Reverse proxy in the cloud reddit / selfhosted ---------------------------------------------------------------------- BinaryPatrickDev · 2023-12-15 03:46 I’m a bit skeptical of things like cloud flare tunnels and want to set up a Linode instance running a reverse proxy in the cloud. The idea is that I could host things on my local servers, and access them publicly without revealing my public IP. I’d run something like Traefik on the node and then poke a hole in the firewall for that IP only. I don’t want to expose a bunch of ports on my local network even if they’re IP restricted, so I’m thinking I could run another reverse proxy locally? Is double hopping through proxies going to lead to headaches? Also if everything is always TLS encrypted, would just using a cloudflare tunnel be any less secure? ---------------------------------------------------------------------- stephen_neuville · 2023-12-15 04:02 CDN engineer here by trade. Totally doable. You can set up a basic Varnish or nginx install on the linode to cloak your home IP and, if you want, do some caching. ---------------------------------------------------------------------- saizo80 · 2023-12-15 04:07 this is basically what i do. i use a tailscale network for my devices to interact with my server. tailscale lets you override local dns so i point that to my pihole and it gets sent through nginx to the endpoints. then on my linode i also have it set up on the tailscale network and its running nginx that forwards it to the appropriate endpoints ---------------------------------------------------------------------- flaming_m0e · 2023-12-15 04:13 I use Linode; run Caddy2, Tailscale, and Wireguard. I don't have to open any ports at home. ---------------------------------------------------------------------- BinaryPatrickDev · 2023-12-15 04:21 I’d definitely use Traefik because it handles all that and I’m the most familiar with it. Internet traffic won’t mind going TLS to a linode reverse proxy, then TLS to a local reverse proxy, then finally to the actual service? ---------------------------------------------------------------------- BinaryPatrickDev · 2023-12-15 04:22 That would require me to use tailscale as an exit node? ---------------------------------------------------------------------- flaming_m0e · 2023-12-15 04:23 Not for simply hosting ---------------------------------------------------------------------- dvoecks · 2023-12-15 04:25 I've had that running for quite a while. I'd say go the whole way and don't punch the whole in the firewall. Run a VPN between them. I did it with wireguard, and it's been _boringly_ reliable. ---------------------------------------------------------------------- stephen_neuville · 2023-12-15 04:32 Nah. All it cares about is a hostname match to a valid cert at the edge (in this case your traefik setup). We have lots of customers that have TLS just to our caches, then port 80 to the backend with an ACL to restrict traffic to only our IPs. ---------------------------------------------------------------------- MaxBroome · 2023-12-15 04:33 Same here, and if you set it up correctly with DDNS on your WG hostname you won’t have to worry about your home IP changing. ---------------------------------------------------------------------- chaplin2 · 2023-12-15 04:45 Egress bandwidth on VPS will cost you! ---------------------------------------------------------------------- xervir-445 · 2023-12-15 04:48 Can confirm, wireguard just works and has no drama. ---------------------------------------------------------------------- Manaberryio · 2023-12-15 06:20 Not doing this is unsecure? Asking as I have couple of services, IP restricted for most, and a web hosting from my home server. No issues so far for months. ---------------------------------------------------------------------- SillyLilBear · 2023-12-15 07:38 I would recommend a wireguard VPN and you don't need the cloud service at all. ---------------------------------------------------------------------- domanpanda · 2023-12-15 09:47 i'll share solution which i use for like 2 years or so: * proxy machine in my LAN has both internal address 192.168.0.250 and Zerotier (VPN) address [10.200.0.1](https://10.200.0.1) * service1.example.com is set to 10.200.0.1 in my Cloudflare DNS * when im outside of network, i connect to VPN (Zerotier) and my request to service1.example.com goes to 10.200.0.1 address and then proxy (nginx) forwards it further * when im inside my network my internal DNS (Adguard Home or PiHole or your router if it has such capabilities) overwrites service1.example.com with internal address 192.168.0.250, so requests go to this address. As you see no ports are opened/forwarded. Offcourse instead of ZeroTier/Tailscale you may set your own selfhosted VPN (wireguard? openvpn? l2tp?) and then you will have to forward VPNs port, but nothing more. You also would not have to set VPNs ip in DNS (you set 192...250 instead) if you'll allow your custom VPN to access whole network (forwarding enabled). Buit i prefer Zerotier/Tailscale solution because it's easier to setup, safer and more reliable (if your custom VPN goes down then you loose access) ---------------------------------------------------------------------- TBT_TBT · 2023-12-15 10:08 Many have flatrates or terabytes of traffic included. So no. ---------------------------------------------------------------------- jkirkcaldy · 2023-12-15 10:10 I use Tailscale between my VPS and my server. It’s invisible to the end user but makes the setup easier. ---------------------------------------------------------------------- TBT_TBT · 2023-12-15 10:11 Do you really want to expose those services publicly, so that everybody can access them, or is it only you who should be able to access those services? If the latter, Tailscale is enough. ---------------------------------------------------------------------- BinaryPatrickDev · 2023-12-15 10:47 Yea even linode’s base shared hosting is 1TB of traffic. That’s plenty for my needs. ---------------------------------------------------------------------- BinaryPatrickDev · 2023-12-15 10:50 It’s me plus family. I don’t want to have to manage everyone’s devices and I don’t want to have to worry about their laptop having direct access to things inside my network. It’s too effective at connecting machines. Can you only allow specific ports with tailscale? ---------------------------------------------------------------------- TBT_TBT · 2023-12-15 11:13 That would rather be a usecase for a VPN like Tailscale. You have to weigh in the risks of opening up your services to the whole internet (you will be attacked for sure) vs the inconvenience of working with VPN (Tailscale makes that very easy). If the family wants to have access to your services, they will probably "jump the hoop" of getting Tailscale. Getting an account is easy and free and you can share out singular servers from your Tailnet to theirs - you don't have to let them in your whole network. Yes, you can use [https://tailscale.com/kb/1018/acls](https://tailscal e.com/kb/1018/acls) to allow specific ports. You might want to consider using an internal reverse proxy with DNS based Let's Encrypt certificates (like [https://nginxproxymanager.com/](https://nginxproxymanager.com/) ) to translate "hostname:1234" to "[https://myservice.mydomain.tld](https://myservice.mydomain.tld)" without the need for ports and with a valid, secure SSL connection. But that is rather personal preference. ---------------------------------------------------------------------- Oujii · 2023-12-15 11:14 If they want to actually access their services without a VPN client they would and if they were considering CF Tunnels, I think that's likely. ---------------------------------------------------------------------- Oujii · 2023-12-15 11:17 > Can you only allow specific ports with tailscale? Yes. But if you don't want any headache at all, it's better to do your proposed setup or similar, like connecting your Linode instance to your home via a Wireguard VPN. If you use Tailscale, your family will have to install AND connect to the Tailscale client. You can also do the Linode > Home server connection through Talscale, but I'd advise just using Wireguard instead as it's a lot faster for this purpose. ---------------------------------------------------------------------- tillybowman · 2023-12-15 11:50 check out frp fast repay proxy. it’s a solution built for that. ---------------------------------------------------------------------- fdren · 2023-12-15 12:30 Autossh and systemd ---------------------------------------------------------------------- bpmbee · 2023-12-15 12:48 I second this! ---------------------------------------------------------------------- coolsingel · 2023-12-15 13:58 I do this with nginx as the proxy (digital ocean droplet), plus wireguard. It’s nice because I don’t need to keep track of my home IP and there’s a secure channel between the web servers and the proxy. ---------------------------------------------------------------------- Kaleodis · 2023-12-15 14:24 No. Just point the nginx proxy config to your tailscale ip and port. That's how I do it. Tailscale on server machine and VPS. ---------------------------------------------------------------------- nerdyviking88 · 2023-12-15 14:24 Did this in prod for years. Proxy landed on AWS, vpn'd back to onprem. Was solid as heck. ---------------------------------------------------------------------- semidog · 2023-12-15 14:40 Third this. I already had a reverse proxy in the cloud, and had multiple holes (about 10 or so) in my home router to allow the cloud instance (and only the cloud instance) to connect through. My ISP recently decided I don't deserve a public IP and put me behind a CG NAT gateway. So I just set up a wireguard tunnel from my home to the cloud instance, and voila ... Now I have all the services I had, but with a few bonuses: 1. All traffic out of my self hosted services is encrypted 2. No more holes in my home router. 3. No more DDns required. Wireguard does roaming very well ---------------------------------------------------------------------- eddyizm · 2023-12-15 15:38 Also just set this up using caddy and zerotier. ---------------------------------------------------------------------- timotheus95 · 2023-12-15 23:08 I am running that through a SSH tunnel between the servers instead of any holes. The local reverse proxy will have to forward the headers of the public one. Traefik has a simple forwardedHeaders option for this. ---------------------------------------------------------------------- ArtSchoolRejectedMe · 2023-12-16 02:03 Use wireguard as a VPN(don't forget to enable keepAlive). Then do port forwarding with iptables ---------------------------------------------------------------------- zeta_cartel_CFO · 2023-12-16 02:06 >don't punch the hole in the firewall Not to nitpick :) . But he's still going to need to expose the WG port externally. ---------------------------------------------------------------------- blind_guardian23 · 2023-12-16 09:00 No, instead of peer2peer you can use server/client. ---------------------------------------------------------------------- zeta_cartel_CFO · 2023-12-16 19:49 Ahh..I see what you mean. Have the WG server part on the VPS side and client on his home network. ---------------------------------------------------------------------- blind_guardian23 · 2023-12-16 19:58 yes, instead of "everyone connecting to everyone", its "all clients connect to vps/wg server" because it has a public IP.