The first publicly open instance
I want to start with self hosting something available from internet. Currently I have jellyfin, nas etc but everything is available in local network.
My biggest concern is securing local network. I thought i will run application on separate server, I will use small vps as proxy, but Im not sure if it will be enough
Björn
in reply to Kkk2237pl • • •abeorch
in reply to Kkk2237pl • •What are you using for a router? A good uptodate version of something like ooenwrt, a separate subnet running on a different vnet and firewall zone.
Why the vps?
Selfhosted reshared this.
Kkk2237pl
in reply to abeorch • • •abeorch
in reply to Kkk2237pl • •Im no expert so you know take everything with a grain of salt but for me i flash all my routers with #openwrt including #tplink stuff... Butnthat gives me everything i need.
You probably do.everything with stock firmware though
Selfhosted reshared this.
kythrea
in reply to Kkk2237pl • • •I run my server on the internet, and my security is crowdsec + geo ip block (well, white-list my country's ip but same idea) and authelia.
Using this setup, I barely ever have even bots randomly pingig me, let alone anyone trying to access my NAS.
androidul
in reply to Kkk2237pl • • •I was pondering the same for last couple of days and had some thoughts on how to make it feasible. My research led me so far to 2 prerequisites:
I found pretty good Caddy documentation that covers both, so I think I’ll deploy a secondary Caddy reverse proxy that’ll perform such ops for public facing services.
Of course, I currently have only 1 Caddy instance reverse proxy ing my internal services, haven’t reached the part on traffic handling when my devices are connected to the “safe network” (aka my home LAN)
abeorch
in reply to Kkk2237pl • •Selfhosted reshared this.
0ops
in reply to Kkk2237pl • • •ui_hater
in reply to Kkk2237pl • • •irmadlad
in reply to Kkk2237pl • • •Have you considered Cloudflare Tunnels/Zero Trust. When you use Cloudflare Tunnels/Zero Trust, you don't need to fiddle with NAT, open any ports, in fact you don't need any open ports. You just install Cloudflare Tunnels/Zero Trust on your server, connect to your Cloudflare Tunnels/Zero Trust account, and Cloudflare does the rest. To deploy Cloudflare Tunnels/Zero Trust you will need a domain name. Cloudflare will sell you a domain name but I think most get something cheap from NamesCheap or Pork Bun. When you have secured a domain name, switch the nameservers to the ones that Cloudflare assigns you. Jacks a doughnut, Bob's your uncle.
ETA: Obviously you'll need port 22 for administration.
sudo ufw default deny incoming
sudo ufw default allow outgoing
Kkk2237pl
in reply to irmadlad • • •