Running a public supertux cart server securely
reddit / selfhosted

----------------------------------------------------------------------
stefaniststefan · 2023-11-20 12:16

I want to run my own public supertux cart server since when i connect
localy with my friends if we are more than 2 ppl any other will time
out and noidea how to fix it so i thought this could be a opertunity
on how to secure a exposed server.

I watched the techno tim security video where he said to isolate it on
the local network then a local reverse proxy and a cloudflare one

So if i use it in a container is is restricted from the local network?
if no how do i do that and do i need a seperate reverse proxy that
only has acess to the one container in like a docker network and then
i expose the port and make it acesseable with duck dns and then look
into cloud flare

any more things i need to reseach and what ressources do you guys
recomend for me

----------------------------------------------------------------------
Lucasmalezan · 2023-11-20 16:14

sounds like you're in for a fun adventure running your own public
supertux cart server! i agree with the techno tim security video
suggestion to isolate it on the local network and use a local reverse
proxy along with a cloudflare one. as for running it in a container it
should restrict access from the local network but setting up a
separate reverse proxy with access only to that container within a
docker network sounds like a good idea. exposing the port and making
it accessible with duck dns and looking into cloudflare will
definitely add an extra layer of security. keep researching and don't
hesitate to ask for resources from the community. good luck!

----------------------------------------------------------------------
stefaniststefan · 2023-11-20 16:25

how do i isolote docker networks any good resourches is should know
before diving in and thx

----------------------------------------------------------------------
R0NAM1 · 2023-11-20 23:26

A good strategy for having a publicly accessible server that is still
'private' is to forward a port to the internet from the machine that
runs SuperTux server on your firewall/router combo, BUT put it through
whitelist based access control (ACL), then whenever your friends want
to play they just give you there latest IP address
([ifconfig.me](https://ifconfig.me)) and you update the firewall to
allow them. Usually this presents to any remote host as a
closed/filtered port that the firewall just drops packets for unless
the IP matches.

Although I don't recommend security through obscurity by itself, it
would be terrifyingly impressive for an attacker to somehow know the
specific whitelisted IP addresses and forge them to even get a return
packet. I do the same thing with a bedrock server for switches and
other less-then-configurable by network devices and it works very
well.

​

What router/firewall combo do you use, any custom firmware? The only
way this could not work is if the router does not support it, if it
dosen't you should get a new router regardless, all in ones default
software is usually buggy and exploitable as hell.

----------------------------------------------------------------------
stefaniststefan · 2023-11-21 05:59

I use a isp router since i currenltly have my internet through
adsl+lte :/

----------------------------------------------------------------------
R0NAM1 · 2023-11-21 06:17

No LTE in my area, but I have ADSL as well, you can likey do 1 of 3
thing:
1. Put your current router into bridge mode, and buy a new router to
flash OpenWRT to it, or use an old PC with multiple NICS to run
OpnSense on it

2. Write OpenWRT to your current router if you actually own it

3. Go ahead and see if it supports whitelisting ACL anyways.

----------------------------------------------------------------------
stefaniststefan · 2023-11-21 06:29

I tried putting the thing in bridge mode but it doenst have one i cant
even change the dns server lol anyway my street is getting fiber rn
and then i can just use a old pc with pf sense as a router plugged in
to the fiber box and then host the server