Serveo: Expose Local Servers to the Internet • Hacker News Board

Re: Serveo: Expose Local Servers to the Internet

#81

Post by AmericanChopper » Sun, Jun 23, 2019, 11:56 AM UTC

zAy0LfpBZLC8mAC wrote: post #77

AmericanChopper wrote: post #56

Earlier quoted context omitted.

Because without NAT, none of the devices on my home network would be able to connect to any internet connected hosts. That is, unless I assigned internet routable addresses to their network interfaces. If I did that, I’d either have to install firewalls on my devices, or expose all services running on my devices to the internet. But I don’t have to do that, because my home router uses NAT to allow all devices on my h…

The point is that IP doesn't work how you think it works, but I have no clue what exactly your misconception is, so I don't know what I need to explain to you to make you see the error in your reasoning. And unfortunately, you don't even answer my questions, instead just hand-waving your way through the explanation, ignoring all the details that would show where your misunderstanding lies. In any case, no, if you onl…

> if you only remove NAT from your home router that also has a stateful firewall, nothing changes security-wise.

But now I don’t have an internet connection, because none of the devices on my home network have an internet routable IP.

Re: Serveo: Expose Local Servers to the Internet

#82

Post by ubercow13 » Sun, Jun 23, 2019, 12:00 PM UTC

zAy0LfpBZLC8mAC wrote: post #74

ubercow13 wrote: post #72

Earlier quoted context omitted.

So an inbound packet comes in to your NAT and there is no entry for it in the state table. Isn't it then dropped? Isn't that preventing a connection?

Why should it be dropped? If there is no entry in the state table, then NAT rules are consulted to see whether a new rewrite entry should be added (such as DNAT/port forwarding rules on your home router), and if there is no matching rule either, it simply is forwarded without address rewriting.

Why would it be forwarded? Do you mean that it forwards it to itself, the NAT device addressed by the actual public IP? Wikipedia seems to disagree [0] "if the destination port number of the incoming packet is not found in the translation table, the packet is dropped or rejected because the PAT device doesn't know where to send it."

I am sure a NAT could be configured any number of ways, though, and could probably do anything you want with such packets.

[0] https://en.m.wikipedia.org/wiki/Network_address_translation

Re: Serveo: Expose Local Servers to the Internet

#83

Post by tjoff » Sun, Jun 23, 2019, 12:20 PM UTC

zAy0LfpBZLC8mAC wrote: post #80

tjoff wrote: post #78

Earlier quoted context omitted.

Yes, but it would be worth it. There is no need nor benefit to have a per-device unique address advertised to the world. If there is a desire for a certain device then absolutely, give it its own IP, but that is the exception.

> There is no need nor benefit to have a per-device unique address advertised to the world. Yes, there is! But possibly more importantly: There is no benefit to assigning devices ambiguous addresses. It's as sensible as having all rooms in your business have "1" as their room number because you somehow have convinced yourself that that prevents people from entering your building.

What need or benefit?

I have no idea what you are trying to convey, I do not think you understood the concept.

I'm not talking about security.

Re: Serveo: Expose Local Servers to the Internet

#84

Post by shock » Sun, Jun 23, 2019, 12:32 PM UTC

AmericanChopper wrote: post #50

zAy0LfpBZLC8mAC wrote: post #47

Earlier quoted context omitted.

> It allows you to connect a private network to any other network, including the internet, without allowing hosts on that network access to hosts on the private network. So, how does it do that? > What is your justification for saying that access control measures are not security controls? I am not saying that. It simply isn't an access control measure.

> So, how does it do that? By rewriting the IP headers of packets as they traverse routing devices. If you’re trying to say that all NAT devices are stateless firewalls, then your point is even more contrived than I first thought. > It simply isn't an access control measure. Then why can’t other internet connected devices connect to my internet connected laptop? If I’d connected my laptop directly to my ISP then they…

> Then why can’t other internet connected devices connect to my internet connected laptop?

Some of them can. For example a device in the ISP network that can deliver a packet directly to your router's WAN interface can connect to your LAN devices in the absence of a firewall that would drop them.

As an example consider this:

A packet from src 10.10.10.10 to dst 192.168.1.1 arrives on the WAN interface. There are no firewall rules that match and the NAT is stateless. The router looks at the route table and sees a route for 192.168.1.0/24 on the LAN interface. It puts the packet on the LAN interface and calls it a day. Since 10.10.10.10 was a device on the same ISP network segment/broadcast domain as your router's WAN interface, it just reached a device in your NATed LAN.

On the campus LAN we used as a best practice to drop all packets that arrived on the WAN interface with a destination to the private LAN IP range, that had no entries in the state table.

Re: Serveo: Expose Local Servers to the Internet

#85

Post by ris » Sun, Jun 23, 2019, 12:37 PM UTC

iampims wrote: post #12

I’m a big fan of Cloudflare Tunnels: https://www.cloudflare.com/products/argo-tunnel/ https://ngrok.com is also a very good alternative.

> https://ngrok.com is also a very good alternative.

But with non-standard and proprietary client software.

Re: Serveo: Expose Local Servers to the Internet

#86

Post by ris » Sun, Jun 23, 2019, 12:39 PM UTC

trevordixon wrote: post #62

Hey cool, this is my side project! I've been trying to think of other interesting things to add to the project. For example, OpenSSH can do TUN/TAP tunneling, so you can use SSH as a proper VPN. (See https://wiki.archlinux.org/index.php/VPN_over_SSH ) How could that be useful in Serveo? How else could SSH be used creatively?

It all almost seems too easy. How much time do you have to spend dealing with abuse reports?

Re: Serveo: Expose Local Servers to the Internet

#87

Post by privateSFacct » Sun, Jun 23, 2019, 12:56 PM UTC

AmericanChopper wrote: post #81

zAy0LfpBZLC8mAC wrote: post #77

Earlier quoted context omitted.

The point is that IP doesn't work how you think it works, but I have no clue what exactly your misconception is, so I don't know what I need to explain to you to make you see the error in your reasoning. And unfortunately, you don't even answer my questions, instead just hand-waving your way through the explanation, ignoring all the details that would show where your misunderstanding lies. In any case, no, if you onl…

> if you only remove NAT from your home router that also has a stateful firewall, nothing changes security-wise. But now I don’t have an internet connection, because none of the devices on my home network have an internet routable IP.

NAT - regardless of firewalls or anything else - requires explicit config to allow packets to a host behind NAT. That’s is a security feature. Carrier grade NAT makes that even clearer. Note - I’ve configured non Firewall NATs - still requires explicit config. Some load balancer are basically non firewall NATs

Re: Serveo: Expose Local Servers to the Internet

#88

Post by hunter2_ » Sun, Jun 23, 2019, 1:29 PM UTC

zAy0LfpBZLC8mAC wrote: post #79

ComodoHacker wrote: post #58

Earlier quoted context omitted.

The point you were objecting to was "external device can't connect to a device behind NAT without explicit configuration". Without NAT rules access to internal devices is prevented because packets don't get routed to private IPs.

That just isn't the case, though. A router without NAT and without a firewall (or a combined NAT/firewall thingy with default allow and no further rules) will route packets addressed to "private addresses" just fine. An IP router does not distinguish between "private addresses" and "non-private addresses": As long as there is a route for a prefix in the routing table, the router will route packets addressed to that p…

So your example depends on the incoming packet already being addressed to a device behind the home router, which in a home network is in a private range. Thus, your example depends on the ISP's network delivering a packet to the customer despite that packet having an IP address that doesn't match the IP address the customer leased. Do you agree, and if so, do you know that this has ever happened in a residential setting?

Or do you mean an adversary who is or who compromises the ISP, possibly by tapping into the coax/fiber/etc in the last mile or by pwning the related nodes?

Re: Serveo: Expose Local Servers to the Internet

#89

Post by zimbatm » Sun, Jun 23, 2019, 1:29 PM UTC

tjoff wrote: post #78

Nextgrid wrote: post #69

Earlier quoted context omitted.

I’ve never seen NAT being used with IPv6. I don’t see the point, it would be more effort to use it than not.

Yes, but it would be worth it. There is no need nor benefit to have a per-device unique address advertised to the world. If there is a desire for a certain device then absolutely, give it its own IP, but that is the exception.

Actually it would make P2P communication much simpler.

WebRTC or any other video conferencing software wouldn't need a STUN server if all the clients were able to talk directly to each-other.

Re: Serveo: Expose Local Servers to the Internet

#90

Post by mijoharas » Sun, Jun 23, 2019, 1:37 PM UTC

I've written and am running something exactly like this for my work. (We used to use forward.wf but had to move away from it, a third party blocked it).

Very simple system, just a server+ nginx + letsencrypt. Tiny service to set new people up. We've been running out the last year or so, it took an hour or 2 to write, and hasn't needed more than that maintenance since.