Which services do you Port Forward? reddit / selfhosted ---------------------------------------------------------------------- archgabriel33 · 2023-12-18 20:02 For all the talk about using VPNs/Tailscale/Cloudflare Tunnels/SSH tunnels over port forwarding, I'm curious which ones are the services that you do actually port forward and why? For me it's just ResilioSync and Plex. ---------------------------------------------------------------------- Agile_Ad_2073 · 2023-12-18 20:05 Only port 443 for the reverse proxy :) ---------------------------------------------------------------------- archgabriel33 · 2023-12-18 20:06 Do you run Plex proxied through that? ---------------------------------------------------------------------- archgabriel33 · 2023-12-18 20:07 Do you run Plex proxied through that? ---------------------------------------------------------------------- Mintfresh22 · 2023-12-18 20:17 none ---------------------------------------------------------------------- Agile_Ad_2073 · 2023-12-18 20:17 Jellyfin and jellyseer ---------------------------------------------------------------------- Sheriff___Bart · 2023-12-18 20:39 I manually set up a reverse proxy server that I run web traffic through. The good part about it is you can have multiple sub domains that get redirected to different internal servers. ---------------------------------------------------------------------- chriso93 · 2023-12-18 20:40 Plex and VPN. Everything else goes through Cloudflare Tunnels which doesn’t need port forwarding. ---------------------------------------------------------------------- Square_Lawfulness_33 · 2023-12-18 20:47 Everything over a VPN running on a VPS. I have the T-Mobile home internet and I don’t get a public IP, so I can’t port forward. ---------------------------------------------------------------------- Eirikr70 · 2023-12-18 21:27 Nginx and my apps through 443, Mailserver through 2 email ports, Wireguard through Wireguard port, A TURN/STUN server through several TCP and UDP ports. ---------------------------------------------------------------------- Bill_Guarnere · 2023-12-18 21:33 I port forward only the udp port needed for connecting to my Wireguard vpn. I completely moved my self hosted sites to containers published with Clouflare Tunnel, I also avoid to expose any port on my LAN from those containers, cloudflared communicate with backend services throught docker networks, one for each service. I'm also moving all my company services to Cloudflare Tunnel/Access, in this way we will be completely free to move stuff on new sites and services without bothering about reverse proxies, NAT on firewalls, DNS and all those annoying things. Now we're leaving cloud (IBM Cloud, former Softlayer) and moving to rented servers on Hetzner, when we'll finish to move everything to Cloudflare Tunnel/Access + Cloudflare Rules (for rewrite rules, http headers rewrites, etc etc..) we'll be totally free, to migrate we have only to rsync files and directory and fire up services with docker- compose or kubernetes on the new site. ---------------------------------------------------------------------- Tiwenty · 2023-12-18 22:04 Nginx + Wireguard. ---------------------------------------------------------------------- mrhinix · 2023-12-18 22:22 Used to be 443 only for nginx reverse proxy. None at the moment. Currently remote vps with wireguard server and entire traffic goes thourgh this vpn tunnel. If I want to watch movies on jellyfin outside of my network - I can login to my router and open the 443 to have access though proxy. And i used to have everything through this proxy - *arrs, jellyfin, Jellyserr, unraid gui, bitwarden, guacamole, deluge, nzbget, pdf- Stirling and so on... Long term goal is router with opensense and automation in home assistant to open this port from HA interface. But I need to buy/change my router. ---------------------------------------------------------------------- Oujii · 2023-12-18 22:26 One port for Wireguard and a few for Tailscale so it can estabilish direct connections with my other site that is behind a CGNAT. ---------------------------------------------------------------------- ailee43 · 2023-12-18 22:29 Nothing. Cloudflare tunnels for everything. ---------------------------------------------------------------------- purepersistence · 2023-12-18 22:30 I could tell you but I’d have to kill you. ---------------------------------------------------------------------- sum_yungai · 2023-12-18 22:40 Only port 3389 so I can RDP to my Windows 7 workstation. ---------------------------------------------------------------------- Old-Assumption4984 · 2023-12-18 22:55 For me, 25, 80, 443, 465, 993, 995. For email inbound/outbound and web sites. ---------------------------------------------------------------------- esturniolo · 2023-12-18 23:18 0. ---------------------------------------------------------------------- MrDephcon · 2023-12-18 23:35 Just Plex, everything else goes through CF Tunels ---------------------------------------------------------------------- bem13 · 2023-12-18 23:42 SSH to my Raspberry Pi (with public key auth of course) and one port for my GPS tracker(s) to send data to Traccar. Everything else I access through Tailscale. The SSH is only used as a backup in case Tailscale dies or something. ---------------------------------------------------------------------- bpreston683 · 2023-12-19 00:23 None. I use Tailscale Funnel for any exposed services. I don’t even have Plex forwarded anymore. ---------------------------------------------------------------------- TuhanaPF · 2023-12-19 00:24 Plex and nginx. That's it, absolutely nothing else. ---------------------------------------------------------------------- housepanther2000 · 2023-12-19 00:45 I actually don't port forward anything. I have an NGINX reverse proxy in the cloud that reaches my home server via a WireGuard tunnel. ---------------------------------------------------------------------- nitsky416 · 2023-12-19 00:52 What host do you use for that? I've been wanting to set up something similar but everything seems super expensive ---------------------------------------------------------------------- housepanther2000 · 2023-12-19 00:56 It's not super expensive at all. Check out servercheap.net. They have a VPS that's like 4.50 a month. It's really all you need. ---------------------------------------------------------------------- Mr_SlimShady · 2023-12-19 01:02 Same, tho I’m more of a Vista type of guy myself ---------------------------------------------------------------------- Massive_Snatch · 2023-12-19 01:03 I lol'd. :) ---------------------------------------------------------------------- Accomplished-Lack721 · 2023-12-19 01:06 Fortunately it's protected with the following login: u: admin p; password1 No one ever guesses the 1. ---------------------------------------------------------------------- Business_Holiday_608 · 2023-12-19 01:09 Zero. Unless there's a DMZ I stay away from any of that with good reason esp with the amount of hypervisors everyone uses nowadays ---------------------------------------------------------------------- FabrizioR8 · 2023-12-19 01:15 go ask Shodan. /s ---------------------------------------------------------------------- Hulkenboss · 2023-12-19 01:30 So, I see some of you say you forwarded ports for Plex. I used to do that until I saw my router logs register a concentrated attack on my forwarded Plex port. Literally knocked my Internet out that day. Since then I disabled port forwarding to Plex and enabled the Relay setting on Plex. It lets my users still watch but it's bandwidth limited. Is there a method I'm not aware of that let's them stream full blast without forwarding ports? I do have a PIA sub and have it running interference between qBittorrent and the web via GlueTun in 2 docker containers, but that's all I've figured out so far. Thanks. ---------------------------------------------------------------------- JAP42 · 2023-12-19 01:35 I run a reverse proxy and forward 80 and 443. Run all the service behind the proxy. ---------------------------------------------------------------------- 4rt3m0rl0v · 2023-12-19 01:39 WireGuard only. I let that through to my Firewalla Gold router. It enables me to connect to my internal network, and from there, I can access anything I want. I don’t know why anyone would port forward anything other than a VPN protocol such as WireGuard. ---------------------------------------------------------------------- ex1tiumi · 2023-12-19 01:57 Wireguard and SSH on non standard port. ---------------------------------------------------------------------- ericesev · 2023-12-19 02:14 ssh, http & https. Technically I'm not port forwarding, these services are running on my router. ---------------------------------------------------------------------- wingerd33 · 2023-12-19 02:32 >Which services do you Port Forward? Nice try, China. ---------------------------------------------------------------------- TheCudder · 2023-12-19 02:50 Plex, Wireguard, Nginx Proxy Manager for everything else. ---------------------------------------------------------------------- digitalbydesign · 2023-12-19 02:54 Same ---------------------------------------------------------------------- ARJeepGuy123 · 2023-12-19 03:01 I reverse proxy Kasm and use that to access internal stuff. Also mesh central ---------------------------------------------------------------------- Budget-Supermarket70 · 2023-12-19 03:16 I run plex proxied through a reverse proxy. ---------------------------------------------------------------------- Budget-Supermarket70 · 2023-12-19 03:17 Why not just nginx? ---------------------------------------------------------------------- VviFMCgY · 2023-12-19 03:32 * 1194 for OpenVPN - legacy config, but old faithful just incase * Port 8000 for SSH with key auth to upload photos from my phone * 3389 for Duo protected RDP to a WS2022 VM * 80/443 to reverse proxy * 51821 for a site-to-site VPN to my VPS * 51820 sort of, its forwarded on my VPS for WG Clients * ICMP 4 and 6 allowed ---------------------------------------------------------------------- zfa · 2023-12-19 03:33 Just put Plex behind nginx on an obtuse subdomain (e.g. `q8nwbyru.example.com`). As long as you use a wildcard cert so that subdomain name doesn't get into the CT logs its incredibly unlikely anyone will hit it to see you're running Plex (as long as it isn't also your default site lol). Go as crazy as you like with the domain name as users never need to use it, plex handles all the what-lib-is-where behind the scenes. ---------------------------------------------------------------------- BouncyPancake · 2023-12-19 04:02 Minecraft, 7 Days to Die, ATS, and 443 for various web services ---------------------------------------------------------------------- TuhanaPF · 2023-12-19 04:20 As I understand, it's for Plex's end-to-end encryption. ---------------------------------------------------------------------- hekermon · 2023-12-19 04:48 only wireguard port ---------------------------------------------------------------------- bmn001 · 2023-12-19 04:51 You shouldn't manually forward anything other than your VPN. One port. That's it. ---------------------------------------------------------------------- Cavustius · 2023-12-19 04:54 I do. I only have 443 exposed (port forward) and that goes to my reverse proxy that is ngnix proxy manager on unRAID. Plex remor access is set up with 443 and the proxy url. ---------------------------------------------------------------------- faithful_offense · 2023-12-19 05:15 only wireguard. currently looking into how to make it even more secure and protecting it with 2FA ---------------------------------------------------------------------- zfa · 2023-12-19 05:15 Plex can be proxied through nginx just fine (ditto caddy, traefik etc). It's a fairly standard topology. ---------------------------------------------------------------------- TuhanaPF · 2023-12-19 05:29 Though Plex constantly gives the message of an unsecured connection to all users, and according to Plex, this means there's no end to end encryption. ---------------------------------------------------------------------- Charming-Molasses-22 · 2023-12-19 05:31 Ports 22, 80, 443 and a few VPNs. ---------------------------------------------------------------------- zfa · 2023-12-19 05:37 Then you have bad config. Loads of guides online but this is as good a place as any to start: https://www.plexopedia.com/plex-media-server/general/plex-nginx- reverse-proxy/ Any problems and you want to get it working post a support post on /r/plex and link me. More than happy to help troubleshoot with you. GL. ---------------------------------------------------------------------- ibfreeekout · 2023-12-19 05:43 Thank you for mentioning the strict setting with Cloudflare - always makes me worried when I see people recommending the flexible setting. ---------------------------------------------------------------------- nick_ian · 2023-12-19 06:07 Nothing, other than Wireguard. Once I connect to wireguard, I can access everything. I don't see the point unless you're trying to provide access to someone not tech-savvy enough to set up a VPN client connection. ---------------------------------------------------------------------- Manaberryio · 2023-12-19 06:08 53,80,443. Nginx proxy manager all the way and Adguard home TLS DNS locked to my phone IP range to have ad blocked on mobile everywhere without vpn. ---------------------------------------------------------------------- archgabriel33 · 2023-12-19 06:11 Why for adguard home? 👀 ---------------------------------------------------------------------- darklord3_ · 2023-12-19 06:12 Is there a tutorial for this, rn im still PFing but have npm alr setup for websites. I was just unsure of how to approach it with plex. ---------------------------------------------------------------------- archgabriel33 · 2023-12-19 06:15 Does it make sense to re-encrypt and proxy heavy Plex traffic though? ---------------------------------------------------------------------- archgabriel33 · 2023-12-19 06:16 ATS? ---------------------------------------------------------------------- archgabriel33 · 2023-12-19 06:21 Never heard about Duo, that looks interesting. I use JumpDesktop as it doesn't require port forwarding. ---------------------------------------------------------------------- archgabriel33 · 2023-12-19 06:22 What's the benefit?Plex traffic is already encrypted. ---------------------------------------------------------------------- archgabriel33 · 2023-12-19 06:28 Kasm looks interesting. Why that over any remote desktop software though? ---------------------------------------------------------------------- archgabriel33 · 2023-12-19 06:29 How do you secure the forwarded SSH? ---------------------------------------------------------------------- archgabriel33 · 2023-12-19 06:30 Doesn't Firewalla have wireguard running on the router directly? ---------------------------------------------------------------------- archgabriel33 · 2023-12-19 06:33 Wouldn't proxying Plex add in extra lag and heavy compute as your basically re-encrypting already encrypted content? ---------------------------------------------------------------------- ericesev · 2023-12-19 06:34 I do three things: 1. Disable password authentication in sshd\_config (below). 2. Use a ssh key stored on a Yubikey. 3. Enable AppArmor for sshd. ​ PermitRootLogin no ChallengeResponseAuthentication no PasswordAuthentication no UsePAM no PubkeyAuthentication yes ---------------------------------------------------------------------- archgabriel33 · 2023-12-19 06:34 Why not just use Cloudflare Tunnels at that point? 👀 ---------------------------------------------------------------------- archgabriel33 · 2023-12-19 06:37 Wouldn't proxying Plex add in extra lag and heavy compute as your basically re-encrypting already encrypted content? ---------------------------------------------------------------------- archgabriel33 · 2023-12-19 06:38 How do you deal with Plex then? ---------------------------------------------------------------------- AdrianTeri · 2023-12-19 06:39 None ---------------------------------------------------------------------- Charming-Molasses-22 · 2023-12-19 06:48 I do my self-hosting on a VPS. ---------------------------------------------------------------------- housepanther2000 · 2023-12-19 06:52 Cloudflare may cut you off if they detect video streaming. ---------------------------------------------------------------------- BouncyPancake · 2023-12-19 07:01 American Truck Sim\* Kinda forgot to just do the full name, my bad ---------------------------------------------------------------------- zfa · 2023-12-19 07:04 It'll add load obviously but negligible on modern hardware, and absolutely not noticeable to an end user. Encrypting and decrypting SSL is nothing like transcoding video which is what making users bounce through Plex relays forces. ---------------------------------------------------------------------- audero · 2023-12-19 07:17 None. ---------------------------------------------------------------------- archgabriel33 · 2023-12-19 07:21 They wouldn't detect it if you run it through nginx proxy though, right? ---------------------------------------------------------------------- Himent · 2023-12-19 07:54 Torrent outbound port, https ports for proxy, port for wireguard ---------------------------------------------------------------------- idee18554 · 2023-12-19 08:03 I thought the point was that way you only expose the reverse proxy authentication, instead of the likely less secure service like plex ---------------------------------------------------------------------- nicman24 · 2023-12-19 08:04 Ssh because if ssh is breached we are all fucked anyways and wireguard ditto ---------------------------------------------------------------------- SurKaffe · 2023-12-19 08:16 443 and VPN for everything else. Running Fail2Ban on all foreign IPs. They have no business on my server. ---------------------------------------------------------------------- r3tryfail · 2023-12-19 08:37 I just moved it to 3390 ---------------------------------------------------------------------- localhost-127 · 2023-12-19 09:03 heretic ---------------------------------------------------------------------- archgabriel33 · 2023-12-19 09:07 What if you travel abroad? 👀 ---------------------------------------------------------------------- no-fapping-way · 2023-12-19 09:09 I really hope there's a missing /s there ---------------------------------------------------------------------- Im1Random · 2023-12-19 09:12 How receive emails and host publuc websites through a vpn... ---------------------------------------------------------------------- no-fapping-way · 2023-12-19 09:13 Running Jellyfin, Plex etc from devices that don't have VPN clients (TVs), Game Servers, ---------------------------------------------------------------------- SurKaffe · 2023-12-19 09:20 I have VPN for that. ---------------------------------------------------------------------- archgabriel33 · 2023-12-19 09:24 Well, yes, but you said all foreign IPs are banned. So how would you connect to your VPN? ---------------------------------------------------------------------- SurKaffe · 2023-12-19 09:26 VPN is on my router, 443 services on another server. So VPN is not affected. Im hoping VPN is safe enough from hackers and exploiting. ---------------------------------------------------------------------- too_many_dudes · 2023-12-19 09:27 Just learned about STUN the other day. You have a Jabber server or something? ---------------------------------------------------------------------- tungtungss · 2023-12-19 09:33 My ISP does not allow port-forwarding, so also everything on my k3s cluster with nodeport, via Tailscale, connected to Headscale on local (same country) VPS. Also exposed publicly with nginx proxy manager. Satisfied enough with <8ms ping when pinging with Tailscale for 4usd/mo 😄 I wanna learn traefik though, also dunno if I should integrate CDNs (like bunnyCDN) hoping it can accelerate static assets further ---------------------------------------------------------------------- AshKmo33 · 2023-12-19 09:36 I forward ports 80 (HTTP), 22 (SSH) and 443. On port 443 I have both SSH and TLS (HTTPS) multiplexed using NGINX, which allows me to access my machine even behind strict public/organisation networks that block other ports and/or try to detect VPNs. Obviously I have enabled only public-key authentication for SSH, although I still use the standard port. ---------------------------------------------------------------------- Eirikr70 · 2023-12-19 09:44 I have a Matrix/Synapse server with the videoconference function. Just for the fun of it, and in order not to leave my metadata to ... Meta. ---------------------------------------------------------------------- cookies_are_awesome · 2023-12-19 10:14 For websites, use Cloudflare Tunnel, no VPN necessary. For email, no idea because I would never bother self-hosting a mail server myself. ---------------------------------------------------------------------- daYMAN007 · 2023-12-19 10:43 SSH HTTP/HTTPS Wireguard 1. -> Access to My Private Network Wireguard 2. -> Useable as VPN without giving out access to my internal network One is a to get access to my network (Via subspace) Also, seriously no one is exposing ssh? ---------------------------------------------------------------------- 7WuCF77S95mfQFvfwk7F · 2023-12-19 10:53 UDP 53 for wireguard. ---------------------------------------------------------------------- lomsucksatchess · 2023-12-19 11:06 nginx to serve a simple document and wireguard for all my services ---------------------------------------------------------------------- persiusone · 2023-12-19 11:33 I use a router/hotspot with built in WG for this when traveling, but none of my local devices need VPN to work for obvious reasons. ---------------------------------------------------------------------- xardoniak · 2023-12-19 11:38 Wireguard and Pterodactyl game ports are public facing. Wazuh and Portainer are port forwarded but traffic is only allowed in from my VPS. Everything else is CF tunnels ---------------------------------------------------------------------- xardoniak · 2023-12-19 11:39 Do you have a guide for this set up? ---------------------------------------------------------------------- kearkan · 2023-12-19 11:50 I only port forward for wireguard, just set up CF tunnels yesterday for everything else. ---------------------------------------------------------------------- Infuryous · 2023-12-19 12:46 Only Plex and SSH on a non-standard port. I uses SSH tunnels to access anything I need on my come network. ---------------------------------------------------------------------- bpreston683 · 2023-12-19 13:11 I let it work on indirect connection. I watch 98% of all my stuff local in my house. ---------------------------------------------------------------------- guptaxpn · 2023-12-19 13:14 This is likely true, although I'm not sure if their DPI might be able to detect that. I'd imagine the rate of data sent for 720/1080/4k streams is rather predictable, so even if it's encrypted they'd see 700/1-2gb getting transferred over the course. Of 60-90 minutes regularly enough. Idk if I'd want to bounce that through a commercial US agency. ---------------------------------------------------------------------- guptaxpn · 2023-12-19 13:17 Why apparmor? ---------------------------------------------------------------------- unofficialtech · 2023-12-19 13:26 Heavy is relative in something like the scope of CF's CDN traffic, and you are likely to be nothing but a drop in the ocean, but be aware that while they removed 2.8 from the umbrella TOS, the CDN-specific TOS for non-enterprise to state that you must use something like Stream for video content. ---------------------------------------------------------------------- Rakn · 2023-12-19 13:27 What do you gain from using cloudflare tunnels opposed to port forwarding? ---------------------------------------------------------------------- hillz · 2023-12-19 13:30 None I use cloudflare tunnel ---------------------------------------------------------------------- jhacked · 2023-12-19 13:34 Why expose port 443 when you can just expose a VPN tunneled access port that let you access everything from outside including the reverse proxy to provide SSL certs to self hosted apps? ---------------------------------------------------------------------- smittayyy · 2023-12-19 14:20 You gain security benefits from not exposing ports directly on your perimeter. The services will be exposed through cloudflare so there would need to a security hole on cloudflares side for the security risk. ---------------------------------------------------------------------- ARJeepGuy123 · 2023-12-19 14:20 It's self hosted (though not open source) and really nicely done 🤷🏻‍♂️ ---------------------------------------------------------------------- ozzeruk82 · 2023-12-19 14:21 I would like to do 'Wireguard 2', how are you configuring it to make this work? I already have 'Wireguard 1' which I use on a daily basis and has worked flawlessly for 5 years. That's why I don't want to mess with the settings though without being sure! ---------------------------------------------------------------------- ozzeruk82 · 2023-12-19 14:23 It's great to see that far more people seem to be just exposing one UDP port for Wireguard than say 4-5 years ago, back then a similar survey often seemed like only a few were using Wireguard. It's by a mile the safest way to do this and once setup in my experience has been exceptionally reliable. ---------------------------------------------------------------------- Wf1996 · 2023-12-19 14:28 Get a VPS, connect it via VPN or Tailscale, route your traffic through the VPS. Use a reverse proxy on the VPS or route the traffic to a proxy in your network. Only open the ports 443 and 80 on the VPS to the internet. ---------------------------------------------------------------------- Cavustius · 2023-12-19 14:38 This was the YouTube video I followed for the most part. [https://www.youtube.com/watch?v=h1a4u72o- 64](https://www.youtube.com/watch?v=h1a4u72o-64) Other than that it was a bunch of different articles, beating my head against the wall, watching it like 3 times until I understood it. For unRAID I had to leave docker containers set to bridge for my port forward to work, and I had to restart NginxProxyManger before it actually worked. In Plex under Remote Access I have port 443 in there, but there is a red X in there from my WAN Internet, but it works just fine, not sure why Plex doesn't like it. This step I am not sure if it was 100% necessary or not, because I think TV's just auto connect to plex? I never changed settings for my parent's TV or mine and it worked, but under Network I have custom server access URL's and then I have a [subdomain.mydomain.com](https://subdomain.mydomain.com) in there, but all that really is so I can go to my website and hit my cloudflare vs going to like [tv.plex.com](https://tv.plex.com) to watch, it is really the same thing. From that YouTube video I also set up Overseerr to use Nginx and have my Cloudflare Cert Let me know if you have more questions, I haven't touched this stuff in like 8-10 months since I set it up so kinda rusty. ---------------------------------------------------------------------- Cavustius · 2023-12-19 14:38 This is what I sent in another comment: This was the YouTube video I followed for the most part. [https://www.youtube.com/watch?v=h1a4u72o- 64](https://www.youtube.com/watch?v=h1a4u72o-64) Other than that it was a bunch of different articles, beating my head against the wall, watching it like 3 times until I understood it. For unRAID I had to leave docker containers set to bridge for my port forward to work, and I had to restart NginxProxyManger before it actually worked. In Plex under Remote Access I have port 443 in there, but there is a red X in there from my WAN Internet, but it works just fine, not sure why Plex doesn't like it. This step I am not sure if it was 100% necessary or not, because I think TV's just auto connect to plex? I never changed settings for my parent's TV or mine and it worked, but under Network I have custom server access URL's and then I have a subdomain.mydomain.com in there, but all that really is so I can go to my website and hit my cloudflare vs going to like tv.plex.com to watch, it is really the same thing. From that YouTube video I also set up Overseerr to use Nginx and have my Cloudflare Cert Let me know if you have more questions, I haven't touched this stuff in like 8-10 months since I set it up so kinda rusty. ---------------------------------------------------------------------- Acceptable-Jump-8332 · 2023-12-19 14:53 No port forwarding. Only Tailscale. ---------------------------------------------------------------------- Frostlike2816 · 2023-12-19 15:01 80, 443, Plex, 1194, SSH (with an explicit deny on my firewall everything that isn't a few select IPs), 8008 for Dendrite I think(?), a bunch of ephemeral ports for coturn and one for private torrent trackers. ---------------------------------------------------------------------- highly_confusing · 2023-12-19 15:03 convenience. ---------------------------------------------------------------------- ericesev · 2023-12-19 15:23 Cloudflare sees everything. They own the private key for https and decrypt it all. That's how their service works. ---------------------------------------------------------------------- daYMAN007 · 2023-12-19 15:46 Just setup subspace inside its own docker network. Then make sure with ip routes that connection from the ip range of subspaces to your internal ip range get dropped. ( I don't have it set up as like this as my secondary wireguard container is on a different host which makes the whole setup a little bit different.) ---------------------------------------------------------------------- kindrudekid · 2023-12-19 15:46 Only: * 443 - For HTTPS, as everything is behind reverse proxy * 853 - DNS over TLS for use on android phones for my parents and family. * Whatever port wireguard runs on... Though I rarely use it and dont think I should keep it open anymore but am lazy ---------------------------------------------------------------------- daYMAN007 · 2023-12-19 15:52 Or [https://www.reddit.com/r/WireGuard/comments/115tt2z/comment/j957jp j/?utm\_source=share&utm\_medium=web2x&context=3](https://www.reddit.c om/r/WireGuard/comments/115tt2z/comment/j957jpj/?utm_source=share&utm_ medium=web2x&context=3) Without docker ---------------------------------------------------------------------- jhacked · 2023-12-19 16:08 There is no convenience in that at all. With the configuration I'm talking about, you just enable the VPN connection (say on a smartphone) and then use the HTTPS URL (which is a local-only URL that runs through your own DNS server, something like Adguard or pi-hole). Is it the inconvenience of having to enable the VPN connection on your device? For so much more protection, that doesn't sound convincing. ---------------------------------------------------------------------- ericesev · 2023-12-19 16:10 I use it as a defense-in-depth strategy against unknown/unpatched flaws in sshd. It scopes/sandboxes sshd to only be able to access the things it needs in order to accept connections and authenticate users. A vulnerability in the server process would, in theory, be blocked by AppArmor because it causes sshd to do more than it typically needs. ---------------------------------------------------------------------- blentdragoons · 2023-12-19 16:11 i port forward 443 directly through my router. no external service used, nor needed. ---------------------------------------------------------------------- CC-5576-05 · 2023-12-19 16:27 Nginx = 443 ---------------------------------------------------------------------- chkpwd · 2023-12-19 16:35 Why 22? ---------------------------------------------------------------------- Charming-Molasses-22 · 2023-12-19 16:37 Why not? ---------------------------------------------------------------------- daYMAN007 · 2023-12-19 16:41 So you are port forwarding... just through a vps ---------------------------------------------------------------------- BlazingBane007 · 2023-12-19 16:45 But we still need a static IP right?. Or do we still need to have a port open for cloudflare? ---------------------------------------------------------------------- smittayyy · 2023-12-19 16:49 if you’re using a reverse proxy you need to expose that 443 port to a static private IP. You don’t need a static WAN IP. Cloudflare uses the tunnel id to basically map to your WAN so to speak. So if you’re accessing a friendly dns name over the internet it knows where that traffic needs to go ---------------------------------------------------------------------- ericesev · 2023-12-19 17:30 Why does the port matter? If an attacker is accessing a http service, it doesn't make much difference whether they do that through a cloudflare tunnel or through a port, correct? ---------------------------------------------------------------------- grandfundaytoday · 2023-12-19 17:31 So you can share with friends and family. Why else do you have plex? ---------------------------------------------------------------------- grandfundaytoday · 2023-12-19 17:35 It's easy to differentiate between a Linux ISO and a streaming video on a TLS tunnel. Cloudflare knows. ---------------------------------------------------------------------- ericesev · 2023-12-19 17:44 Indeed. The location of the port doesn't matter (cloud or local). An attacker has the same access to a vulnerable http backend service regardless of where the port is located. ---------------------------------------------------------------------- mcr1974 · 2023-12-19 17:45 that semicolon is making my eyes bleed. ---------------------------------------------------------------------- mcr1974 · 2023-12-19 17:47 I'd like to know this too. ---------------------------------------------------------------------- mcr1974 · 2023-12-19 17:49 I like this. if you have any further details, git repos, web links, I'd very much welcome them! ---------------------------------------------------------------------- BenReilly2654 · 2023-12-19 17:50 I don't forward any - I use [Ockam.io](https://Ockam.io) to access from known machines. ---------------------------------------------------------------------- raojason · 2023-12-19 17:51 Only WireGuard for me. Was using Cloudflare tunnels for a while but WireGuard just makes more sense for my purposes/use case in my opinion so I took them down. ---------------------------------------------------------------------- Nyucio · 2023-12-19 18:06 There are devices that you are not able to run a VPN on. How do you give them access to (for example) Plex/Jellyfin without exposing port 443? ---------------------------------------------------------------------- jhacked · 2023-12-19 18:09 That's how a VPN works. You expose one port and that's it, it's like you would be connected to your home network. From there, you access a local only URL configured into your DNS server meaning that you'll still access on a HTTPS port Plex, but you're able to do so only in your local home network and outside through the VPN tunneled access ---------------------------------------------------------------------- Nyucio · 2023-12-19 18:11 I know how a VPN works. You still need a VPN client. There are some devices where you can not run a VPN client. So no VPN connection. That's why you forward port 443. ---------------------------------------------------------------------- t1nk3rz · 2023-12-19 18:21 Port forward for my nextcloud, cloudflare tunnels for my vaultwarden and guacamole ( for my AD lab) ---------------------------------------------------------------------- jhacked · 2023-12-19 18:23 Oh yeah that case is fine, most times you can though 😀 ---------------------------------------------------------------------- SpongederpSquarefap · 2023-12-19 18:33 I have 2 rules that allow inbound traffic on my firewall - Allow from any to my WireGuard VM on UDP port 51820 - Allow ICMP from my parents router to my router No need for any others, sure a reverse proxy is fine but it'll get blasted with requests and I don't want to bother with that ---------------------------------------------------------------------- hhkk47 · 2023-12-19 18:33 In our country it's very rare for ISPs to allow their modem/ONU to be configured in bridge mode, and those that do might still put you in a CGNAT. I use 2 ISPs in a failover configuration -- one allows bridge mode, while the other does not (their support does not even have any idea what it is). Neither one provides static IPs unless you are a business customer. I primarily use Wireguard VPN, but if the main ISP goes down (or my dynamic DNS does not get refreshed properly), I use Cloudflare tunnels as a substitute. ---------------------------------------------------------------------- SpongederpSquarefap · 2023-12-19 18:33 Are you stupid? At least change the port so hackers can't get to you Everyone knows it's impossible for them to try and RDP when it's on another port ---------------------------------------------------------------------- SpongederpSquarefap · 2023-12-19 18:34 A "fun" speedrun to do is this - Make a VM in Azure - Give it a public IP - Keep the username as administrator and use a cracked password - Start the clock and see how long it takes to be owned ---------------------------------------------------------------------- hhkk47 · 2023-12-19 18:40 By default Fail2Ban will only ban an IP after a set number of failed logins (hence the name). ---------------------------------------------------------------------- katrinatransfem · 2023-12-19 18:42 Port 443 to HA Proxy, port 25 for email, and that's about it. ---------------------------------------------------------------------- katrinatransfem · 2023-12-19 18:43 You can proxy lots of different things on different subdomains. ---------------------------------------------------------------------- 4rt3m0rl0v · 2023-12-19 18:48 Yes, it does. I should have clarified that there's an ISP-supplied router, and then the Firewalla. It's the former that I had to configure to port-forward WireGuard traffic, so that it could get to the Firewalla. ---------------------------------------------------------------------- mcr1974 · 2023-12-19 19:00 the key info is the wireguard vpn. ---------------------------------------------------------------------- mjh2901 · 2023-12-19 19:01 The vast majority of my stuff is behind Cloudlare zero trust so there are no ports open. I have port 443 only open and pointing at NginX Propxy Manger, all with DDNS so the domain names are pointed to the correct IP address (again Cloudflare hosts the domains) I have 2 services that go through this. Jellyfin and Joplin Server. Jellyfin because streaming media through zero trust is a violation of their rules. I did at one point run it through zero trust but after a posting on Reddit led me to do some reading of their terms I stopped. Joplin Server because it's just easier. I have FileBrowser running through zero trust but I may change that in the future as I think it again is a violation of Cloudflare's terms of service. So for those of us that use cloudfared the only thing that really needs an open port is self hosted media streaming. ---------------------------------------------------------------------- gripfly · 2023-12-19 19:02 Actually, it's quite an interesting idea. I haven't gotten myself much into cybersecurity yet, as I was afraid of setting something up wrongly in my lab and then having to deal with some annoying virus. But with a cloud VM, I don't have to worry about any of that since there is no tunnel to my home network. Surprisingly, I never thought of it! Thanks! ---------------------------------------------------------------------- gripfly · 2023-12-19 19:04 Doesn't this have the drawback that one needs to trust CF to not inspect the data being transferred? ---------------------------------------------------------------------- gxjansen · 2023-12-19 19:12 You enable Tailscale and then just set the IP that Tailscale assigned to your Plex server as Custom Server Access URL in your Plex client. Works like a charm. ---------------------------------------------------------------------- smittayyy · 2023-12-19 19:19 Depending on how you set this up you can set up authentication prior to the site loading. So in a cloudflares instance you get hit with a cloudflare login before you even see the local application. Alternatively if you don’t use cloudflares authentication you can use something like Authentik or Authelia which prompts for authentication through that. ---------------------------------------------------------------------- SpongederpSquarefap · 2023-12-19 19:26 Even in your home lab it should be OK so long as the VM is in an isolated network that can't reach anything Yes sandbox escapes are possible, but it's unlikely anyone would burn one on your home infra Definitely safer to do it in the cloud ---------------------------------------------------------------------- Remote-Job-4940 · 2023-12-19 19:44 This is the way. ---------------------------------------------------------------------- llBooBll · 2023-12-19 19:51 Plex, WireGuard, qbittorrent :) ---------------------------------------------------------------------- oddllama25 · 2023-12-19 20:00 I use tailscale, cloudflare, and nginx and forward no ports. ---------------------------------------------------------------------- Ursa_Solaris · 2023-12-19 20:25 The amount of people who don't understand this on this sub is concerning. If there is a VPN connection between your local device and a remote server, that remote server is now on your LAN. ---------------------------------------------------------------------- xardoniak · 2023-12-19 20:44 So have you changed your port in Plex from 32400 to 443 and set an entry in NPM for plex.mydomain.com? I'm just struggling to grasp how you route all of the traffic via a reverse proxy :) ---------------------------------------------------------------------- Cavustius · 2023-12-19 20:47 Yes, in Plex at the Remote Access setting, I changed it from 32400 to 443, and I have an entry inside Nginx Proxy Manager for [plex.mydomain.com](https://plex.mydomain.com). ---------------------------------------------------------------------- ericesev · 2023-12-19 20:53 Many processors have instructions dedicated to encryption. So there is not much overhead. https://en.wikipedia.org/wiki/AES\_instruction\_set ---------------------------------------------------------------------- chriso93 · 2023-12-19 20:59 For Cloudflare tunnels you neither need to open ports nor do you need to have a static IP. You have an agent running e.g. as container that directly connects to the services you want to expose. There are a lot YT videos that can explain that better than I can. ;) ---------------------------------------------------------------------- BlazingBane007 · 2023-12-19 21:00 Please share one, I don't know what im doing know. Cant understand anything. ---------------------------------------------------------------------- Technerden · 2023-12-19 21:06 The main benefit here is if you cant open ports and/or have CGNAT (shared public ip). Apart from that it doesnt give any advantage that cant be solved other ways ---------------------------------------------------------------------- chriso93 · 2023-12-19 21:07 If the service you expose is vulnerable then you have a problem either way, that’s right. But with Cloudflare you don’t expose your very IP to the world to mess with it. Vulnerabilities in routers and firewalls are found every week andmy router surely wouldn’t withstand a mini DDoS bought by some 15 yrs old script kiddie. I personally think it has a lot advantages. One only has to trust Cloudflare ;) ---------------------------------------------------------------------- ericesev · 2023-12-19 21:18 I agree. I suspect this happens because folks focus on "open ports". They've been told that port forwarding is bad without being given an explanation as to why. FWIW: The advice "port forwarding is bad" actually has nothing to do with ports at all. Rather, it is meant to say providing access to the internet at large is dangerous for services that weren't designed for that purpose. Here's an example: Let's say I have an internal service running Wordpress version 1.0 from 2007. No matter the remote access solution, if everyone on the internet has access, it's going to get hacked. It doesn't matter if I forward a port to it, if I use a reverse proxy, or I use cloudflared; it's just plain unsafe to have open to the internet. [https://wordpress-1-0.domain.tld/dangerous- request](https://wordpress-1-0.domain.tld/dangerous-request) is going to be bad regardless of whether the port is open on your router, open on a VPS, or if the port is open on Cloudflare's or any other cloud provider's network. VPNs prevent this. They require an extra authentication step before allowing access to the service. Adding authentication to the reverse proxy, or enabling Zero Trust access controls in Cloudflare will similarly block these unsafe requests. ---------------------------------------------------------------------- IcyEase · 2023-12-19 21:25 hey dude, bro. port forwarding is like totally unhip these days, huh? but let me give you a lowdown on the real deal. VPNs, Tailscale, Cloudflare Tunnels, and SSH tunnels are just tunneling protocols that are soooo 2010s. Port forwarding, on the other hand, is like the OG tech from the 90s. It's way more secure and reliable, bro. You see, when you're using those fancy tunneling protocols, you're actually sending your data over some random servers controlled by big tech companies. That means they can totally sniff your packets anytime they want, bro. But with port forwarding, your data stays safe and sound on your own network, just between your devices. It's like having your own secure tunnel, man! As for the services I port forward, I've got my gaming console, like the PlayStation 5, all set up with port forwarding. It's like the ultimate lag-free gaming experience. I also port forward my Plex server because it gives me direct access to my media library without any hiccups. And hey, I'm not done yet. I even have my Raspberry Pi running a VPN server, and you know what? I port forward that too. So, to answer your question, I port forward anything that I consider important. It's all about that extra layer of security and control, dude. Plus, it shows you're actually tech-savvy and not just some sheep following the latest trends. ---------------------------------------------------------------------- ericesev · 2023-12-19 21:43 Cloudflare doesn't stop a DDoS against your IP. Nor does it do anything to protect your router/firewall. Your IP is still on the internet and you're still using the router/firewall regardless of if you're using Cloudflare or not. ---------------------------------------------------------------------- Agile_Ad_2073 · 2023-12-19 22:27 Why so arrogant in your question? I expose my reverse proxy because of two apps I want to offer to my father that leaves 3000km away and I don’t want him to have to use a vpn for that. All my self hosted services are behind twingate, that doesn’t even need any port forwarding…. ---------------------------------------------------------------------- jhacked · 2023-12-19 22:32 Hey didn't think I was resulting arrogant, my apologies. You say it doesn't even need port forwarding but you said you were port forwarding the 443? Have I misunderstood? ---------------------------------------------------------------------- Agile_Ad_2073 · 2023-12-19 22:34 Only 2 apps are being served outside via the reverse proxy. Jellyfin and jellyseer. All the other apps my father doesn’t need are not exposed outside ---------------------------------------------------------------------- KingAroan · 2023-12-20 01:06 None, I have a cloud VPS with tailscale and traefik. Traefik takes the requests that come in and send them through the tailscale VPN into my network. Hides my home IP and done it's all docker based on the host it's easy to burn and soon up a new one quickly. All my DNS records point to a central one so I just need to change the single IP and all services are back up. ---------------------------------------------------------------------- Biog0d · 2023-12-20 02:13 So why you even asking then if you know it all, just to say you know it? Lol smh ---------------------------------------------------------------------- jhacked · 2023-12-20 07:37 So why answering just with "convenience" without further explanation? I was just genuinely curious if there were reasons I was missing out. Guys I understood my posts sounded arrogant and I'm sorry, but you can't keep coming like this ---------------------------------------------------------------------- GolemancerVekk · 2023-12-20 09:20 That's not fair, Chinese scan bots already know what you forward better than you do. ---------------------------------------------------------------------- GolemancerVekk · 2023-12-20 09:29 They become completely dependent on CloudFlare services *and* allow CF to peek at everything they're doing through those tunnels. But it's worth it, because OP now saves $3 on the domain every year. Also they had a quick glance at the website and think free accounts benefit from CF's DDoS protection. Leaving aside the fact nobody will ever bother to DoS let alone DDoS them. ---------------------------------------------------------------------- GolemancerVekk · 2023-12-20 09:31 Typically, VPN done right is an outgoing connection not an incoming one. If they're still doing incoming VPN in today's day and age (other than as a learning experience) they're doing it wrong. ---------------------------------------------------------------------- GolemancerVekk · 2023-12-20 09:32 Yeah I was going to ask, why fail2ban and not an outright geoip block... ---------------------------------------------------------------------- feo_ZA · 2023-12-20 10:59 Me too, Plex and Wireguard. I don't understand why you need CloudFlare Tunnels though, when you already have the VPN? ---------------------------------------------------------------------- -eschguy- · 2023-12-20 23:02 443 for my reverse proxy (Caddy). ---------------------------------------------------------------------- archgabriel33 · 2023-12-21 02:24 What's Stream? 👀 ---------------------------------------------------------------------- archgabriel33 · 2023-12-21 02:29 Thats not correct. Plex data is encrypted and nginx encrypts it once more. So no, they wouldn't be able to see it. Whether they might be able to figure out it's video streaming based on pattern detection is another matter, but they wouldn't be able to see exactly what the data is. ---------------------------------------------------------------------- archgabriel33 · 2023-12-21 02:31 How does it work? 👀 ---------------------------------------------------------------------- archgabriel33 · 2023-12-21 02:32 Curious what the use case is 👀 ---------------------------------------------------------------------- unofficialtech · 2023-12-21 02:33 It’s their paid video streaming service (like a CDN/relay for live and on demand video) ---------------------------------------------------------------------- archgabriel33 · 2023-12-21 02:34 Why not just use the app? I never use the Plex web interface. ---------------------------------------------------------------------- archgabriel33 · 2023-12-21 02:37 Oh, I see. Funnel means your Plex traffic goes through the Tailscale servers though, right? Doesn't that slow down Plex? ---------------------------------------------------------------------- archgabriel33 · 2023-12-21 02:39 Yes, I'm aware of that. I'm just curious if it's worth it security wise. ---------------------------------------------------------------------- archgabriel33 · 2023-12-21 02:41 And you can use it for Plex? I thought that's more of a corporate offering. ---------------------------------------------------------------------- ericesev · 2023-12-21 05:09 If the reverse proxy is only for Plex, and it is configured as described "Plex handles all the what-lib-is-where behind the scenes as part of their authentication", then no, I don't think adding the reverse proxy improves security. Technically it makes it slightly worse since the attack surface is expanded to include the reverse proxy. The same wildcard cert could be added to Plex too. But I don't know Plex well enough to know if it will only allow the obtuse subdomain or just allow any subdomain. But IMO the random/obtuse host name provides hiding, not security; I wouldn't trust that to protect anything of significant value as DNS names get exposed by the browser and OS. A reverse proxy would add convenience if more than just Plex is being used. But IMO the reverse proxy only improves security if it adds an authentication step of its own. ---------------------------------------------------------------------- ericesev · 2023-12-21 06:06 >Thats not correct. Plex data is encrypted and nginx encrypts it once more. I'm not aware of any TLS or browser feature that permits nesting encryption like that. If Plex is doing something custom, please share details as I am genuinely interested in how they've done that. Each hop along the path decrypts the data and then re-encrypts before forwarding to the next hop. The browser, Cloudflare, nginx, and Plex all have access to the unencrypted content and each hop re-encrypts that content again before sending it to the next hop. The only way nested TLS/https encryption could work is if the browser is always using the certificate from Plex. That would mean the connection end- to-end encrypted between the browser and Plex. It is very easy to verify this. Check the fingerprint of the certificate when visiting Plex via the Cloudflare's https proxy, and check the fingerprint of the certificate when visiting Plex directly. If the encryption is nested/end-to-end you'll see Plex's certificate fingerprint in both cases. If the encryption is hop-to-hop, you'll see Cloudflare's certificate when connecting to Clouflare, Nginx's certificate when connecting to nginx, and Plex's certificate only when connecting directly to Plex. In Chrome, these are the steps to view the certificate & fingerprint: 1. Click the icon to the left of the domain name at the top of the browser. 2. Click the "Connection is secure" menu. 3. Click on "Certificate is valid" 4. The SHA-256 fingerprints will be at the bottom of the "General" tab. ---------------------------------------------------------------------- archgabriel33 · 2023-12-21 06:08 So you mean something like Authelia to protect Plex? Wouldn't that mean I can no longer use the Plex apps and I'm restricted to the browser? (I only use the apps personally never the browser.) ---------------------------------------------------------------------- archgabriel33 · 2023-12-21 06:15 I might be wrong. I don't use the browsere version, but I outright assumed that the Plex apps would verify for a TLS certificate coming form Plex and would refuse a Cloudflare one. Plex credentials would definetely not go through Cloudflare though as they go to the Plex servers. Plex handles the authentication on its own through its servers at both ends, so the only thing going through Cloudflare/nginx might be some temporary authentication/encryption tokens. ---------------------------------------------------------------------- ericesev · 2023-12-21 06:25 Yes, Authelia is one way. mTLS, where a certificate is added to your device, is another. I know Authelia breaks the apps. I suspect mTLS might not, but haven't tried it. I only ever use the browser; no apps on ChromeOS :) ---------------------------------------------------------------------- ericesev · 2023-12-21 06:30 >I outright assumed that the Plex apps would verify for a TLS certificate coming form Plex and would refuse a Cloudflare one. Oh that may be where i'm confused. It is entirely possible the app could do something custom like that. ---------------------------------------------------------------------- gxjansen · 2023-12-21 06:55 No: https://tailscale.com/kb/1094/is-all-traffic-routed-through- tailscale ---------------------------------------------------------------------- katrinatransfem · 2023-12-21 08:34 If it is anything like Jellyfin and Navidrome which I use, the App still uses the website behind the scenes. ---------------------------------------------------------------------- chriso93 · 2023-12-21 10:20 I know that my IP is on the internet; that’s how the internet works. But without it being connected to a domain name it’s less likely to be messed with believe it or not. No one targets random IPs on the internet but when there are obviously sites served then suddenly a ton of Chinese IPs are trying to access my IP. My firewall doesn’t lie ;) So I still think it’s not a bad idea. ---------------------------------------------------------------------- BenReilly2654 · 2023-12-21 13:00 Install it on both machines, do a little configuration to get them talking, and everything is encrypted end to end. Connections are initiated outbound on both sides and sent via an encrypted relay. So on my laptop I just point to localhost:port and I get the service on the Pi. ---------------------------------------------------------------------- raojason · 2023-12-21 16:51 Nothing special really. I'm just not sharing with anyone outside of my house so 24/7 exposure to internal services through a third party is not necessary. Remote access is always through my phone, tablets or one of my laptops. Also slightly easier to maintain with the pfsense integration. ---------------------------------------------------------------------- archgabriel33 · 2023-12-22 02:13 "The Funnel relay server establishes a TCP proxy to your node over Tailscale. This proxy serves as an encrypted relay between the Funnel relay server and your node. We use a relay server to send Funnel traffic between public devices and your node to ensure your node’s IP address isn’t exposed to the internet. Importantly, the Funnel relay servers do not decrypt traffic moving between public devices and your nodes exposed through Funnel, so Tailscale cannot see any information about the content being served." ---------------------------------------------------------------------- archgabriel33 · 2023-12-22 02:14 Oh, so it's like Tailscale? ---------------------------------------------------------------------- zabouth1 · 2023-12-22 10:51 Wireshark then everything goes over the VPN