What is the best/safest way of exposing my self-hosted apps to the web reddit / selfhosted ---------------------------------------------------------------------- Zhyphirus · 2023-12-28 23:29 Hello, Recently I've been reading hella stuff about DNS, domains, reverse proxies, VPS's, tunneling and so on... But I couldn't grasp the idea of how to actually do it. Currently, I have a pretty simple setup (i think), a few services on both my computer and an OrangePI, on my computer I have AirVPN (wireguard) that I use to forward two ports (plex and qbit for seeding), they are going out randomly. I was using AdGuard Home DNS Rewrite to make use of domains for local use only, but now I've transitioned to DuckDNS because I wanted to test out the SSL certs, still pointing to my local IP. And with that, I use Nginx Proxy Manager (the one with UI), to reverse proxy all of my apps to the correspondent IPs and ports. Is there any way to keep my current setup and still share some or all reverse proxied services to the internet? I'm not exactly sure, but I think I need to buy a domain too if I want to actually do this correctly, right? I'm fine with changing my current setup, just bear with me, since I'm no pro at this and may need some help while at it anyway, any advice is welcome, and please point out any evident problem with my current setup, like security risks and/or dumb decisions, thanks :) ---------------------------------------------------------------------- Shulya · 2023-12-28 23:32 I suggest using something like Authentik to secure your web apps with accounts and 2FA ---------------------------------------------------------------------- xardoniak · 2023-12-28 23:41 I proxy all of my stuff through a CloudFlare tunnel and I have it set up so MFA is required (done on CFs side) before access is granted ---------------------------------------------------------------------- siege801 · 2023-12-28 23:45 I've recently started using this. Previously I didn't have to open anything because I was only sharing services with household residents who had VPN access on their devices. But now I've opened a service to wider family through a CF tunnel. ---------------------------------------------------------------------- stringfellow-hawke · 2023-12-28 23:48 Suggested order of operation 1 - Don't do it (ie the trust no one plan) 2 - Only do it via a VPN/ZT-ish tunnel into your network. (ie the only trust myself plan) 3 - Reverse DNS w/ proxy over https like Cloudflare w/ proxy rules limiting access + firewall rules limiting connections from CF. (ie the cloud is just someone else's computer so why not my computer plan) 4 - Same as 3, but no proxy (ie the friends/family Plex plan) 5 - Make your firewall Swish Cheese and allow direct port access (ie the YOLO plan) ---------------------------------------------------------------------- Outrageous_Plant_526 · 2023-12-28 23:57 Cloudflare tunnels, tailscale, zerotier. Check them out. Just don't open up any ports on your router. ---------------------------------------------------------------------- Zhyphirus · 2023-12-29 00:02 My main goal currently is to share overseerr to my friends that connect to my plex so I can avoid them asking me for new media, of course there are other ways of doing this (and easier ways too) but I wanted to understand this type of stuff just because in my opnion it's really cool to learn it. But at the same time I didn't want to compromise my whole network opening holes on my firewall and/or port forwarding everything. Maybe the cloudflare option would be a good one, since I don't need to ask for my friends to do any type of configuration. ---------------------------------------------------------------------- Zhyphirus · 2023-12-29 00:04 How easy is the configuration process? Lately I've heard a lot of different opnions about the Cloudflare Tunnel, some recommend and others don't, since I'm doing more of a media server thingy I think it doesn't really matter where my stuff goes through. Do you mind sharing a simplified step-by-step on how you did it? or maybe a video/doc that you followed, thanks :) ---------------------------------------------------------------------- Zhyphirus · 2023-12-29 00:20 If I understand tailscale and zerotier correctly, my user in the other end would need to do their own configuration, correct? Cloudflare Tunnel open up to everyone, but is the most "secure" when opening to all the internet because of all the layers of security (I think so?) ---------------------------------------------------------------------- KingAroan · 2023-12-29 00:37 I use a cloud VPS with tailscale and traefik on it to route all my traffic without revealing my private IP. ---------------------------------------------------------------------- Zhyphirus · 2023-12-29 00:47 How much do you pay per month on your VPS? I know those can be quite expensive depending on the machine and location ---------------------------------------------------------------------- Outrageous_Plant_526 · 2023-12-29 00:54 I bought a domain and used it with Cloudflare. For each service I am hosting and want to make available I just configure a new subdomain. I have a full ESXi host so I installed the Cloudflare client on my Wireguard VM. I can pretty much access everything I want and to sharebit I just need to provide the subdomain. ---------------------------------------------------------------------- KingAroan · 2023-12-29 00:55 I use Hetzner and it's not too bad. I have two with them a cheap $5 a month management host for portainer that can only be accessed through VPN, then the proxy box I pay like $25 a month and get triple the resources as if I were to pay the same rate from digital ocean and way more bandwidth allowance. I can't complain about them at all. I only have it with so many resources because I am hosting a gitlab instance but I'm thinking of retiring it because I don't really use it much. ---------------------------------------------------------------------- Zhyphirus · 2023-12-29 00:59 ahh, got it, maybe this is going to be the way, I want to do something similar to this, just share some stuff that I'm hosting, it seems to be pretty straight forward that way ---------------------------------------------------------------------- Smooth_Report_8096 · 2023-12-29 01:04 Why is port-fowarding through the router not recommended? I'm genuinely trying to understand the cons of doing so... ---------------------------------------------------------------------- Outrageous_Plant_526 · 2023-12-29 01:06 The last thing I need to set up is to push everything through my reverse proxy so I can actually configure authentication for those services that don't have it natively. Each user would then have their own account access if somehow somebody figures out my domain and subdomains. ---------------------------------------------------------------------- Zhyphirus · 2023-12-29 01:08 Interesting, I'll take a look at my options and see what will be the 'best', so far Cloudflare tunnels seems to be a really solid option. And about the referral, if I do opt in the way of VPS's and use Hetzner, I'll send you a message, thanks ---------------------------------------------------------------------- Zhyphirus · 2023-12-29 01:12 One thing that I didn't quite understand yet, you can use both cloudflare tunnels and reverse proxy on your local machine? I thought once you picked Cloudflare tunnel, you didn't need reverse proxying anymore because they would take care of that now, and they already have the security layers for that, or am I mistaken? ---------------------------------------------------------------------- Outrageous_Plant_526 · 2023-12-29 01:18 The Cloudflare tunnel basically acts like a forward proxy. Once you have your account and the domain you configure the subdomain and then the actual IP and port on your home network. So when you go to https:// xxx.domain.com it hits the tunnel endpoint on the inside of your network and then forwards the traffic over to the internal IP and port. What I will do is configure each subdomain for the reverse proxy IP and it will grab the header, ask for authentication, resolve the subdomain, and forward the traffic to the correct IP. ---------------------------------------------------------------------- Ursa_Solaris · 2023-12-29 01:18 If you are the only person using your services, and you never have plans to let somebody else use it, then it makes more sense to use a VPN. Otherwise, if you have even one other non-technical person who accesses your stuff, you should just learn basic networking and security practices, and forward the port. But some people on this sub act like that creates a magic portal that lets demons into your home. ---------------------------------------------------------------------- Outrageous_Plant_526 · 2023-12-29 01:22 I should also add that a cool feature of cloudflare is it can make self-signed certificates appear trusted to the browser. ---------------------------------------------------------------------- Zhyphirus · 2023-12-29 01:28 now I kinda get what you are doing and how it works, it's a little blurry, but I feel like if I give it a shot I can manage it, it's nothing critical, so I can play around a bit ---------------------------------------------------------------------- shoesli_ · 2023-12-29 01:29 I use Cloudflare proxy together with Traefik reverse proxy to expose web services. For authentication i use Authelia, some services also require Google login before reaching my reverse proxy (Cloudflare access). I also have Wireguard for full TCP access to my server (rarely used) I recommend using Docker if you are looking to create a secure setup ---------------------------------------------------------------------- SDSunDiego · 2023-12-29 01:32 This sub really has a problem with nuanced advice about opening ports for apps. Its annoying. And telling people to "do don't it" just isn't helpful. Some of the replies are adding complexity and more layers which creates their own problems. Keep it simple. Install Overseerr, keep overseerr updated, use plex to authenticate for overseerr (admin account), have users use plex to authenticate to overseerr. Done. ---------------------------------------------------------------------- Outrageous_Plant_526 · 2023-12-29 01:33 The basic configuration is actually very straightforward. I mean literally there is like 2 text boxes and 2 drop downs to configure each subdomain. What I want to do with the reverse proxy is probably not necessary for most configurations but I also have some services hosted through docker so there are multiple networks internally. ---------------------------------------------------------------------- Zhyphirus · 2023-12-29 01:34 That's the idea, but to get the user to connect to overseerr I need to expose it to the internet first, no? ---------------------------------------------------------------------- chaplin2 · 2023-12-29 01:48 Couldn’t attackers bypass the Cloudflare and connect by IP address? ---------------------------------------------------------------------- Nestramutat- · 2023-12-29 01:53 The only real downside of forwarding a port (assuming you don't fuck anything up) is exposing your home IP. I've been DDOS'd once, so now all my traffic goes through a VPS and tunnel ---------------------------------------------------------------------- ChurchOfSatin · 2023-12-29 02:01 Isn’t it against cloudflares TOS to stream Plex? ---------------------------------------------------------------------- Zhyphirus · 2023-12-29 02:03 Not sure, but I'm not going to send anything plex related through the cloudflare tunnel, only overseerr for now, plex itself is being port forwarded, and I tell my 'users' to access [app.plex.tv](https://app.plex.tv) to access it. ---------------------------------------------------------------------- SDSunDiego · 2023-12-29 02:12 This sub and other internet resources parrot that opening a port = death to your network. Generally, Overseerr isn't going to be your problem especially since its open-source with lots of contributors. Your two greatest risks to your network is Plex and You. ---------------------------------------------------------------------- TenuredKarma1 · 2023-12-29 02:20 I want to jump this for clarity. I use a npm with forward 80 and 443 to nmp. With sub domain's, something.mydomain.com pointed to my static ip. I use the npm access list to authenticate myself and my wife to gain access to a couple services I run. Is this not enough? ---------------------------------------------------------------------- kangarootrampoline · 2023-12-29 02:34 [Here you go](https://www.youtube.com/watch?v=ey4u7OUAF3c) ---------------------------------------------------------------------- LexSoup · 2023-12-29 02:38 Simplest for local access with ssl: Setup a reverse proxy (npm for example). Request a ssl cert using a dns challenge (no need to open ports). Point your domain *.internal.yourdomain.com in your dns to your reverse proxy. In your proxy create a entry for your services. For example radarr. Point the reverse proxy entry for radarr to where radarr runs + port radarr runs on. Done, now you can access it locally with a ssl cert. For external access to overseer a simple cloudflare tunnel will do the trick just fine. ---------------------------------------------------------------------- Zhyphirus · 2023-12-29 03:04 Yep, after doing some more research on everything, I've come to the conclusion that this would be the best course of action. I've bought a simple domain for $9 (1 year), and configured everything to at least pass overseerr on a subdomain, everything seems to be working fine, now I just need to configure my domain in my NPM too, do something like you said \`\*.internal.domain\` and request an SSL cert, and I should be golden. I'll be going over my cloudflare setup and improving it to avoid any extra risks, but I guess I'm happy enough with the current result, even thought there were a lot of different opinions about this approach ---------------------------------------------------------------------- Zhyphirus · 2023-12-29 03:08 I've tried to do this earlier, before doing this post, but I couldn't figure out why it wasn't working, I had no domain, and I was trying to forward through the VPN because it was 'easier' and connect through my static IP, and it wasn't working. So I kinda gave up on that idea, after this post and some new attempts my setup with cloudflare tunnel seems to be working fine. ---------------------------------------------------------------------- krogue4 · 2023-12-29 03:32 What you need to understand is that even with cloudflare protection, you are still opening up your network to intrusion if the app you are serving has vulnerabilities. Cloudflare will help hide your IP, it will offer secure connections, DDoS, etc. you still run the risk of a nefarious person exploiting an app and using a remote code execution (RCE) which would provide access to your server. Cloudflare does employ a smart firewall to protect against common and known RCE, but this is limited to those that are known. [RCE protection on Cloudflare](https://www.cloudflare.com/learning/security/what-is- remote-code-execution/) This is why you need to keep your apps up to date, servers patched, and monitor your system for suspicious activity. You need to weigh the risk and decide if it's worth it to you. ---------------------------------------------------------------------- Zhyphirus · 2023-12-29 03:39 Got it, and I do understand that, for now, it looks like it's working fine, I'll search more on the matter and try to make it as secure (limited only to my knowledge) as possible tweaking, since anyone can actually just try to access my app hosted app, currently I did disable all type of logins on the app (allowed only controlled by me), so not that simple to get through it, only if there's a flaw on their part, and there's still the worry of DDoS, IP Leak (that should be minor since I'm still using the VPN) and many more. Thanks ---------------------------------------------------------------------- prince251 · 2023-12-29 05:34 I was, still am, in a similar predicament as you. I ultimately went with Cloudflare tunnels as well because everyone's fear mongering over opening ports. But Plex's remote streaming requires opening a port anyway so 🤷‍♂️. There's not really a way around that, is there? I know I could do Plex over Cloudflare tunnels as well but rather not get banned for it. ---------------------------------------------------------------------- d4nowar · 2023-12-29 05:43 I really love that you edited in your solution with steps. Kudos. ---------------------------------------------------------------------- reoccurcat · 2023-12-29 06:28 All the stuff I NEED to access over https is through authentik (you could use authelia but I took the easy way out lol) Everything else is through WireGuard ---------------------------------------------------------------------- arimhan · 2023-12-29 08:08 You need to firewall your server to only accept cloudflare IP range. ---------------------------------------------------------------------- DetectiveDrebin · 2023-12-29 08:09 Have them use your own chatbot on Discord. Check out Requestrr. Install it via docker. In this way you don’t need to expose overseer and they can request media. ---------------------------------------------------------------------- ParaDescartar123 · 2023-12-29 08:11 Don’t do it. Turn back before it’s too late. Use tailscale or similar solution. ---------------------------------------------------------------------- chaplin2 · 2023-12-29 08:19 Sure, but anyone can connect to Cloudflare with VPN. It’s a major company. I want everyone connection going through Cloudflare. ---------------------------------------------------------------------- arimhan · 2023-12-29 08:25 What do you mean ? If you firewall only the cloudflare ip, everyone will need to pass by cloudflare to connect to your home instance. ---------------------------------------------------------------------- Kevin68300 · 2023-12-29 09:13 what I did was setting up Cloudflared with a tunnel hitting my Nginx Proxy manager and wildcards. This way I can create new subdomains with specific apps locally, I do not have to set it up in cloudflare again, only in NPM. ---------------------------------------------------------------------- TheQuantumPhysicist · 2023-12-29 10:02 Oh, for the love of god... stop giving cloudflare so much power! Make your own VPN! It's not that hard! ---------------------------------------------------------------------- Zhyphirus · 2023-12-29 11:05 How would I do that, exactly? I've always seems people saying to use my own VPN, which honestly makes no sense to me since I don't understand how it would work. And another thing, when I do that, wouldn't my user need to connect to my VPN to tunnel into my home network and connect to any services? This wouldn't be interesting since I wanted a zero-config approach for my users so they don't get discouraged ---------------------------------------------------------------------- Zhyphirus · 2023-12-29 11:08 The problem with the tailscale solution is that only people that join that network would be able to connect to the apps, right? This wouldn't be ideal for me, maybe if I wanted to share something that only I wanted to connect over the internet I'll use zerotier or tailscale ---------------------------------------------------------------------- Zhyphirus · 2023-12-29 11:08 thanks :) ---------------------------------------------------------------------- chaplin2 · 2023-12-29 11:10 I have not used Cloudflare tunnels. Do you allow only one IP or the entire range of Cloudflare IPs? In the latter case, ---------------------------------------------------------------------- Zhyphirus · 2023-12-29 11:14 Yeah, a lot of controversial takes on this post, and a lot of people who say "don't do it" but actually don't explain further than the basics, so I'm kinda lost, Cloudflare Tunnel seemed like a good and simple solution to my problem, if it's safe? Not sure at all, I'll be doing a lot more research to see if I'm compromising my local network at all by doing that. And about Plex, yea, there's no way around it, what people used to do (or still do) is use a VPS, but a good example is hetzner, it got banned and everyone went down (so I know). Also, I heard that a good way to prevent your exposed port from being discovered is by avoiding the default one 32400 and using a random one instead, I'm not sure if it actually matters but here are my 2c. ---------------------------------------------------------------------- Zhyphirus · 2023-12-29 11:16 For this to work, do you expose both ports 80 and 443, and it just simply exposes every service that is available on Authentik? And how exactly is the setup for WireGuard and exactly does it do for this config? I've never understood how people used WireGuard outside of private network servers, so confusing for me ---------------------------------------------------------------------- Void3d_ · 2023-12-29 11:59 But won’t you be banned on cloudflare for using their tunnels with Plex? ---------------------------------------------------------------------- Zhyphirus · 2023-12-29 12:00 I explained in another comment, for now only overseerr will be going through that tunnel, plex is being port forwarded ---------------------------------------------------------------------- kiwijunglist · 2023-12-29 12:08 Just install wireguard and open a single port for wireguard on the router, and then install wireguard on your phones etc. ---------------------------------------------------------------------- HurricanKai · 2023-12-29 12:15 Cloudflare Origin Pull is much better than Tunnels! ---------------------------------------------------------------------- AgogFox · 2023-12-29 12:24 Yes it is. You have to set the sub-domain for media server to DNS- only(gray cloud) ---------------------------------------------------------------------- kearkan · 2023-12-29 12:45 I've recently been looking at this, the section in the TOS pertaining to streaming media is no longer there. However there is a section warning off streaming our "perfectly legal jellyfin library" ---------------------------------------------------------------------- kearkan · 2023-12-29 12:47 What you're saying is fair enough, but remember you're the one taking the security risk. It's not skin off your back if they don't use it. Having to connect to a VPN is a small price to pay for access to the services you're providing. That's why companies all over the world do it for remote work. ---------------------------------------------------------------------- Zhyphirus · 2023-12-29 12:52 Yeah, makes sense, and other than that I guess anything related to exposing my services to the internet with no restrictions like VPN, proxies, etc. will be dangerous and can lead to some wonderful headaches. Honestly this was more of a study for myself than anything else, maybe I'll keep going that way or maybe if I find a better and safer way of doing this I may as well try it (or maybe just don't do it at all, who knows). ---------------------------------------------------------------------- TheQuantumPhysicist · 2023-12-29 12:55 There's a fair amount of work and things to learn. I've done it all, and I couldn't be happier. But again, I've been doing this for more than 10 years. It's not something you learn overnight. Take your time. First, a VPN is just a network interface you create when you connect through an app. When you connect, you get into a subnet, which shows up as a network interface on your device. If your (private) web services are reachable through a domain, such as `email.example.com`, and that resolves to your VPN subnet, say, 10.10.1.1, that's all you need, and you're done. So, the only condition to reach this level is to be able to connect to that VPN network. You give access to whomever is allowed to your network. So how do you connect to that VPN? Well, you create a VPN server, say with OpenVPN, and expose the UDP port that makes you connect there. That's all! Two options there: 1. Assuming you own a VPS, you run your VPN there, but then you're trusting the VPS because whatever network running in the VPS is accessible for your VPS. I fucking trust no one, so my VPS can access absolutely zero things from my network, but that's up to you. If you wanna go through that route, you have a fixed IP address, and you connect to your VPN through the IP address of your VPS or you buy a domain name, and make something like `vpn.example.com` resolve to that. This is very easy as a start. 2. Assuming you don't want to own a VPS or trust a VPS provider. In that case, you need to use some kind of dynamic DNS. [I wrote my own implementation of DynDNS to make my home reachable from anywhere](https://github.com/TheQuantumPhysicist/sam-dns-tools). I only expose the VPN port through my router. You can use any of the implementations of DynDNS out there, you don't have to use mine. Once you have your IP address bound to some domain, you just connect to that domain. The worst downtime you'll have is if your IP address changes, and you wait for your IP address to be updated. 3. (Bonus), the master/expert solution to have close to zero down time is to tunnel from a VPS to your network through a tunnel you create from your network to the VPS. This requires multiple VPNs (back and forth) with complicated firewall setup to prevent unauthorized access to your network from the VPS. But you can do this later. No need to start with this. Ask ChatGPT about many of this stuff if you need more help. I'm happy to help, but this needs more than just 10 minutes on reddit. I've been typing for 15 minutes. Good luck. ---------------------------------------------------------------------- Zhyphirus · 2023-12-29 13:10 Thanks for the through explanation, and trust me, I know home networking is no joke lol, I would say I probably know less than 1% of the basics. So far, since I only used stuff locally there was no problem in messing it up, but when opening stuff up to the internet it gets a bit more serious. For the sake of learning I'll probably use this approach that you explained for my private stuff, like Sonarr, Radarr, etc. So I can connect to my home network anywhere, but for the other part, where I want to share over the internet, I guess there's no way of doing it without actually exposing my self. I just need to be smart about it and tweak some stuff on cloudflare (which I'll need to research still) to make it safer for my self. And just to point out, I do understand your concern about the usage of Cloudflare Tunnel (part of it at least), I'm kinda paranoid with this stuff too, I don't really trust anything that claims to be a one click solution, it just feels weird and insecure, maybe because I don't know how it actually works and how all the stuff is being processed, for now I marked it as a solution to my problem because it worked, but I'll be going over some other things and maybe getting it work differently, I'll be updating this post if I come across anything new. Thanks ---------------------------------------------------------------------- kearkan · 2023-12-29 13:18 I'm on the same hunt looking to share jellyfin, it's looking like I'll just go the wireguard route. ---------------------------------------------------------------------- Zhyphirus · 2023-12-29 13:20 If you plan on doing only for your self when you are not in your home network, I would recommend doing that way, it seems to be the safest and easiest way, tunneling through a VPN ---------------------------------------------------------------------- AnApexBread · 2023-12-29 13:52 Cloudflare separate Warp, and pages IPs. They're different than he proxy range ---------------------------------------------------------------------- AnApexBread · 2023-12-29 13:55 This sub recommends not opening them because a lot of people don't know how to do it safely ---------------------------------------------------------------------- ChurchOfSatin · 2023-12-29 14:17 What does that do? Can you point me to somewhere I can read about this? ---------------------------------------------------------------------- AgogFox · 2023-12-29 14:36 DNS-only means Cloudflare will solely function as a DNS for that sub- domain and will not serve as a reverse proxy, routing your traffic through Cloudflare's servers for that sub-domain. It is a violation of the Terms of Service to proxy a **large** amount of non-HTML traffic (e.g. file, video, image). Here's the [blog post](https://blog.cloudflare.com/updated-tos) regarding the old Section 2.8 Limitation on serving non-HTML content, which has been relocated to a new [CDN-specific section](https://www.cloudflare.com/service-specific-terms- application-services/#content-delivery-network-terms). I'm still not 100% sure on this; if I missed any information feel free to correct me. ---------------------------------------------------------------------- Global-Orange-8423 · 2023-12-29 15:11 Ok, most of you say you should use Cloudflare tunnels. How do I expose for example a game server to the Internet? ---------------------------------------------------------------------- Zhyphirus · 2023-12-29 15:19 Easiest/safest way in my experience was using a VPS and running the game server on a docker container, I did it for valheim, the only problem is that its quite expensive dependending on how strong the server needs to be. Or, if you don't want to deal with it, maybe directly exposing the port for a short period of time should be OK, there are other options too, like zero tier, tailscale or wireguard for tunneling to your home network which requires a bit more of configuration on your part and your friends would need to setup it too to connect. Now I'm not sure how this would work with cloudflare tunnel, since I'm running web services it works nicely with it, but a game server I have no idea, googling about it would probably yield better results ---------------------------------------------------------------------- Ursa_Solaris · 2023-12-29 16:14 If you have a reasonable expectation of a DDOS, that's completely fair. If I ever hosted something that I expected to share publicly, I'd probably do the same. But at the end of the day that's still forwarding a port into your network, you're just doing it across a tunnel. ---------------------------------------------------------------------- stringfellow-hawke · 2023-12-29 16:51 I think a CF proxy w/ reverse DNS is about as safe as you can allow outside access. Then you can put rules on the CF side using their threat score thingy w/ geoblocks. You could even limit access down to your friend's specific IP or ISP's sub net. Then put rules on your firewall to only accept IPs from CF. They publish that somewhere. That way, no one can try to get around the CF proxy if they somehow know your IP some how. It's not bulletproof, but you would need a seriously determined actor to get in there. And even then, they will find themselves only at Overseerr's front door and needing an exploit to get past Plex (or local) authentication, and even then, presumably, you're running it in a container with restricted volume and network access. ---------------------------------------------------------------------- bazpaul · 2023-12-29 17:05 Awesome. Thanks for the write up. How much does this cost? And is it fast? Like do the web pages load quickly? ---------------------------------------------------------------------- Zhyphirus · 2023-12-29 17:08 So far, I only needed to buy a domain, $9, as for any other services free so far since I'm doing this for personal usage and everything is pretty fast for being free ---------------------------------------------------------------------- psychobobolink · 2023-12-29 17:10 Cloudflare tunnels with their Access (ZTNA) ---------------------------------------------------------------------- bazpaul · 2023-12-29 17:10 Wow that’s cool ---------------------------------------------------------------------- Remarkable-Host405 · 2023-12-29 17:13 what if overseerr has an exploit that can allow someone to get into your overseerr container without logging in and exploit code? ---------------------------------------------------------------------- Remarkable-Host405 · 2023-12-29 17:15 just want to point out that my isp uses cgnat, so cloudflare tunnels are the only way, can't port forward. and there is a real risk of hacking any website, overseerr source in on github, the setup is only as secure as the weakest link. basically trusting that overseerr is unexploitable. ---------------------------------------------------------------------- Zhyphirus · 2023-12-29 17:26 I was thinking about that too, so I set up in the Zero Trust dashboard some policies in Access→Applications, now only a handful off email can log in on the OTP, it's similar to a nginx basic auth (not that familiar with that so not sure how it works) or something like that, but handled by Cloudflare. Now, if someone goes to my domain, they need first to input their email and input a code that goes to that e-mail only if that e-mail is in my policy, honestly, that seemed good enough for me. But if that has an exploit too, then I'm fucked, lol ---------------------------------------------------------------------- mod1fied · 2023-12-29 17:37 Using Nginx Proxy Manager with a Fortigate firewall. Blocking by: -Geography -Threat Intelligence like abuse.ch -Crowdsec CTI -Fortigate IPS in place with 24 hour quarantine and a DoS policy to filter connections. Could I use a VPN only? Perhaps, but the convenience with Nextcloud and pulling media requests remotely outweighs the simplicity for the non tech savvy in my life. ---------------------------------------------------------------------- Remarkable-Host405 · 2023-12-29 17:59 that's amazing, i feel much more secure with that in front of website ---------------------------------------------------------------------- sh4hr4m · 2023-12-29 18:03 can anyone explain me how can I exclude a path from the application domain in cloudflare? i have the filebrowser which has the sharing function and for each file that I share it creates a link like this https://myapp.mydomain.com/share/[randomuid] but If I send this link to some one he or she needs to have my credentials of my cloudflare application in order to can download the file 😢 ---------------------------------------------------------------------- reoccurcat · 2023-12-29 18:25 Only ports 80 and 443, the reverse proxy I run (Nginx Proxy Manager right now, considering traefik in the future) handles all the forwarding stuff. The WireGuard setup is pretty close to default for me, I have the port 51820 forwarded on my OPNsense and it gives me access to my LAN. It helps because sometimes I don't want to expose things that don't need to be exposed (even with Authentik) because if you expose something to the internet, there's always the **chance** that a zero-day will be released and you'll get exploited. The VPN is used so that I can get to those services that I really don't need to be directly accessible using the web. ---------------------------------------------------------------------- CactusBoyScout · 2023-12-29 18:54 NGINX with an auth provider like Authentik also seems pretty secure? ---------------------------------------------------------------------- CactusBoyScout · 2023-12-29 19:04 Can someone help me understand why Cloudflare tunnels are preferable to NGINX? Fairly new at this ---------------------------------------------------------------------- Zhyphirus · 2023-12-29 19:09 Not an expert, but I can say from experience is that cloudflare tunnels are quite easy to setup compared to nginx, I know people are gonna disagree but that's how I felt at least, and if you want to use nginx, you will need to expose ports from your machine, while cloudflare tunnel you don't, you are still exposing something but not exactly ports. In the end, they work kinda similar, and you maybe need to use cloudflare or something else to register a domain and dns records, but that's another history. Even after configuring cloudflare tunnel, I'm still using nginx proxy manager to reverse proxy my local services to an internal subdomain just for the sake of simplicity, but every case is unique ---------------------------------------------------------------------- CactusBoyScout · 2023-12-29 19:14 Could I still use Authentik with Cloudflare? I do like having a single authentication system for most of my self-hosted software. ---------------------------------------------------------------------- Zhyphirus · 2023-12-29 19:16 Oof, nor sure, I've seen some comments about it, but since I don't use it, I can't really help you ---------------------------------------------------------------------- Ursa_Solaris · 2023-12-29 19:26 If you're stuck behind CGNAT then you have no choice but to use a tunnel of some kind, that's true. You can still rent a cheap VPS, connect it to your server via VPN, and run a reverse proxy on it, pointed at your real server. And while it is true that you're only as secure as the weakest link, as long as you don't make yourself easily found (only forward 443, put everything behind a reverse proxy, only use subdomains, with a wildcard DNS record and wildcard cert) you are *highly* unlikely to be attacked unless you somehow attract attention. Almost all exploitation of that sort is automated these days, and automation can't use intuition to locate things, it can only follow scripts and rules. ---------------------------------------------------------------------- Remarkable-Host405 · 2023-12-29 19:35 cloudflare tunnels are free, vps is not. i see no reason not to use them. i'll have to look into the last 3 things you mentioned ---------------------------------------------------------------------- Larkonath · 2023-12-29 19:37 To help you put things into perspective about the dangers of the big bad internet, on a VPS for work we have an open port (but not the standard one) for a MySQL database. This solution was build around 2014 I think. I was in charge of putting data in this database. Back then I offered to make an API in front of the DB to secure it but the other dev that was consuming the data preferred to hit the database directly (he told me I could pry his sql from his cold dead hands). This VPS has a sub-domain name and the db is feeding the main website, so it's not exactly hidden. Guess how many times we got hacked in all those years? Yes, zero. We're not a big corp, but as a hobbyist you're even less a target than us. YMMV obviously :p ---------------------------------------------------------------------- Zhyphirus · 2023-12-29 19:43 yea, I think about that too, I think that since I'm a doing this as a hobby, and I'm not a big company (obviously) I don't take a lot of risky opening up my stuff to the internet, of course, if a hacker sees a way in my network and I have 0 ways of defending my self, that's on me, so I'm trying to make as secure as I can think of. Also, since I'm not using a VPS, I plan to keep VPN on all the time, at least when using the Cloudflare Tunnel and exposing my ports (which I do by on the VPN end), at this point I'm doing split tunneling with stuff that doesn't need it, so it works. ---------------------------------------------------------------------- lilrebel17 · 2023-12-29 22:09 I use cloudflare tunnels to my own reverse proxy. No ports are exposed on my router. My IP isn't visible. Everything goes through the cloudflare tunnel to my reverse proxy. My major apps are behind cloudflare zero trust policies. So, in order to access my pw managers' web app, you gotta auth through cloudflare zero access and then auth into the app. My proxy just takes the request and forwards it to my local servers with the appropiate apps. ---------------------------------------------------------------------- Zhyphirus · 2023-12-29 22:15 Cool, right now I'm taking a similar approach, I've set up zero trust policies for only a few email that I know are going to be used, I've checked on whois and nslookup, it looks like nothing is pointing to my end, everything ends on cloudflare (not sure if there's other ways of checking this) the only thing that I didn't do was configure the tunnel to use my reverse proxy, would mind expanding on that? And since I'm already here, what policies did u set up? just for the sake of curiosity ---------------------------------------------------------------------- lilrebel17 · 2023-12-29 22:32 I'm always here to help my brother/sister. Yeah, I set up my DNS records so that the root domain and wildcard point to the tunnel. On the tunnel, I set up so it points the wildcard to my proxys IP. That way, all traffic that comes to the domain cloudflare routes thorough the tunnel to my proxy. From there, my proxy says, "Hey, I know this subdomain, let me route you there." Or I have never heard of this subdomain, 404. For policies. I am still tweaking them, but I set up applications in zero trust and have policies specific to them. However, currently, I have it geoblocked to exclude everything but the US since I and my friends that would use the service would be in the US. Since I am the only one using my PW manager currently. I have that app locked so only a single email can access it, I did find I cant just use a gmail account. So when you attempt to access it, cloudflare pops up a login screen. I enter my email, then enter the one-time code. Then, I can log in to the web app. Did that help? ---------------------------------------------------------------------- PowerfulAttorney3780 · 2023-12-29 22:43 Is there a need for a guide on getting RDP and SSH to work via Cloudflare tunnels? I had a bitch of a time figuring it out and I documented the process. Online sources weren't much help, so I wonder if the community would be interested in me posting it up. ---------------------------------------------------------------------- Zhyphirus · 2023-12-29 22:43 Yes it did, I'll probably not be doing that lol, I plan to do something similar but with a wireguard tunnel instead, and about the policies I didn't try with a Gmail, but one of my users that I set up have it, I'll have to test to see if it'll fail ---------------------------------------------------------------------- lilrebel17 · 2023-12-29 22:57 Different solutions for different use cases. Definitely let me know. I just setup the cloudflare tunnel to try it a week or so ago and thus far have been really impresseded with the suite of security features. ---------------------------------------------------------------------- Zhyphirus · 2023-12-29 23:20 If you don't mind, I would like to see it, currently I don't think I need it, but some extra info would be nice ---------------------------------------------------------------------- Zhyphirus · 2023-12-30 00:32 For sure, I'll try to give it a shot in the future, I did read some posts/tutorials on the matter, but honestly, couldn't really understand I'll need to actually do it so I can make anything of it lol ---------------------------------------------------------------------- lilrebel17 · 2023-12-30 00:37 No worries, man. I'm glad to help if you have any other questions! ---------------------------------------------------------------------- dankydooo · 2023-12-30 06:08 Awesome tunneling is a great resource the lists and describes lots of options for this. Personally, I leaned into the cloudflare stack for my certs and my tunnels since I’m running kubernetes. I’m using k3s. Being able to leverage cloudflare with its access policies lets me keep non authenticated traffic from ever getting near my network. My services are behind Google oauth. Tunnels create dns names and then we create cnames to these tunnel dns names. This allows cloudflare to proxy all dns requests so there is never an IP exposure. They also are very selfhosted friendly. Just need a domain which is like $6 for something anymore. Using cloudflare external dns and tunnel ingress is a very nice experience. On another note zrok/open ziti look very interesting. https://github.com/anderspitman/awesome-tunneling https://github.com/STRRL/cloudflare-tunnel-ingress-controller ---------------------------------------------------------------------- dankydooo · 2023-12-30 06:11 Cloudflare proxies the dns of the tunnel and applies access policies before any traffic is even forwarded. ---------------------------------------------------------------------- dankydooo · 2023-12-30 06:13 There are better solutions than VPN to solve this problem. In this case a publicly resolvable and accessible url to a service running on a local machine. A VPN introduces complexity and doesn’t really fit that bill here. ---------------------------------------------------------------------- TheQuantumPhysicist · 2023-12-30 07:05 I think I disagree with you, but perhaps I misunderstand your proposition. Say I want to have exclusive access to my Plex web interface. How would you prevent people outside my network from accessing that page? Keep in mind that things like Plex are not made to be open publicly due to the focus on convenience more than security, as there have been hacks made possible by such dumb moves. How would you solve this without a VPN? Keep in mind that Plex is just an example. There are tons of examples where authentication is not good enough to be left open publicly, DAV comes to mind first, but there's lots more. ---------------------------------------------------------------------- PhilipLGriffiths88 · 2023-12-30 11:37 Links to zrok/OpenZiti, I work on the project: * [https://zrok.io/](https://zrok.io/) * [https://github.com/openziti](https://github.com/openziti) ---------------------------------------------------------------------- Ok_Sandwich_7903 · 2023-12-30 15:04 Tailscale it, putting in ACLs to control access would be an option. ---------------------------------------------------------------------- [deleted] · 2023-12-30 21:25 [removed] ---------------------------------------------------------------------- dankydooo · 2023-12-30 21:45 The question is "What is the best/safest way of exposing selfhosted apps to the web". You have altered the question with a different scenario "say I want to have exclusive access to my Plex interface". Regardless, this is easily ahieved either way with cloudflare tunnels: Cloudflare tunnels have access policies that allow "exclusive access" a myriad ways. Oauth, username/password, etc. There is no need for whoever has access to bother with a vpn. For example, my plex interface is accessible by whoever I assign to the Google SSO and username passswords I have setup. I can also lock down by origin IP and other access policy restrictions. Authentication occurs off of my network. Why would I need my users to install VPN for something like that? Cloudflare tunnel solves the problem, is easier than vpn, and requires less knowledge and risk, as I'm not even exposing a VPN endpoint. ---------------------------------------------------------------------- za_organic · 2023-12-30 22:09 This is not the threat vector. Bot/crawler/shodan detects your port and IP and you get added to a dB. There are people that make a living from establishing access to an environment. They will then bundle the access with 1 to 5000+ other "pawned" environments. This will be sold to people like crypto gangs for free compute or geographic proxies for attacks. Alternatively they will just chain your environment to a botnet and use it as part of a ddos. I've seen many comprimises at smaller companies where their servers were converted to staging grounds for attacks on other companies or as part of supply chain attacks. ---------------------------------------------------------------------- TheQuantumPhysicist · 2023-12-31 07:33 Yes, they're easier, but you're trading your privacy and security with convenience, the 101 disgusting state of current affairs in this century that defeats the whole point of self-hosting stuff. It's up to you. I, personally, don't want 3-letter agencies or big tech to be able to snoop on or even scan my crap as they please whenever they want. If you've seen enough news, you'd understand that bad actions they do don't really require legal warrants or authorization. Big tech can judge you for any stupid reason, like Amazon did a few months ago when they shutdown an automated home for a misunderstanding regarding a delivery driver. Same with google when they forwarded a case to the FBI for suspect of child abuse because a mother was laying down half-naked with HER OWN BABy. There's tons of cases when big tech just fucks you over because of their incompetence or whatever. Why the FUCK would I expose my services to them? I don't need them, and I can manage myself. All my family members that use my services don't even notice the difference. They have VPNs that are automatically connected. They just use the services seamlessly, and no one can do anything about my services unless they have a legal reason for it. So, excuse me if I don't think your solution is a good one. Good luck though, whatever works for you and makes you happy, right? All the best. ---------------------------------------------------------------------- dankydooo · 2023-12-31 20:23 What does any of this have to do with safely exposing a home endpoint? If you are so paranoid why use the internet at all? Do you own a cell phone? What internet provider do you use to know that the backbone is secure? How does VPN keep you safe from all these things? Seems you have a very small idea of what safety and security means. Regardless, have a nice new year and look at some other more modern solutions to VPN like open ziti and Tailscale. ---------------------------------------------------------------------- TheQuantumPhysicist · 2023-12-31 20:53 > What does any of this have to do with safely exposing a home endpoint? You're kidding, right? I already explained that in my first response to you. It doesn't seem you understand the implications. Whatever. Doesn't really matter. Have a nice new year too.