163
[SOLVED] ELI5: How to put several servers on one external IP? (lemmy.today)
submitted 1 year ago* (last edited 1 year ago) by to c/selfhosted@lemmy.world
107 comments fedilink hide all child comments
 

I'm pretty new to selfhosting and homelabs, and I would appreciate a simple-worded explanation here. Details are always welcome!

So, I have a home network with a dynamic external IP address. I already have my Synology NAS exposed to the Internet with DDNS - this was done using the interface, so didn't require much technical knowledge.

Now, I would like to add another server (currently testing with Raspberry Pi) in the same LAN that would also be externally reachable, either through a subdomain (preferable), or through specific ports. How do I go about it?

P.S. Apparently, what I've tried on the router does work, it's just that my NAS was sitting in the DMZ. Now it works!

you are viewing a single comment's thread
view the rest of the comments
[–] [S] 5 points 1 year ago (1 child)

Just me and the people I trust, but there are certain inconveniences around using VPN for access.

First, I live in the jurisdiction that is heavily restrictive, so VPN is commonly in use to bypass censorship

Second, I sometimes access my data from computers I trust but can't install VPN clients on

Third, I share my NAS resources with my family, and getting my mom to use a VPN every time she syncs her photos is near impossible

So, fully recognizing the risks, I feel like I have to expose a lot of my services.

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 2 child comments
    •
  • [–] 1 point 1 year ago (2 children)

    Remember that with services facing public internet it's not about if you get hacked but when you get hacked. It's personal photos on someone elses hands then.

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 4 child comments
    •
  • [–] 2 points 1 year ago (1 child)

    Not sure why you're downvote, you're absolutely right. People scan for open ports all day long and will eventually find your shit and try to break in. In my work environment, I see thousands of login attempts daily on brand new accounts, just because something discovered they exist and want to check it out.

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 2 child comments
    •
  • [–] 1 point 1 year ago

    Those who have not been burned yet often don't expect it to happen to them. Usually it isn't anything big causing it but some typo in a config or software not updated on time.

  • permalink
  • fedilink
  • source
  • parent
  • [–] [S] 1 point 1 year ago (1 child)

    I do remember that and take quite a few precautions. Also, nothing that can be serioisly used against me is in there.

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 2 child comments
    •
  • [–] 4 points 1 year ago (1 child)

    I have wrestled with the same thing as you and I think nginx reverse proxy and subdomains are reasonably good solution:

    • nothing answers from www.mydomain.com or mydomain.com or ip:port.
    • I have subdomains like service.mydomain.com and letsencrypt gives them certs.
    • some services even use a dir, so only service.mydomain.com/something will get you there but nothing else.
    • keep the services updated and using good passwords & non-default usernames.
    • Planned: instant IP ban to anything that touches port 80/443 without using proper subdomain (whitelisting letsencrypt ofc), same with ssh port and other commonly scanner ones. Using fail2ban reading nginx logs for example.
    • Planned: geofencing some ip ranges, auto-updating from public botnet lists.
    • Planned: wildcard TLS cert (*.mydomain.com) so that the subdomains are not listed anywhere maybe even Cloudflare tunnel with this.

    Only fault I’ve discovered are some public ledgers of TLS certs, where the certs given by letsencrypt spill out those semi-secret subdomains to the world. I seem to get very little to no bots knocking my services though so maybe those are not being scraped that much.

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 2 child comments
    •
  • [–] [S] 1 point 1 year ago (1 child)

    Pretty solid! Though insta-ban on everything :80/443 may backfire - too easy to just enter the domain name without subdomain by accident.

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 2 child comments
    •
  • [–] 2 points 1 year ago

    Could be indeed. Looking at the nginx logs, setting a permaban on trying to access /git and a couple of others might catch 99% of bots too. And ssh port ban trigger (using knockd for example) is also pretty powerful yet safe.

  • permalink
  • fedilink
  • source
  • parent