/patches. ---------------------------------------------------------------------- tech2but1 · 2023-11-17 22:35 > ~~pfsense~~ *OPNsense ---------------------------------------------------------------------- Ursa_Solaris · 2023-11-17 23:12 >Consensus here is going to be pfsense or openwrt since they’re both FOSS and fully capable routers. Just adding in, OPNSense is preferred to pfSense in the FOSS community as the latter has been less respectful of FOSS. Most recently, [they pulled the rug out from under home users.](https://www.reddit.com/r/PF SENSE/comments/17fvtvv/pfsense_plus_homelab_is_no_longer_available_as_ a/) More info from OPNSense's perspective on the fork [can be found here.](https://docs.opnsense.org/history/thefork.html) ---------------------------------------------------------------------- Dagger0 · 2023-11-18 02:13 A traceroute can't tell you that, but if websites report a different IP to either your client machine or (for NATed v4 networks) your router's WAN IP, then yes, it's likely you're behind CGNAT. Yes, you would need to somehow set up a port forward at the ISP end, which is unlikely to be possible. With v6, all of your devices have proper IPs and you can just permit connections to them without needing to do any port forwarding. It's the easiest way to deal with all of the problems of NAT and CGNAT, with the main potential issue being that your clients need to have or get v6 in order to connect. ---------------------------------------------------------------------- justanotherlurker82 · 2023-11-18 14:39 Give tailscale a try.