Dynamic DNS vs Dedicated VPN IP

Comments

• jjlinux@lemmy.ml ⁨6⁩ ⁨months⁩ ago

  A fixed IP does make things easier at first, but I fail to see the value on that for personal use. Nothing a reverse proxy and DDNS can’t replace.

  I purchased a domain, use dynamic DNS for it, and point my sub domains to an NGINX proxy server that handles where each points to.

  Nothing has access to anything in my network from the internet (all ports are closed on my PFSense), other than Wireguard, and I just VPN into my network when I’m not home.

  It was scary when I started, but figured it out in a couple of days. Take into consideration that I’m not even mildly smart, so it should be fairly easy for anyone.

  Get into furoms, ask around, watch tutorials, you’ll be up and running in no time.

  Good luck.

  source

  • kakes@sh.itjust.works ⁨6⁩ ⁨months⁩ ago

    Thanks for the reply!

    So the NGINX server hosted outside your network, then? And then reverse-proxy that into your home server?

    Honestly, I feel like NGINX is a bit overkill for my situation, since I’m not expecting to have a lot of traffic. I could be wrong, though.

    source

    • marsara9@lemmy.world ⁨6⁩ ⁨months⁩ ago

      Their setup sounds similar to mine. But no, only a single service is exposed to the internet: wireguard.

      The idea is that you can have any number of servers running on your lan, etc… but in order to access them remotely you first need to VPN into your home network. This way the only thing you need to worry about security wise is wireguard. If there’s a security hole / vulnerability in one of the services you’re running on your network or in nginx, etc… attackers would still need to get past wireguard first before they could access your network.

      But here is exactly what I’ve done:

      1. Bought a domain so that I don’t have to remember my IP address.
      2. Setup DDNS so that the A record for my domain always points to my home ip.
      3. Run a wireguard server on my lan.
      4. Port forwarded the wireguard port to the wireguard server.
      5. Created client configs for all remote devices that should have access to my lan.

      Now I can just turn on my phone’s VPN whenever I need to access any one of the services that would normally only be accessible from home.

      P.s. there’s additional steps I did to ensure that the masquerade of the VPN was disabled, that all VPN clients use my pihole, and that I can still get decent internet speeds while on the VPN. But that’s slightly beyond the original ask here.

      source

      • -> View More Comments
    • atzanteol@sh.itjust.works ⁨6⁩ ⁨months⁩ ago

      Nginx isn’t for security it’s to allow hostname-based proxying so that your single IP address can serve multiple backend services.

      source

      • -> View More Comments
    • jjlinux@lemmy.ml ⁨6⁩ ⁨months⁩ ago

      No, it’s inside the network. Once I’m inside my network via the VPN, the proxy server routes to the service I want based on the subdomain instead of using the IP and port as the address.

      This can also be useful if, instead of going the VPN route, and you choose to go the CDN tunnel (for example, Cloudflare) way. I actually started with a tunnel via Cloudflare, but after some digging, I don’t trust them anymore. Having a tunnel allows you to close all ports coming into your network, but at the expense of having to trust the tunnel provider, and I don’t trust many companies out there.

      source
    • clmbmb@lemmy.dbzer0.com ⁨6⁩ ⁨months⁩ ago

      No, the nginx runs inside your network. It’s the “entry point” to it and it proxies all requests to your respective services.

      source

      • -> View More Comments
• kalpol@lemm.ee ⁨6⁩ ⁨months⁩ ago

  Really only if you’re running your own email server. Otherwise as far as I know dynamic DNS fills the need.
  You aren’t in any more risk either way.

  Sounds like maybe you want to look into pfsense to do traffic filtering. Highly recommend.

  source

  • kakes@sh.itjust.works ⁨6⁩ ⁨months⁩ ago

    I messed with pfsense a bit at my old job, but never really thought to use it in my home network - might just give that a shot, thanks!

    source

    • TCB13@lemmy.world ⁨6⁩ ⁨months⁩ ago

      but never really thought to use it in my home network

      Because you don’t need it. OPNsense and pfSense may make sense in some cases however you’re running a small network and you most likely don’t require those. OpenWRT will provide you with a much cleaner open-source experience and also allow for all the customization you would like. Another great advantage of OpenWRT you’ve the ability to install 3rd party stuff in your router, you may even use qemu to virtualize stuff like your Pi-Hole on it or simply run docker containers.

      source
• justme@lemmy.dbzer0.com ⁨6⁩ ⁨months⁩ ago

  VPN providers usually do not offer port forwarding, so the dedicated IP doesn’t help you. I discussed that in length with a support guy from nordvpn. The dedicated IP is only meant for outgoing connections, so your IP doesn’t jump to crazy, which would cause problems,e.g., with bank logins.

  source
• VelociCatTurd@lemmy.world ⁨6⁩ ⁨months⁩ ago

  As long as whatever firewall rules you’re using is capable of resolving FQDNs then I don’t see an advantage of doing this. Maybe in the off chance that your IP changes, someone else gets the new IP and exploits it before the DDNS setup has a chance to update. I think that’s really unlikely.

  source

  • peregus@lemmy.world ⁨6⁩ ⁨months⁩ ago

    Why do firewall rules need to resolve FQDNs?

    source

    • VelociCatTurd@lemmy.world ⁨6⁩ ⁨months⁩ ago

      To resolve whatever hostname you’ve setup for ddns

      source

      • -> View More Comments
• traches@sh.itjust.works ⁨6⁩ ⁨months⁩ ago

  First I’d ask if you need to open ports at all - if this is only for your family’s use then Tailscale or one of its alternatives can accomplish the same goal without opening ports in your firewall or worrying about security flaws in your hosted services.

  If it’s for public use, maybe consider cloudflare tunnel?

  source

  • kakes@sh.itjust.works ⁨6⁩ ⁨months⁩ ago

    True, these do sound like the best solutions honestly. I wanted to avoid something like Tailscale, since it just becomes another point for me to support/troubleshoot on the user end, but maybe I should reconsider. It’s a tradeoff, but it would also simplify a lot on my end.

    source
• catloaf@lemm.ee ⁨6⁩ ⁨months⁩ ago

  Safer in terms of what?

  If you can’t justify it, then no, save your money.

  source

  • kakes@sh.itjust.works ⁨6⁩ ⁨months⁩ ago

    Just in terms of broadcasting my home IP directly vs having a middleman, essentially.

    source

    • atzanteol@sh.itjust.works ⁨6⁩ ⁨months⁩ ago

      You’re not “broadcasting” anything. You’re running a server.

      Your browser is the thing sending your ip to every site you visit. And beyond simple geolocation data it’s not that useful to anybody.

      source

      • -> View More Comments
• pyrosis@lemmy.world ⁨6⁩ ⁨months⁩ ago

  You can do that or you can use a reverse proxy to expose your services without opening ports for every service. With a reverse proxy you would point port 80 and 443 to the reverse proxy once traffic hits your router/firewall. In the reverse proxy you would configure hostnames that point to the local service IP/ports. Reverse proxy servers like nginx proxy manager then allow you to setup https certificates for every service you expose. They also allow you to disable access to them through a single interface.

  I do this and have setup some blocklists on the opnsense firewall. Specifically you could setup the spamhaus blocklists to drop any traffic that originates from those ips. You can also use the Emerging Threats Blocklist. It has spamhaus and a few more integrated from dshield ect. These can be made into simple firewall rules.

  If you want to block entire country ips you can setup the GeoIP blocklist in opnsense. This requires a maxmind account but allows you to pick and choose countries.

  You can also setup the suricatta ips in opnsense to block detected traffic from daily updates lists. It’s a bit more resource intensive from regular firewall rules but also far more advanced at detecting threats.

  I use both firewall lists and ips scanning both the wan and lan in promiscuous mode. This heavily defends your network in ways that most modern networks can’t even take advantage.

  You want even more security you can setup unbound with DNS over TLS. You could even setup openvpn and route all your internal traffic through that to a VPN provider. Personally I prefer having individual systems connect to a VPN service.

  Anyway all this to say no you don’t need a VPN static IP. You may prefer instead a domain name you can point to your systems. If you’re worried about security here identify providers that allow crypto and don’t care about identity. This is true for VPN providers as well.

  source

  • kakes@sh.itjust.works ⁨6⁩ ⁨months⁩ ago

    Thank you for such an in-depth reply!

    There’s a lot to take in here, but it sounds like I’ve got some work to do - not necessarily a bad thing. It’s honestly about time I took my network more seriously and set up some proper routing / firewalls.

    source
• Decronym@lemmy.decronym.xyz ⁨6⁩ ⁨months⁩ ago

  Acronyms, initialisms, abbreviations, contractions, and other phrases which expand to something larger, that I’ve seen in this thread:

  Fewer Letters	More Letters
  DNS	Domain Name Service/System
  HTTP	Hypertext Transfer Protocol, the Web
  IP	Internet Protocol
  VPN	Virtual Private Network
  nginx	Popular HTTP server

  ---

  [Thread #737 for this sub, first seen 5th May 2024, 05:35] [FAQ] [Full list] [Contact] [Source code]

  source