Opening ports vs reverse proxying? reddit / selfhosted ---------------------------------------------------------------------- Dont_Blinkk · 2023-12-12 15:36 I am totally new to this but i've read that opening ports via port forwarding in your router is an old approach and that now reverse proxy is the way to go. I wanted to understand the differencies and why one is preferred/safer than the other. I mean i can't make that much of a mess if i just open a random port on a properly firewalled modem, or can I? ---------------------------------------------------------------------- flaming_m0e · 2023-12-12 15:49 > i've read that opening ports via port forwarding in your router is an old approach and that now reverse proxy is the way to go Well, if you're hosting the reverse proxy on your LAN, you will need to forward ports to your reverse proxy. The benefit of a reverse proxy is a centralized endpoint without having to worry about port numbers, a way to host multiple services on the same port, and a way to add SSL/Auth if the service behind it doesn't support. ---------------------------------------------------------------------- ElEd0 · 2023-12-12 16:15 I think that depends entirely on what you are hosting and how you want to access it. I use reverse proxy so that I can filter and redirect requests to their respective service based on subdomain, that way I dont have to remember and write ports in a URL bar whenever I want to access my services. For other services that I dont want to go through ports 80/443 I just port forward them in the router (SSH, XMPP, minecraft servers, etc) ---------------------------------------------------------------------- ex1tiumi · 2023-12-12 16:42 You can setup VPN for every device or something like Tailscale/Headscale, ZeroTier or Twingate. Those services mentioned create a layer network between devices and the service does routing. This way you do not need to open ports but every device has to have the client so you won't be able to connect from any random device. ---------------------------------------------------------------------- tech2but1 · 2023-12-12 18:15 It's not old vs new, it's 2 different approaches that have been around for a long long time. Hosting a reverse proxy at home has been beyond the average homelabber for a while but now with appliances/dockers etc of reverse proxies with GUIs or simpler command line options it's something that you can do yourself. Port forwarding was (and is) just easier, but less secure. Also it's not just about the port forwarding versus the reverse proxy, all depends what you have behind it. If you've got some IDS/other security (like say CrowdSec) then you're likely not going to see much difference either way realistically but similarly opening ports to a secured service isn't going to make that any more or less secure using either method. The reverse proxy may reduce the attack surface but at the end of the day the same bots are scanning the same IP it's just a different service responding (or not as the case may be). So short answer, it depends! ---------------------------------------------------------------------- treading9879 · 2023-12-12 19:59 That’s not quite the “right” question to be asking because they aren’t mutually exclusive. What you want to decide is: VPN or port forwarding. If it’s just you using the services then use a VPN. ---------------------------------------------------------------------- Ursa_Solaris · 2023-12-12 20:29 There are marginal benefits of port scanners seeing less ports open with a reverse proxy as you can take educated guesses at what services are running if they are using default ports. A reverse proxy will also not typically forward any traffic that is destined for your IP address directly and not a domain name, which will keep most of the riff-raff out as it's very difficult to reverse-lookup an IP to a domain record. These are useful obscuring techniques, and obscurity is a perfectly valid layer of security. However, this will mostly just reduce noise. As long as you're up-to-date on your patching and not doing anything extraordinarily stupid, these benefits are pretty small. They will not protect you from a determined attack targeting you specifically. If you forward ports directly, when you browse to that service, you'll have to manually type the port in every time. If you use a reverse proxy, the proxy will route your traffic to the correct port automatically based on the configuration. All of this only applies to web traffic, though. There's not much benefit to proxying non-web traffic. In most cases it's technically possible, but if you have any users it'll likely just cause confusion as they'll have to change the default port in whatever software. In those instances, you may as well just forward the port. ---------------------------------------------------------------------- Deadlydragon218 · 2023-12-13 02:22 I am still young in my years of network engineering. But nginx/apache have been around for a good long while. Both are capable of reverse proxying. Nginx being newer and easier to configure. Now one thing I would love to see built out by the open source community is a WAF, that seems heavily restricted by the industry as an “enterprise” feature. When it really should be considered as the next layer in web app security that everyone should have. ---------------------------------------------------------------------- Accomplished-Lack721 · 2023-12-13 04:39 Opening a random port means you're not quite as firewalled as if you don't. It's like opening a window in a house with great security. It's still a way in. The thing with opening ports is you want to be damn sure whatever is listening on those ports is safe. This usually means it has a good track record of its own, is using best practices like SSL for connections, only allows logins via very secure techniques (2FA, secure keys, etc). When you use a reverse proxy, the only ports opened up are the ones the proxy is listening on. Random jntruders scanning ports don't know what's on the other side of the proxy (say, your NextCloud), so they can't target it with service-specifjc known vulnerabilities as easily. The reverse proxy itself should have limited access to your data or other sensitive resources. The service behind it should only have access to the data and resources it needs. It's not the be-all end-all of security, but it's an important step. ---------------------------------------------------------------------- 7WuCF77S95mfQFvfwk7F · 2023-12-13 11:00 If you use a reverse proxy you have a single point of entry that is developed for beeing exposed to the internet. You have also have a single point of failure. Because of the single entry point you can run a single fail2ban instance and be more confidend that the service is more resistant against attacks. ---------------------------------------------------------------------- Bright_Mobile_7400 · 2023-12-13 12:09 That’s one thing I have been looking around for for ages and can’t find anything yet ---------------------------------------------------------------------- MaxxiK97 · 2023-12-13 13:42 For port forwarding you are telling your router "if someone asks for a connection on port X you send this straigt to device wwww.xxxx.yyyy." this way you are exposing your device to the world wide web. As long as the device is hardened and has no security issues (spoiler, it has) its all fine. The reverse proxy on the other hand stand in between as a middleman. You are telling your router "if someone asks me something, i will forward it to you". Then the reverse proxy gets the packages and asks your devices. Not forwarding, but actually asking in place of the external request. This way, you have to harden and secure mainly the reverse proxy. Your device behind the reverse proxy only talks to the proxy, no direct connection between any-external and any-trusted. Also you can Loadbalance and do a lot of other stuff on the reverse proxy, while port forwarding will just... you know... forward to one device. ---------------------------------------------------------------------- Deadlydragon218 · 2023-12-13 18:41 The closest “reasonably” obtainable WAF I have come across is cloudflare but that is a paid service and it doesn’t have the granularity or features I would be looking for and expect from a WAF, sadly we aren’t there yet.