Reverse Proxy only allowing DynDNS-IPs as alternative to VPN? reddit / selfhosted ---------------------------------------------------------------------- Simplixt 路 2023-11-30 23:19 Hi all, I have the following challenges: \- I have friends and family that want to access my services \- But they cannot / don't want to install any VPN \- But I don't want to open my services to the complete internet My idea: It's good enough, if they can access the services at home. They have internet provider with dynamic IP address. In the router, you easily set a DynDNS-Service. So: Why not just have a rule, that only allows connections of the IP- addresses of the DynDNS-Domains. Of course, the proxy/firewall would recheck the DNS entry regulary. Someone has tried such a setup? What solution are you using? Do you think it's similar secure as a VPN? (of course HTTPS connections only via Letsencypt cetificiate) ---------------------------------------------------------------------- ericesev 路 2023-12-01 00:56 I think that's a solid idea. Unless you have users on mobile devices, then it could get tricky as their IPs are likely shared with a lot of folks on the same mobile network. FWIW, I just add authentication to the reverse proxy and open it to the internet. Only those with accounts can actually login and access the services behind the proxy. Just keep the reverse proxy updated (standard advice for any service). ---------------------------------------------------------------------- IllegalD 路 2023-12-01 09:43 It sounds like your friends and family are actually the administrators of your network 馃榿 ---------------------------------------------------------------------- Simplixt 路 2023-12-01 11:07 Haha, for my parents it's better to change an unvisible setting in the router, instead of placing a raspberry pi in their network or installing WireGuard on every device. They are paranoid with any software that must be installed :D ---------------------------------------------------------------------- Simplixt 路 2023-12-01 11:09 I just set it up with my opnSense-Firewall. Was quite easy, just need to set an "Host"-Alias with the DynDNS- Domain, and put it in the port forwarding rule. The DNS info of the Alias is refreshed every 300 Seconds, so there might be 5 Minutes downtime every night when the routers reconnect, but that should be fine. ---------------------------------------------------------------------- zfa 路 2023-12-02 02:17 I've used similar before and worked just fine - just a shell script to open up iptables for the IP returned for a dyndns name. It ran and ran via cron for years just fine.