I need some insight on how exactly tunnels and shit work reddit / selfhosted ---------------------------------------------------------------------- professional_pole · 2023-12-30 10:52 So, I recently came into possession of a server, and I've been having lots of fun with it. I'm currently running a minecraft server with playit,gg, Vikunja, tailscale (no headscale yet) and syncthing they're all lovely, and working fine, but something abt them scares me i have no idea how they work! (or networking as a whole, really). I just know that I've input a few commands/installed a few programs and I can magically connect to my server from other networks. That makes me worry, though. Considering that playit, for example, does not request any kind of authentication (unless I have forgotten about it) what stops random people from connecting using this tunnel? I haven't had another network to test from since I installed vikunja, which is the one that really concerns me. I feel that if I knew how these tunnels worked it would put my mind at ease, and I could *safely* open up connections to the outside world. tldr i have no idea how networking works and I kinda want a quick crash course because i feel like a kid seeing the terminal for the first time and getting scared that my computer is getting hacked ---------------------------------------------------------------------- ManWithoutUsername · 2023-12-30 11:05 Normally you need to provide a passphrase or certification Understand the basic of tunnel is easy. You need connect A B and you want every traffic between AB be encrypted, POINT to POINT For that is a tunnel, A create the tunnel and specify what algoritms use for encrypt and what networks to share (sometime you share ANY and do that in firewall), B joins it with a pashphrase/password ---------------------------------------------------------------------- BelugaBilliam · 2023-12-30 11:07 Are you using cloudflare tunnels? Assuming you're not, as long as you don't port forward the port of the service on your router, nothing is exposed. It will still work via VPN. However if your using cloudflare tunnels, that's a bit different. ---------------------------------------------------------------------- lawrencesystems · 2023-12-30 11:10 Tailscale has a great write up on how NAT traversal works which is not only how Tailscale works, but lots of others, such as [Netbitrd.IO](https://netbird.io/), works as well. [https://tailscale.com/blog/how-nat-traversal- works](https://tailscale.com/blog/how-nat-traversal-works) ---------------------------------------------------------------------- dually · 2023-12-30 11:46 A tunnel interface is a virtual network interface which your operating system can interact with in more or less the same way that it can interact with a real hardware interface. ---------------------------------------------------------------------- tenekev · 2023-12-30 12:55 Ffs, even their diagrams are gorgeous. ---------------------------------------------------------------------- sznyoky · 2023-12-30 17:16 To have a gasp on the fundamentals, you may want to read up about "OSI model" and "TCP/IP" for example Once you read them, continue reading about software firewalls and VPN. If you are concerned about your home server's security, search for "hardening ". replace with windows server, linux distro or any service you run and want to secure. Quick overview: Devices over the network are communicating with packages. Think of a package that has a sender, recipient and some content within. That package travels through various checkpoints that check the sender, recipient and maybe want to see the content. If you want the content to be available only for the recipient. Here comes the encryption. The sender and recipients agree on what encryption method to use and proceed to encrypt the content. The sender and recipient will still be visible for the checkpoints to know where the packet should be directed. VPN "tunnels" are like the same, packages are encrypted so no one can see your content but the recipient. So now the server can receive packages, but how does it know which service should process the package? Here comes to play the port number. Think of that like floor/door next to the address on the package. There are some reserved ports dedicated to well known services such as HTTP/HTTPS/SSH/FTP/DNS and many more. Search for IANA ports & protocols so see more. It is really a bad idea to let a server receive packages on all ports as all can be exploited by bad actors (the service listening on the port. search for CVE vulnerabilities if you want to learn more). To prevent that, firewalls can help to filter out which sender can access what port on the server. It is a good idea to deny all inbound connection and open only the one that is needed (called "hole punch" I believe). You do this on your router and on your server too. If a server wants to be hidden from public exposal but still want to be reached from public network, a trusted MITM (Man In The Middle) service can be used such as Tailscale, Cloudflare or other vendors providing tunnels. This means that all incoming connections to the server are blocked. The important note is that we are talking about incoming packets initiated by any external sender which are blocked. To establish a tunnel between the server and cloud tunnel provider, the server starts the communication by sending an initial request then receiving a reply for that. Since the connection is initiated from the server, the two endpoints can exchange packages on the established tunnel until the connection times out or break for whatever reasons. Then the server needs to initiate the VPN "tunnel" again. Sorry for any typo and formatting, I wrote it on mobile.