Secure network for self hosting. reddit / selfhosted ---------------------------------------------------------------------- simen64 · 2023-11-27 08:17 I want to get into self hosting. I now have an Asus ZenWifi Pro ET12 router which i think is one of the more top of the line Asus routers. But now as i want to get into self hosting, should i switch it out for a mini PC like the topton j6412 which i have been looking at. Will this provide better security and speed. Or will it just make it slower and more unreliable? ---------------------------------------------------------------------- stupv · 2023-11-27 10:17 A custom router is not one of the first things I would recommend building if you're just getting into self hosting ---------------------------------------------------------------------- dev_all_the_ops · 2023-11-27 11:57 Do you care about results? Or the process? If you just want to access your own stuff; install tailscale. If you want others to access it; look at Cloudflare tunnels You _could_ go old school and do the port forwarding/DMZ dance, but I don’t recommend it because it’s easy to make a mistake and do it insecurely. ---------------------------------------------------------------------- nicktids · 2023-11-27 12:33 Came here to say cloudflare tunnels Used to port forward and this is just safer ---------------------------------------------------------------------- AlanC-137 · 2023-11-27 13:07 Cloudflare tunnels are free? For a small application page ---------------------------------------------------------------------- Simplixt · 2023-11-27 13:15 You have a WiFi 6E Mesh, that's awesome, would be really stupid to replace it. However, you could look how to combine the Asus WiFi Mesh with a self- hosted firewall. E.g. using a OPNsense-VM as Gateway / DHCP / DNS server für all clients in the network .. But that's more for playing around. ---------------------------------------------------------------------- dev_all_the_ops · 2023-11-27 14:26 Yes, here is a tutorial on how to do it: https://youtu.be/ey4u7OUAF3c?si=T9oTeCeJCqib6Dxm ---------------------------------------------------------------------- simen64 · 2023-11-27 15:53 So the asus router offers enough secuirty for self hosting, even with exposing things through nginx proxy manager? ---------------------------------------------------------------------- Simplixt · 2023-11-27 15:59 Of course, if you would rent a VPS, you wouldn't have a firewall at all. The asus router controlls, that just the port e.g. 443 is exposed to your application host. Now you must secure your application host via e.g. Crowdsec and forward authentication. In the best case, your are not using port forwarding at all, but only a VPN to connect to your home network. ---------------------------------------------------------------------- zerorendan · 2023-11-27 16:21 How safer is compared to tailscale ? ---------------------------------------------------------------------- SuicidalSparky · 2023-11-27 17:26 Tailscale is for you to access your own stuff. CF tunnels is for others to access your stuff. Ofc you can do whatever you want but generally that would be the intention. I use a CF tunnel to allow access to my Plex media requests system which is powered by Ombi which I host locally on the Plex machine. ---------------------------------------------------------------------- zerorendan · 2023-11-27 17:33 Thanks for clarifying ---------------------------------------------------------------------- gringo_9210 · 2023-11-27 23:22 The choice of router doesn't do much as most if not all consumer-grade home routers these days have built-in firewalls enough to block most intrusions on network without open ports. If self-hosting a website at home then make sure to secure the two opened web hosting ports (TCP port 80/443) with UFW, Fail2Ban, or even Port Knocking on for ex. Linux. Don't forward but limit access (locally) to SSH port. Encrypt your DNS (DoH, DoT, etc.) at home by running either AdGuard Home or Pi-hole. Also proxy DNS via Cloudflare & make sure to use full (strict) end-to- end SSL encryption (DNSSEC enabled). Use stronger security headers & SSL encryption parameters (minimum TLSv1.2, SSL ciphers, stapling & ECDH curve, etc.). Use a software firewall on your websites such as Wordfence, Sucuri, or BBQ Pro on Wordpress. Don't overkill with your network setup. If you're just gonna be running a website that serves primarily cached or preloaded static pages then it's no use spending hundreds of dollars for it. Even a wireless Rasp. Pi Zero W is an overkill for such a setup. ---------------------------------------------------------------------- Silencer306 · 2023-11-28 08:30 So I need to run both tailscale and CF tunnel right? I have a plex server I will share with family. Can they also use tailscale? Like whats the difference between the two? ---------------------------------------------------------------------- SuicidalSparky · 2023-11-28 08:36 Tailscale is like a vpn and it allows you access into your network in pretty much the same way. Your family/friends just need Plex to watch you media. They don't need SSH access to your stuff remotely. You also don't need cf tunnel just for Plex. I use cf tunnel because I run a request website which I host locally on the Plex machine. I don't have a static IP and so the easiest way to expose it was using cf tunnel linked to my domain. ---------------------------------------------------------------------- Silencer306 · 2023-11-28 16:19 So cf tunnel basically restricts access to specific apps I select ---------------------------------------------------------------------- SuicidalSparky · 2023-11-28 16:22 I don't know all the uses however I have a domain with cf which points to a local ip/port on my home network. It achieves that by utilising the tunnel similar to a vpn. You run the tunnel software on your host machine and it directly connects to your cf account where you configure the ip/port you want it to point at. It doesn't just point to an app or piece of software. ---------------------------------------------------------------------- Silencer306 · 2023-11-28 16:29 Thanks gonna check it out