6 ms·

Is there a way to do that and still be able to access the server?

by miramba 9mo ago

deleted 9mo ago
[deleted]
Carrok 9mo ago
Many ways. Using a "bastion host" is one option, with something like wireguard or tinc. Tailscale and similar services are another option. Tor is yet another option.
- venturecruelty 9mo ago
  >Never expose your server IP directly to the internet, vps or baremetal.
- cortesoft 9mo ago
  The bastion host is a server, though, and would be exposed to the internet.
  - j45 9mo ago
    It can run a firewall and forward to internal traffic as well.
sh3rl0ck 9mo ago
Either via a VPN or a tunnel.
iLoveOncall 9mo ago
Yes, CloudFlare ZeroTrust. It's entirely free, I use it for loads of containers on multiple hosts and it works perfectly.
- j45 9mo ago
  It's really convenient. I don't love that its a one of one service, but it's a decent enough placeholder.
m00x 9mo ago
Yes, cloudflare tunnels do this, but I don't think it's really necessary for this. I use them for self-hosting.
- doublerabbit 9mo ago
  That server is still exposed to the internet on a public IP. Just only known and courted through a 3rd party's castle.
  - j45 9mo ago
    The tunnel doesn't have to use the Public IP inbound, the cloudflare tunnel calls outbound that can be entirely locked up. If you are using Cloudflare's DNS they can hide your IP on the dns record but it would still have to be locked down but some folks find ways to tighten that up too. If you're using a bare metal server it can be broken up. It's fair that it's a 3rd party's castle. At the same time until you know how to run and secure a server, some services are not a bad idea. Some people run pangolin or nginx proxy manager on a cheap vps if it suits their use case which will securely connect to the server. We are lucky that many of these ideas have already been discovered and hardened by people before us. Even when I had bare metal servers connected to the internet, I would put a firewall like pfsense or something in between.
    - palata 9mo ago
      What does the tunnel bring except DoS protection and hiding your IP? And what is the security concern with divulging your IP? Say when I connect to a website, the website knows my IP and I don't consider this a security risk. If I run vulnerable software, it will still be vulnerable through a Cloudflare tunnel, right? Genuinely interested, I'm always scared to expose things to the internet :-).
      - j45 9mo ago
        Small "except". :) With the amount of automated bots that port scan looking for anything/everything that's open, as well as scanning DNS records for server IPs that could be targeted, one of the nice patterns of cloud hosting is how application and data servers are hosted behind firewalls of some kind, to effectively be internal. As for what's exposed to the web, let's say the payload of a website, if there was something vulnerable in the javascript, that could be a weakness hosted anywhere. Cloudflare can also help achieve this without too much fuss for self-hosted projects, be it personal, and production grade, assuming the rest of the trimmings are tehre.
j45 9mo ago
Yes, of course. Free way - sign up for a cloudflare account. Use the DNS on cloudflare, they wil put their public ip in front of your www. Level 2 is install the cloudflare tunnel software on your server and you never need to use the public IP. Backend access securely? Install Tailscale or headscale. This should cover most web hosting scenarios. If there's additional ports or services, tools like nginx proxy manager (web based) or others can help. Some people put them on a dedicated VPS as a jump machine. This way using the Public IP can almost be optional and locked down if needed. This is all before running a firewall on it.

Is there a way to do that and still be able to access the server?

by miramba 9mo ago

Is there a way to do that and still be able to access the server?

deleted 9mo ago

[deleted]

Carrok 9mo ago

Many ways. Using a "bastion host" is one option, with something like wireguard or tinc. Tailscale and similar services are another option. Tor is yet another option.

venturecruelty 9mo ago
>Never expose your server IP directly to the internet, vps or baremetal.
cortesoft 9mo ago
The bastion host is a server, though, and would be exposed to the internet.
- j45 9mo ago
  It can run a firewall and forward to internal traffic as well.

sh3rl0ck 9mo ago

Either via a VPN or a tunnel.

iLoveOncall 9mo ago

Yes, CloudFlare ZeroTrust. It's entirely free, I use it for loads of containers on multiple hosts and it works perfectly.

j45 9mo ago
It's really convenient. I don't love that its a one of one service, but it's a decent enough placeholder.

m00x 9mo ago

Yes, cloudflare tunnels do this, but I don't think it's really necessary for this. I use them for self-hosting.

doublerabbit 9mo ago
That server is still exposed to the internet on a public IP. Just only known and courted through a 3rd party's castle.
- j45 9mo ago
  The tunnel doesn't have to use the Public IP inbound, the cloudflare tunnel calls outbound that can be entirely locked up. If you are using Cloudflare's DNS they can hide your IP on the dns record but it would still have to be locked down but some folks find ways to tighten that up too. If you're using a bare metal server it can be broken up. It's fair that it's a 3rd party's castle. At the same time until you know how to run and secure a server, some services are not a bad idea. Some people run pangolin or nginx proxy manager on a cheap vps if it suits their use case which will securely connect to the server. We are lucky that many of these ideas have already been discovered and hardened by people before us. Even when I had bare metal servers connected to the internet, I would put a firewall like pfsense or something in between.
  - palata 9mo ago
    What does the tunnel bring except DoS protection and hiding your IP? And what is the security concern with divulging your IP? Say when I connect to a website, the website knows my IP and I don't consider this a security risk. If I run vulnerable software, it will still be vulnerable through a Cloudflare tunnel, right? Genuinely interested, I'm always scared to expose things to the internet :-).
    - j45 9mo ago
      Small "except". :) With the amount of automated bots that port scan looking for anything/everything that's open, as well as scanning DNS records for server IPs that could be targeted, one of the nice patterns of cloud hosting is how application and data servers are hosted behind firewalls of some kind, to effectively be internal. As for what's exposed to the web, let's say the payload of a website, if there was something vulnerable in the javascript, that could be a weakness hosted anywhere. Cloudflare can also help achieve this without too much fuss for self-hosted projects, be it personal, and production grade, assuming the rest of the trimmings are tehre.

j45 9mo ago

Yes, of course. Free way - sign up for a cloudflare account. Use the DNS on cloudflare, they wil put their public ip in front of your www. Level 2 is install the cloudflare tunnel software on your server and you never need to use the public IP. Backend access securely? Install Tailscale or headscale. This should cover most web hosting scenarios. If there's additional ports or services, tools like nginx proxy manager (web based) or others can help. Some people put them on a dedicated VPS as a jump machine. This way using the Public IP can almost be optional and locked down if needed. This is all before running a firewall on it.