ELI5: How to put several servers on one external IP?

Comments

• tofu@lemmy.nocturnal.garden ⁨2⁩ ⁨days⁩ ago

  You need a reserve proxy. That’s a piece of software that takes the requests and puts them toward the correct endpoint.

  You need to create port forwards in the router and direct 80 and 443 (or whatever you’re using) toward the host of the reverse proxy and that is listening to on those ports. If it recognized the requests are for nas.your.domain, it will forward the requests to the NAS.

  Common reverse proxies are nginx or caddy. You can install it on your raspberry, it doesn’t need it’s own device.

  If you don’t want that, you can create different port forwards on your router (e.g. 8080 and 8443 to the Raspi) and configure your service on the Raspi corresponding. But it doesn’t scale well and you’d need to call everything with the port and the reverse proxy is the usual solution.

  source

  • Allero@lemmy.today ⁨2⁩ ⁨days⁩ ago

    There’s an issue with that first part. Do I configure it right? Should <domain>:8100 be redirected to 192.168.0.113:81 in this case?

    Image

    source

    • infeeeee@lemmy.zip ⁨2⁩ ⁨days⁩ ago

      External 80 to internal 80 and external 443 to internal 443

      With this config you don’t have to deal with ports later, as http is 80, https is 443 by default.

      If you run some container on port 81, you have to deal with that in the reverse proxy, not in the router. E.g. redirect something.domian.tld to 192.168.0.103:81

      If you use docker check out nginxproxymanager, it has a very beginner friendly admin webui. You shouldn’t forward the admin ui’s port, you need to access it only from your lan.

      source

      • -> View More Comments
• fibojoly@sh.itjust.works ⁨1⁩ ⁨day⁩ ago

  Welcome to the wonderful world of reverse proxies!

  source
• possiblylinux127@lemmy.zip ⁨1⁩ ⁨day⁩ ago

  What are you running?

  If it is http based use a reverse proxy like Caddy

  source

  • Allero@lemmy.today ⁨1⁩ ⁨day⁩ ago

    Update: tried Caddy, love it, dead simple, super fast, and absolutely works!

    source

    • possiblylinux127@lemmy.zip ⁨1⁩ ⁨day⁩ ago

      Did you also forward UDP port 443?

      If not I would as well since it is used for QUIC which is supported and automatically turned on for Caddy.

      source

      • -> View More Comments
  • Allero@lemmy.today ⁨1⁩ ⁨day⁩ ago

    For now just some experiments alongside NAS

    Planning to host Bitwarden, Wallabag and other niceties on the server, and then when I get something more powerful, spin up Minecraft server and stuff

    source

    • greybeard@feddit.online ⁨1⁩ ⁨day⁩ ago

      I'll be honest, if you aren't planning on sharing with others, I'd recommend switching to something like wireguard to connect back into your house instead of exposing everything publicly. Some firewalls have wireguard built in, so you can setup the VPN easily. But then all you have to do is keep your VPN endpoint safe to keep your internal network protected from the Internet, instead of having to worry about the security of everything you expose.

      source

      • -> View More Comments
• pleksi@sopuli.xyz ⁨1⁩ ⁨day⁩ ago

  I really feel like people who are beginners shouldnt play with exposing their services. When you set up Caddy or some other reverse proxy and actually monitor it with something like fail2ban you can see that the crawlers etc are pretty fast to find your services. If any user has a very poor password (or is reusing a leaked one) then someone has pretty open access to their stuff and you wont even notice unless you’re logging stuff.

  Of course you can set up 2FA etc but that’s pretty involved compared to a simple wg tunnel that lives on your router.

  source

  • Allero@lemmy.today ⁨1⁩ ⁨day⁩ ago

    For now I’m only toying around, experimenting a little - and then closing ports and turning my Pi off. I do have my NAS constantly exposed, but it is solidly hardened (firewall, no SSH, IP bans for unauthorized actions, etc. etc.), fully updated, hosts no sensitive data, and all that is important is backed up on an offline drive.

    source
  • r0ertel@lemmy.world ⁨1⁩ ⁨day⁩ ago

    My mantra is “plan to be hacked”. Whether this is a good backup strategy, a read-only VM, good monitoring or serious firewall rules.

    source
• webghost0101@sopuli.xyz ⁨1⁩ ⁨day⁩ ago

  Whispers “try proxmox”

  source

  • Allero@lemmy.today ⁨1⁩ ⁨day⁩ ago

    I will eventually!

    But for all I understand, it is to put many services on one machine, and I already have a NAS that is not going anywhere

    source

    • DarkDarkHouse@lemmy.sdf.org ⁨1⁩ ⁨day⁩ ago

      I’ve gone the other way. I used to run a Proxmox cluster, then someone gave me a Synology NAS. Now it’s rare that I spin up Proxmox and instead use a mix of VMs, containers and Synology/Synocommunity apps.

      source

      • -> View More Comments
• Nate066@lemmy.world ⁨2⁩ ⁨days⁩ ago

  VPN is definitely the way to go for home networks. Your router even has one built in. OpenVPN and Wireguard are good.

  If you really want to expose stuff like this the proper way is to isolate your home network from your internet exposed network using a VLAN. Then use a reverse proxy, like caddy and place everything behind it.

  You do need a business or prosumer router for this though. Something like Firewalla or setting up a OpenWRT or OPNsense.

  Synology also has there quick connect service as well. While not great if you keep UPNP off and ensure your firewall and login rate limiting is turned on it may be better then just directly exposing stuff. But its had its fair share of problems so yeah.

  Consider not self hosting everything. For example if all your family cares about is private photo storage, consider using a open source E2EE encrypted service for photos on the cloud like Ente Photos. Then you can use VPN for the rest.

  Also consider the fallout that would happen if you are hacked. If all your photos and other things get leaked because your setup was not secure was it really any better than using big tech?

  If nothing else please tell me you are using properly setup https certs from Let’s Encrypt or another good CA. Using a firewall and have login rate limiting setup on everything that is exposed. You can also test your SSL setup using something like www.ssllabs.com/ssltest/

  source

  • Allero@lemmy.today ⁨1⁩ ⁨day⁩ ago

    No truly private photos ever enter the NAS, so on that front it should be fine.

    VPN is not an option for several reasons, unfortunately.

    But I do have a Let’s Encrypt certificate, firewall and I ban IP after 5 unsuccessful login attempts. I also have SSH disabled completely.

    source
• greybeard@feddit.online ⁨1⁩ ⁨day⁩ ago

  The synology NAS can act as a reverse proxy for stuff inside your network. I don't have mine in front of me, so you will have to google the steps, but basically you point the synology to an internal resource and tell it what external subdomain it should respond to.

  source

  • Allero@lemmy.today ⁨1⁩ ⁨day⁩ ago

    Yes, I know where this feature is in the settings, but it’s got its own issues and I also turn the NAS off for the night, so it’s not an option for me.

    source

    • Joelk111@lemmy.world ⁨1⁩ ⁨day⁩ ago

      Why do you turn off the NAS at night? Reminds me of my grandparents turning off the wifi at night.

      source

      • -> View More Comments
    • yournamehere@lemm.ee ⁨1⁩ ⁨day⁩ ago

      then its not selfhosting.

      source

      • -> View More Comments
• bizdelnick@lemmy.ml ⁨2⁩ ⁨days⁩ ago

  If you mean HTTP server, what you need is a reverse proxy and name-based virtual hosts. I usually use nginx for such tasks, but you may choose another web server that has these features.

  source

  • Allero@lemmy.today ⁨2⁩ ⁨days⁩ ago

    Thanks!

    source

    • rikudou@lemmings.world ⁨2⁩ ⁨days⁩ ago

      I recommend caddy as a webserver, it’s very powerful, but the config is super simple compared to old school stuff like nginx or apache.

      source

      • -> View More Comments
• MangoPenguin@lemmy.blahaj.zone ⁨2⁩ ⁨days⁩ ago

  You can either:

  A) Use a different port, just set up the new service to run on a port that’s not used by the other service.

  B) If it’s a TCP service use a reverse proxy and a subdomain.

  source
• skankhunt42@lemmy.ca ⁨2⁩ ⁨days⁩ ago

  Router gets the public IP. Login to it, find port forwarding option. You’ll pick a public port. IE 443 and forward it to a local IP:port combo, IE 192.168.0.101:443.

  Then you can pick another public port and forward it to a different private IP:port combo.

  If you want a subdomain, you forward one port to one host and have it do the work. IE configure Nginx to do whatever you want.

  source

  • Allero@lemmy.today ⁨2⁩ ⁨days⁩ ago

    Thanks!

    source

    • skankhunt42@lemmy.ca ⁨2⁩ ⁨days⁩ ago

      Looks like you got it! Congrats.

      source

      • -> View More Comments
• towerful@programming.dev ⁨2⁩ ⁨days⁩ ago

  Who is externally reaching these servers?
  Joe public? Or just you and people you trust?

  If it’s Joe public, I wouldn’t have the entry point on my home network (I might VPS tunnel, or just VPS host it).

  If it’s just me and people I trust, I would use VPN for access, as opposed to exposing all these services publicly

  source

  • Allero@lemmy.today ⁨2⁩ ⁨days⁩ ago

    Just me and the people I trust, but there are certain inconveniences around using VPN for access.

    First, I live in the jurisdiction that is heavily restrictive, so VPN is commonly in use to bypass censorship

    Second, I sometimes access my data from computers I trust but can’t install VPN clients on

    Third, I share my NAS resources with my family, and getting my mom to use a VPN every time she syncs her photos is near impossible

    So, fully recognizing the risks, I feel like I have to expose a lot of my services.

    source

    • somewa@suppo.fi ⁨1⁩ ⁨day⁩ ago

      Remember that with services facing public internet it’s not about if you get hacked but when you get hacked. It’s personal photos on someone elses hands then.

      source

      • -> View More Comments
• Smokeydope@lemmy.world ⁨1⁩ ⁨day⁩ ago

  I’m also new to this but got all that figured out this week. As other commenters say you need a reverse proxy and configure it. I choose caddy over nginx for easy of install and config. I documented just about every step of the process. I’m a little scared to share my website on public fourms just yet but let me know if you want to see my infrastructure page where I share the steps and config files.

  source

  • Allero@lemmy.today ⁨1⁩ ⁨day⁩ ago

    Thanks, I will! Wise of you not to share it publicly.

    source
• jacksquat@what.forfi.win ⁨2⁩ ⁨days⁩ ago

  Honestly Cloudflare Tunnels could be a very simple way to do it. I’ve always had tremendous luck with it. By using CF you can let them do all the heavy lifting instead of hosting your own… as long as you trust them.

  source

  • BroBot9000@lemmy.world ⁨2⁩ ⁨days⁩ ago

    They are a plague with how prevalent they have become.

    The internet shouldn’t put all its eggs into one basket.

    It’s just another centralized entity which will lead to monopolized power. It goes against what we are trying to do with federated networks like Lemmy and mastodon.

    source

    • Flax_vert@feddit.uk ⁨2⁩ ⁨days⁩ ago

      What’s a better alternative that offer good ddos protection and tunnels

      source
    • aspoleczny@lemmy.world ⁨1⁩ ⁨day⁩ ago

      I prefer to use products and services before inevitable enshittification, not after the curve.

      source
  • rikudou@lemmings.world ⁨2⁩ ⁨days⁩ ago

    You can use frp to do the same thing a CloudFlare tunnel does without giving them your unencrypted data.

    source

    • aspoleczny@lemmy.world ⁨1⁩ ⁨day⁩ ago

      It’s definitely not the same thing. I do understand reservations behind usage free-tier services from Big Bad Corp., but I don’t understand malicious reduction of valid arguments for usage of those services.

      source

      • -> View More Comments
  • Allero@lemmy.today ⁨2⁩ ⁨days⁩ ago

    While not supportive of Big Tech, I do appreciate your piece of advice, and understand self-hosting needs differ!

    source

    • jacksquat@what.forfi.win ⁨2⁩ ⁨days⁩ ago

      Thanks for the heads up!

      source
    • aspoleczny@lemmy.world ⁨1⁩ ⁨day⁩ ago

      Again, attack targets end users, not Cloudflare tunnel operators: It abuses Cloudflare Tunnels as a delivery mechanism for malware payloads, not as a method to compromise or attack people who are self-hosting their own services through Cloudflare Tunnels.

      source
• EpicFailGuy@lemmy.world ⁨1⁩ ⁨day⁩ ago

  You already have a lot of good answers … but I got one more to add.

  I have a very similar setup on my homelab and I’m using a Cloudflare tunnel.

  It’s a free service and it’s really good because it allows you to expose web services and specific ports for remote access over dynamic IPs without having to expose your own router.

  developers.cloudflare.com/…/connect-networks/

  source

  • Allero@lemmy.today ⁨1⁩ ⁨day⁩ ago

    Thanks! I got that advice, too, but I would like to keep it self-hosted - I consider using Pangolin on a VPS for that purpose going forward.

    Also, beware of the new attack on Cloudflare Tunnel: csoonline.com/…/phishing-campaign-abuses-cloudfla…

    source

    • aspoleczny@lemmy.world ⁨1⁩ ⁨day⁩ ago

      This attack targets end users, not Cloudflare tunnel operators (i.e. self-hosters). It abuses Cloudflare Tunnels as a delivery mechanism for malware payloads, not as a method to compromise or attack people who are self-hosting their own services through Cloudflare Tunnels.

      source

      • -> View More Comments
• Chewy7324@discuss.tchncs.de ⁨2⁩ ⁨days⁩ ago

  If you go with IPv6, all your devices/servers have their own IP. These IPs are valid in your LAN as well a externally.

  But it’s still important to use a reverse proxy (e.g. for TLS).

  source

  • Allero@lemmy.today ⁨1⁩ ⁨day⁩ ago

    Oh, nice! So I don’t have just one, but many external IPs, one for every local device?

    source

    • Chewy7324@discuss.tchncs.de ⁨1⁩ ⁨day⁩ ago

      Yes, even IPv4 was intended to give each device in the world their own IP, but the address space is too limited. IPv6 fixes that.
      Actually, each device usually has multiple IPv6s, and only some/one are globally routable, i.e. it works outside of your home network. Finding out which one is global is a bit annoying sometimes, but it can be done.

      Usually routers still block incoming traffic for security reasons, so you still have to open ports in your router.

      source

      • -> View More Comments
• bruhduh@lemmy.world ⁨2⁩ ⁨days⁩ ago

  NAT translation, i use my openwrt router for that

  source

  • possiblylinux127@lemmy.zip ⁨1⁩ ⁨day⁩ ago

    OpenWRT also has great IPv6 support

    source
• thelittleblackbird@lemmy.world ⁨2⁩ ⁨days⁩ ago

  If you have a prosumer router I suggest you to use the ddns in the router plus a reverse proxy. This would be the cleanest solution.

  If you can not, once everything is working with your external access to the synology, the dsm has a built-in reverse proxy so it can redirect http requests to another server. Although this proxy is really simple and limited it can get the work done if you setup is simple enough.

  source

  • Allero@lemmy.today ⁨2⁩ ⁨days⁩ ago

    Thanks!

    source

    • thelittleblackbird@lemmy.world ⁨1⁩ ⁨day⁩ ago

      Check it again, I used it for years before switching to something with more features

      source

      • -> View More Comments
• Onomatopoeia@lemmy.cafe ⁨2⁩ ⁨days⁩ ago

  You’ll need to direct that port for the given service in the router control panel.

  For your current server you have a port forwarding for that port already. Just add a port forwarding rule for the new service.

  source

  • Allero@lemmy.today ⁨2⁩ ⁨days⁩ ago

    Tried doing that - here’s how I’ve set it up:

    Image

    Expected behavior: now when I enter <my domain>:8100, I reach 192.168.0.113:81 Real behavior: connection times out

    source

    • rtxn@lemmy.world ⁨2⁩ ⁨days⁩ ago

      Stupid question, but is the service reachable at all? What if you map 81 to 81? Or whichever port the other, confirmed-to-work service uses?

      source

      • -> View More Comments