Do you know of any Android/iOS app that keeps track of the current device IP and allows the user to send the IP via webhook (or anything alike) to a server? reddit / selfhosted ---------------------------------------------------------------------- Soraster · 2023-11-20 02:21 Reason for my question is the following: I want to host some services on my public server and while they all have normal password protection, I want to ensure the security a tiny bit more. Therefore I want to limit the access to the specific services through ufw and nginx to specific IP addresses. For my homeaddress I can use DYNDNS to get my current IP. However that will not work for my phone, when I'm on the go. I don't want to constantly use vpn, as it slows down the speed of the internet connection significantly. Instead I would much prefer to just simply keep my server updated on my phones IP, so I can update the necessary config files through a script and thus allow my phone to access the services, where ever I am. ---------------------------------------------------------------------- Sure-Temperature · 2023-11-20 02:42 Tailscale? It will give each device a unique IP on its own subnet ---------------------------------------------------------------------- TrackAccomplished607 · 2023-11-20 02:44 Hi. I think what you're asking for is a bit silly and will give you a false sense of protection. As long as your home is using a broadbancd connection the likelyhood of you getting an unshared public IP address is pretty high and even in that situation it's not a contractual promise for you to have that benefit. ​ Eg your public IP can be shared with other customers. ​ Your phone is under the same set of issues. If you want to add cybersecurity to your deployments (applause). You should do that but doing it through IP restriction is an anti-pattern. You're better off using web application firewalls alongside something like the orange cloud proxy service from cloudflare. If you restrict your open ports to 80 and 443 or whatever small set of ports you need and only allow ssh through your network overlay. You will be plenty secure. ​ If you want to go further you can use security based products like zitadel in conjunction with OIDC to secure your application. I would also advocate to setup your nginx reverse proxy to simply not give off hints. You can reference the hardening guides for it. ​ Authelia is easier to setup if you want that. If you want easier control over your userbase. You can use lldap in conjunction with Authelia and zitadel. ​ Now to get to hardening guides for your host. You should probably be running rootless docker/podman or be running your application as a user that does not have elevated privileges. There's probably no need to genuinely harden and stig your deployment although if you want to do that you can use the CISA/DISA recommendations. If you do all of that your deployment will probably be secure. ​ Also if your VPN is slow and if it's based on OpenVPN. Using a wireguard based system may simply be faster due to it requiring less hardware. ​ So just to be clear, restricting access based on IP address seems like a good first step but it's an anti-pattern because it allows you to create a mental model to side step actual security. ---------------------------------------------------------------------- Swedophone · 2023-11-20 02:44 > I don't want to constantly use vpn, as it slows down the speed of the internet connection significantly. Why don't you use VPN for the subnets you use on your home network, and no VPN for other subnets, AKA split tunneling? ---------------------------------------------------------------------- no_step · 2023-11-20 02:46 Create a new duckdns domain, then run a duckdns client on the android device to keep the ip updated. Run 'host [myfakename.duckdns.org](https://myfakename.duckdns.org)' to find the ip. I think it's gonna be error prone and you won't gain any real security, but it's your server ---------------------------------------------------------------------- aamfk · 2023-11-20 03:36 sounds to me like you're looking for a DynDNS client. ---------------------------------------------------------------------- OCTS-Toronto · 2023-11-20 03:37 You could use a dyndns client (easydns had one for public download a while back). But this is a bad idea security wise. If you don't like vpn tunnels (openvpn works well in this scenario btw) then how about ssh tunneling? If your phone is android then it's not hard to do this. Hell you could write a cron job that grabs your ip from https://icanhazip.com/ and post the value to your home webserver. ---------------------------------------------------------------------- rezzorix · 2023-11-20 04:10 For iOS there is an app called “Host Monitor”. https://apps.apple.com/app/id989644054 You can connect (ping) hosts (URL, IPs) and can do this even in background. The frequency can be set to ~hourly, 6 times per day or manual. So if you set up the server end to fetch the IP of the device with Host Monitor checking; you could make things work the way I believe you want it 😉 ---------------------------------------------------------------------- carl2187 · 2023-11-20 04:11 Your describing port knocking. An interesting and (effective?) security by obscurity technique. An example: Host port 443 web server, but by default the port is fully firewalled unless you give the secret "knock". So you hit port 5444 first, the router sees a request to 5444, and adds the source address to a list of allowed devices for the actual 433 port. Now, just your client ip can successfully connect to port 443 as normal. Most security researchers balk at it as wholly dumb and ineffective. But I disagree. With port knocking I get ZERO hits to my publicly exposed SSH port 22 on my actual server. The firewall shows all the port scanners hitting my block port 22, thousands per day. But unless they hit my secret combo of ports first, they don't get to the allow port 22 rule. More complex rule would be used in production: Hit port 5001, then 5009, then 6120, then 4001 now you can hit your actual service port. And if you don't hit them in order, no go. To reach 5009, you must hit 5001 first, to hit 6120, you must have hit 5009, which already required to have hit 5001. Add a rule where if you hit 5008, it all closes and starts over to preclude a port scanner from triggering all your rules. Mikrotik routers have the ability to do this with firewall rules that just trigger and add a client ip to a transient src-address list. The longer your chain the better. Android has an app called "port knocker" that makes it easy to open the door any time automatically. Only issue is someone watching your traffic will easily see your port knocks, but that's a local, persistent adversary, not a transient scan, so yea, I get why serious security people say meh, but the threat your preventing as an individual is the random drive by scans and brute force scripts, and it's 100% effective at preventing those. ---------------------------------------------------------------------- ozjd · 2023-11-20 04:13 The best option would be to have a DynDNS client on your phone (which your server can check) for what you want. However, the reason VPN exists and is popular is because it works with the required security. Trusting an IP address alone leaves yourself open to abuse from another user at your ISP, your ISP, or even simply someone sending you a link to a specially crafted webpage which contains some HTTP requests, etc. Ironically, allowing the phone to send it's IP address to your home server opens up the whole network to abuse, as the update would need to be allowed from an IP address that's not already known. There's a reason we don't use security by obscurity. ---------------------------------------------------------------------- zfa · 2023-11-20 04:14 Far and away best soln. Something like WireGuard always running with only home subnet in the AllowedIPs would be perfect for OP. ---------------------------------------------------------------------- NikStalwart · 2023-11-20 05:08 I think you are overcomplicating and undercomplicating things at once. Proper VPNs will allow split tunneling  —  only the traffic that needs to go through the VPN will go through the VPN. So, the solution would be: * Set up a VPN capable of split tunneling — vanilla Wireguard and tailscale should work * Set up split horizon DNS so that you get are pointed to the internal/VPN-facing IP address of your server while connected to the VPN *??? * Profit ---------------------------------------------------------------------- carlinhush · 2023-11-20 05:28 Home Assistant Companion App does this ---------------------------------------------------------------------- Forgottensky · 2023-11-20 06:01 This. I am 24 hours connected via Wireguard with split tunneling and I don't even realize that I am connected to a VPN ---------------------------------------------------------------------- Soraster · 2023-11-20 07:44 Oh, I didn't even know there were any DynDNS clients for smartphones. Can you recommend one for Android? ---------------------------------------------------------------------- Soraster · 2023-11-20 07:55 Would it be possible to set this up in a way, that the VPN is only active for a specific IP and deny all access to other services running on my home machine? The problem ist as follows: The server running the services mentioned above is not within my home network, but a root server from a public provider. Some of these services are exclusively created for my future staff. After soloing for years, I'm currently building a dev agency. I want the services to only be accessible by them, don't want to limit their bandwith to any other website or service and also don't want to enable them to nose around my home network. ---------------------------------------------------------------------- zfa · 2023-11-20 08:39 We're getting closer to the actual problem here but you're still giving out half-finished solns instead of giving your exact requirements. Relaying through your home? Why? Is this just what you've thought of off the top of your head or a requirement etc.? You'll get better answers if you forego the attempted solns and just post something along the lines of: *"I've got a server hosted with ABC Inc. on which I run Product-X. I can/can't install extra software on it. I have i/j/k employess that need to access it securely.* *"What are my options assuming they can/can't install software on their devices. It's important that the users can/can't access a/b/c"* People can then come in with various topologies you may or may not have considered... Split-tunneled VPNs, zero-trust solns, simple web- proxies etc. There may be extra Qs folk will ask you such as *"Is Product-X web- based?"* etc come up but you'll probably get better quality answers than drip -feeding bits of info like a murder mystery. GL with whatever you come up with. ---------------------------------------------------------------------- SimonLeBonTon · 2023-11-20 08:54 curl ip.me I'd use Tasker to get the phone IP at your convenience and HTTP post it wherever you need ---------------------------------------------------------------------- lilolalu · 2023-11-20 09:02 Assuming your services are going through a Proxy Server: just install a client certificate in your phone and only allow connections with those client certificate. Very secure and much easier to establish than most of the other measures described here. ---------------------------------------------------------------------- nathan12581 · 2023-11-20 09:15 VPN split tunnelling is what you need ---------------------------------------------------------------------- tech2but1 · 2023-11-20 09:25 The correct answer has been given a few times here, split tunnelling. But your idea is mental. If your IP changes and access is locked down by IP address how do you expect your phone to connect to your server to tell it about the new IP if it can;t access the server due to the fact it hasn't got the correct IP in the allow list? ---------------------------------------------------------------------- Soraster · 2023-11-20 10:07 Yeah I thought about this problem. I don't want to lock down all ports for nginx, but instead only certain websites through nginx rules. The webhook receiver would remain open to the public, but would require a long passphrase that would result in ban through fail2ban, if entered incorrectly. I know this isn't ideal, but that's what I had in mind, when thinking about the problem. ---------------------------------------------------------------------- tech2but1 · 2023-11-20 10:14 As a variation on that, or in addition to it, you could look at port knocking. I think you might be overcomplicating it though, stick OPNsense behind your open ports and get some IDS/CrowdSec protections. ---------------------------------------------------------------------- Soraster · 2023-11-20 10:18 >Assuming your services are going through a Proxy Server: just install a client certificate in your phone and only allow connections with those client certificate. > >Very secure and much easier to establish than most of the other measures described here. I already implemented a certificate based authentication for a customer of mine. That does work for websites. However I'm not so sure if that still applies, if the certificate protects a nginx config, that is responsible for the communication with an app. ---------------------------------------------------------------------- lilolalu · 2023-11-20 10:25 I think the built in authentication progress of any app is independent of checking for a valid client cert. First nginx will check if you have the cert to allow establishing the connection. What comes after is not of importance to nginx anymore. With client cert you can even contemplate disabling User authentication completely, if it's not a Multiuser app. ---------------------------------------------------------------------- Soraster · 2023-11-20 10:31 ChatGPT said the following about the topic: >When accessing a web service hosted with Nginx and using certificate- based authentication, the behavior can differ when the service is a backend for a frontend app on an Android phone compared to accessing it through a mobile browser. Mobile Browser Access: As you mentioned, when opening a website that is protected with a certificate on a mobile browser, you are typically prompted to select and use a certificate. This is a standard behavior in most mobile browsers, which support client certificate selection and use. In-App Access (Android App): The behavior within an Android app can be quite different. Android apps don't automatically use installed certificates in the same way a browser does. Instead: The app needs to be specifically programmed to handle certificate- based authentication. This involves implementing code to select the correct client certificate and use it for HTTPS connections. The app developer can use Android's KeyStore system to programmatically access certificates stored on the device. The app can then present these certificates when making network requests to servers requiring certificate-based authentication. In some cases, apps might have the certificate bundled within them, especially if it's for a specific service and the developer wants to streamline the user experience. Implementation Considerations: Security: Storing certificates within the app can have security implications. It's crucial to ensure that the certificates are stored and handled securely. User Experience: If the app requires users to have specific certificates installed, this needs to be communicated clearly, and the app might need to provide guidance on how to install these certificates. Compatibility and Testing: Thorough testing is essential to ensure compatibility across different Android versions and devices, as handling of certificates can vary. Backend Configuration: The Nginx configuration on the server-side will remain the same. It will still expect a client certificate for authentication regardless of whether the request comes from a browser or an app. In summary, for an Android app to use certificate-based authentication with a backend service, it requires explicit implementation within the app to handle such authentication. The app must be programmed to select and use the appropriate client certificates, which can be a more complex process compared to browser-based access. It seems that I wouldn't be able to select the certificate in that case, so no communication with the service behind nginx could be established and so also no app-based authentication would work. ---------------------------------------------------------------------- lilolalu · 2023-11-20 10:39 >It seems that I wouldn't be able to select the certificate in that case, so no communication with the service behind nginx could be established and so also no app-based authentication would work No, it means that you would have to check on a case by case basis. The apps CAN (and probably should) support it. But not all of them do. I.e. the Homeassistant app supports client certs, nextcloud android app is just getting this, jellyfin app doesnt. So at the end it depends on what you are using. ---------------------------------------------------------------------- Soraster · 2023-11-20 10:53 Sadly I need a general solution for all kinds of services, as I don't know yet, what services I will need in the future. ---------------------------------------------------------------------- lilolalu · 2023-11-20 10:55 If its just for protecting your personal access, setting up a wireguard server probably is the the easiest soliution then. If you run a firewall, PFSense has VPN Servers (wireguard, openvpn) built in via plugin. ---------------------------------------------------------------------- kring1 · 2023-11-20 11:38 That's what a firewall is for. Whatever you use to terminate the a Wireguard network should also be able to configure firewall rules. And you should segment your home network. ---------------------------------------------------------------------- from-nibly · 2023-11-21 02:13 This is inventing security. Which is generally a bad idea. If you are worried about someone being able to hack you because their up isn't blocked you are saying that your security is wholly hinging on the thing that updates your allowed IP restriction. Which itself has no IP restriction (it can't cause how else would it work). And you are hoping that the security on that endpoint is WAAAAY better than something like a firewall