Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Serveo: Expose Local Servers to the Internet

serveo.net

Post reply on HN
Print view View original

101–110 of 122 posts

Re: Serveo: Expose Local Servers to the Internet

#101

Post by dorfsmay »

tjoff wrote: post #98
dorfsmay wrote: post #97

Earlier quoted context omitted.

Do you use incognito windows for each website you browse and close them before opening a new one? Do you disable cookies completely? If not, using NAT doesn't add much privacy for "ongoing session". Also, how many people share your internet connection? If it's a handful, like most household, your one in a handful, pretty small area. If that's a concern to you, you should use a VPN.

There is more to the internet than the browser. And there are other techniques than closing all incognito windows for each site ... Surely you recognize the difference between uniquely identifying a machine from that?

Again, at this point, use VPNs, ephemeral ssh hop VMs on AWS, Vultur, etc...

For day to day usage, I'm fine with a given IP on a /64. If the police came to find who ssh'ed through NAT from my ISP provided ipv4, it wouldn't take them very long to figure out my wife and kids can't even spell ssh!

Re: Serveo: Expose Local Servers to the Internet

#102

Post by notwedtm »

tjoff wrote: post #83
zAy0LfpBZLC8mAC wrote: post #80

Earlier quoted context omitted.

> There is no need nor benefit to have a per-device unique address advertised to the world. Yes, there is! But possibly more importantly: There is no benefit to assigning devices ambiguous addresses. It's as sensible as having all rooms in your business have "1" as their room number because you somehow have convinced yourself that that prevents people from entering your building.

What need or benefit? I have no idea what you are trying to convey, I do not think you understood the concept. I'm not talking about security.

There are plenty of benefits and/or use-cases for having each internet connected device have it's own unique address. If not just for nonrepudiation, the elimination of NAT hardware and complexities is a plus as well.

If you're not talking about security, maybe you should be?

Re: Serveo: Expose Local Servers to the Internet

#103

Post by tjoff »

dorfsmay wrote: post #101
tjoff wrote: post #98

Earlier quoted context omitted.

There is more to the internet than the browser. And there are other techniques than closing all incognito windows for each site ... Surely you recognize the difference between uniquely identifying a machine from that?

Again, at this point, use VPNs, ephemeral ssh hop VMs on AWS, Vultur, etc... For day to day usage, I'm fine with a given IP on a /64. If the police came to find who ssh'ed through NAT from my ISP provided ipv4, it wouldn't take them very long to figure out my wife and kids can't even spell ssh!

Not really a solution to the systemic issue of giving facebook a unique id per device for everyone on the planet. I'm also not just talking about my personal setup. A VPN wouldn't be a satisfactory solution to either.

I'm not talking about hiding from the police.

Re: Serveo: Expose Local Servers to the Internet

#104

Post by vardump »

zAy0LfpBZLC8mAC wrote: post #75
vardump wrote: post #68

Earlier quoted context omitted.

NAT is not meant for security. It just unintentionally provides some by preventing inbound connections. That's something you can circumvent in certain scenarios. The technique is called "NAT hole punching".

> It just unintentionally provides some by preventing inbound connections. No, it doesn't.

Of course you should also have a properly configured firewall.

Relying on NAT alone for security is not a great idea.

Re: Serveo: Expose Local Servers to the Internet

#105

Post by dorfsmay »

tjoff wrote: post #103
dorfsmay wrote: post #101

Earlier quoted context omitted.

Again, at this point, use VPNs, ephemeral ssh hop VMs on AWS, Vultur, etc... For day to day usage, I'm fine with a given IP on a /64. If the police came to find who ssh'ed through NAT from my ISP provided ipv4, it wouldn't take them very long to figure out my wife and kids can't even spell ssh!

Not really a solution to the systemic issue of giving facebook a unique id per device for everyone on the planet. I'm also not just talking about my personal setup. A VPN wouldn't be a satisfactory solution to either. I'm not talking about hiding from the police.

Facebook?

You know Facebook buys your purchase history from Credit Card companies, right? Disable ad blocking when you go to Facebook, you'll find out they know way more about you than explainable by ip address and email tracking (and now we now purchase history).

If you chose to use Facebook and credit cards, you have bigger privacy problems than non-NATed ipv6!

Re: Serveo: Expose Local Servers to the Internet

#106

Post by antoniomika »

trickstra wrote: post #76
zackify wrote: post #57

Shameless plug, but I just wrote a post on rolling this yourself in 15 minutes or less. https://zach.codes/roll-your-own-ngrok/

I was trying to achieve the same with ssh tunnels a while back, but I wanted to have certbot running on the local machine, not on the DO server. So nginx on the server would have to forward everything as-is, encrypted. Is that possible?

It sounds like what you're looking for is to just forward the TCP port without having nginx do the SSL termination for you. You can achieve that with vanilla SSH though, just by forwarding port 443. If you want the virtual hosting, you could use an SNI proxy (haproxy with SNI tcp proxying should do for that)

Re: Serveo: Expose Local Servers to the Internet

#107

Post by antoniomika »

Another shameless plug, but I wrote something that pretty much does the exact same thing: https://github.com/antoniomika/sish. Main difference was I didn't look forward to having to run a proprietary binary to achieve something I could write and I wanted to have SSH authentication built in so I can have it available publicly without having to worry about abuse.

Re: Serveo: Expose Local Servers to the Internet

#108

Post by tjoff »

dorfsmay wrote: post #105
tjoff wrote: post #103

Earlier quoted context omitted.

Not really a solution to the systemic issue of giving facebook a unique id per device for everyone on the planet. I'm also not just talking about my personal setup. A VPN wouldn't be a satisfactory solution to either. I'm not talking about hiding from the police.

Facebook? You know Facebook buys your purchase history from Credit Card companies, right? Disable ad blocking when you go to Facebook, you'll find out they know way more about you than explainable by ip address and email tracking (and now we now purchase history). If you chose to use Facebook and credit cards, you have bigger privacy problems than non-NATed ipv6!

Sigh, no I don't use facebook. I'm also a very small subset of earths population and also own a small subset of all internet connected devices.

Re: Serveo: Expose Local Servers to the Internet

#109

Post by zAy0LfpBZLC8mAC »

ubercow13 wrote: post #82
zAy0LfpBZLC8mAC wrote: post #74

Earlier quoted context omitted.

Why should it be dropped? If there is no entry in the state table, then NAT rules are consulted to see whether a new rewrite entry should be added (such as DNAT/port forwarding rules on your home router), and if there is no matching rule either, it simply is forwarded without address rewriting.

Why would it be forwarded? Do you mean that it forwards it to itself, the NAT device addressed by the actual public IP? Wikipedia seems to disagree [0] "if the destination port number of the incoming packet is not found in the translation table, the packet is dropped or rejected because the PAT device doesn't know where to send it." I am sure a NAT could be configured any number of ways, though, and could probably do…

> Why would it be forwarded?

Because the device is a router, and that is what routers do.

> Do you mean that it forwards it to itself, the NAT device addressed by the actual public IP?

No, it forwards it to whatever destination address is in the destination address field of the IP headers, because that is what IP routers do.

If it is addressed to one of the NAT device's own addresses, of course, the routing decision would deliver it to the local protocol stack instead of forwarding it, and if there was any service listening on the respective protocol/port, that service would receive the packet (or the TCP stack would respond with a SYN+ACK, or whatever), and if nothing is listening there, the IP stack should respond with either some ICMP error message or possibly a TCP reset or something.

> Wikipedia seems to disagree [0] "if the destination port number of the incoming packet is not found in the translation table, the packet is dropped or rejected because the PAT device doesn't know where to send it."

Well, maybe that is good enough for explaining to a lay audience what a NAT gateway does, because that is what home routers typically will do, because they tend to also have a stateful firewall built in, but it's pretty misleading if you are trying to understand what is actually going on.

> I am sure a NAT could be configured any number of ways, though, and could probably do anything you want with such packets.

Not really, simply by definition: The function of a NAT is the translation of addresses. A router can have many more features, of course, such as a stateful firewall, but the point is that if you only had the address translation functionality, that would not prevent inbound connections, and if you remove the address translation functionality and keep the stateful firewall, inbound connections still aren't possible. Hence, NAT has nothing to do with whether inbound connections are possible, other than that devices that have NAT functionality commonly also have a stateful firewall.

Re: Serveo: Expose Local Servers to the Internet

#110

Post by zAy0LfpBZLC8mAC »

AmericanChopper wrote: post #81
zAy0LfpBZLC8mAC wrote: post #77

Earlier quoted context omitted.

The point is that IP doesn't work how you think it works, but I have no clue what exactly your misconception is, so I don't know what I need to explain to you to make you see the error in your reasoning. And unfortunately, you don't even answer my questions, instead just hand-waving your way through the explanation, ignoring all the details that would show where your misunderstanding lies. In any case, no, if you onl…

> if you only remove NAT from your home router that also has a stateful firewall, nothing changes security-wise. But now I don’t have an internet connection, because none of the devices on my home network have an internet routable IP.

For one, that does not strictly follow, because you can use NAT with globally routable addresses on your home network.

But in any case, the implied assumption was that you also switch to globally routable addresses for all your devices/that we are possibly talking about IPv6, where that would be the norm anyway. The point is that actually usable internet connectivity without NAT and with a stateful firewall has exactly zero differences security-wise vs. a setup that uses NAT and a stateful firewall. That is, except for the fact that all those misconceptions that people have about NAT can make people think that their network is secure when it is not, simply because they have NAT--if you don't have NAT, you can not mistakenly believe that it protects you against inbound connections.

Post reply on HN