An esoteric alternative is to host a Tor hidden service.
Tor hidden services don't require you open ports, and you don't need a static IP address.
Your residential IP is protected by the onion router, and the .onion domain name is free!
Putting Raspberry Pi Online with Caddy and SSH Tunnel
21–30 of 157 posts
Re: Putting Raspberry Pi Online with Caddy and SSH Tunnel
#22I have a similar setup but instead of SSH Tunnels i use wireguard. In my case some services are not routed to the public internet and only accessible from within my privat wireguard network. E.g my smart home hub. I really like the flexibility to decide whats available for who.
Could you please elaborate on your setup? I haven't had the opportunity to play with Wireguard yet, that could be a useful first project to me :-)
Re: Putting Raspberry Pi Online with Caddy and SSH Tunnel
#23I install a reverse proxy on every remote machine (raspberry pi or odroid) I manage. These machines are usually tucked behind someone's router, and it is hard to tell every router owner to forward the ssh port. When I install a reverse proxy, the machines can proactively tunnel right into a beacon machine whenever they are online and I can ssh into them from the beacon machine directly. I usually set up frpc as a service on the remote machine. It is also possible to use autossh with a monitoring port for this, but I noticed that frpc can bypass firewall restrictions much easier. This scheme also lets me use tools like Cockpit to view the health and status of my remotes.
Re: Putting Raspberry Pi Online with Caddy and SSH Tunnel
#24Earlier quoted context omitted.
The solution in TFA works behind NAT and routers/firewalls, and has the added benefit of encrypting all of the traffic between the two machines thanks to SSH. I’m not sure people who aren’t network administrators should be putting public IPv6 all over their LAN behind their router, at least not until v6 is more common and routers have better inbound security features for such things (like how NAT functions today for…
NAT like security for IPv6 is just dumb. We should always configure firewall for v4 and V6. NAT is not for security!! It has different purpose which is now being taken care by V6 and NAT should just die.
Yes, BUT: for many many years, home networks have relied primarily on NAT for security. The firewall was only ever touched when doing something advanced and even people who were doing things like setting up home servers and such rarely had to deal with it.
Every single tutorial on the topic is IPv4-specific and until IPv6 isn't more common, people will not write guides and tutorials with IPv6 in mind. So until the knowledge of proper security on open networks is common enough among home tinkerers, we should not be recommending people just throw everything straight onto the open Internet.
Re: Putting Raspberry Pi Online with Caddy and SSH Tunnel
#25This can be optimized easy with AutoSSH or "VPN TUN/TAP over SSH"
Re: Putting Raspberry Pi Online with Caddy and SSH Tunnel
#26I have a similar setup but instead of SSH Tunnels i use wireguard. In my case some services are not routed to the public internet and only accessible from within my privat wireguard network. E.g my smart home hub. I really like the flexibility to decide whats available for who.
Could you please elaborate on your setup? I haven't had the opportunity to play with Wireguard yet, that could be a useful first project to me :-)
Pivpn is beginner-friendly and you can always branch off from there.
Re: Putting Raspberry Pi Online with Caddy and SSH Tunnel
#27I think a better option would be to create a Wireguard tunnel between Raspberry Pi and the remote server instead of a SSH Tunnel. Then there is no need to add or change ports and restart the tunnel for every service.
while i think this is true (any other vpn software would work too though) i want to point out that you actually can bring up a tun interface using ssh with the "-w local_tun[:remote_tun]" flag somewhat easily if you want to. It is also possible to make forwarding work in either direction using an integrated socks proxy using "-R" or "-D" flags ...
Re: Putting Raspberry Pi Online with Caddy and SSH Tunnel
#28I install a reverse proxy on every remote machine (raspberry pi or odroid) I manage. These machines are usually tucked behind someone's router, and it is hard to tell every router owner to forward the ssh port. When I install a reverse proxy, the machines can proactively tunnel right into a beacon machine whenever they are online and I can ssh into them from the beacon machine directly. I usually set up frpc as a ser…
Just so that I understand the setup, this still requires one intermediate box - the beacon machine - to be running?
Re: Putting Raspberry Pi Online with Caddy and SSH Tunnel
#29I install a reverse proxy on every remote machine (raspberry pi or odroid) I manage. These machines are usually tucked behind someone's router, and it is hard to tell every router owner to forward the ssh port. When I install a reverse proxy, the machines can proactively tunnel right into a beacon machine whenever they are online and I can ssh into them from the beacon machine directly. I usually set up frpc as a ser…
Just so that I understand the setup, this still requires one intermediate box - the beacon machine - to be running?
That's how I understand it. Basically you have a machine hosted somewhere with a dedicated IP so you can access all remote machines from anywhere at any time, as long as they are connected to it via reverse proxy.
Re: Putting Raspberry Pi Online with Caddy and SSH Tunnel
#30I install a reverse proxy on every remote machine (raspberry pi or odroid) I manage. These machines are usually tucked behind someone's router, and it is hard to tell every router owner to forward the ssh port. When I install a reverse proxy, the machines can proactively tunnel right into a beacon machine whenever they are online and I can ssh into them from the beacon machine directly. I usually set up frpc as a ser…
Just so that I understand the setup, this still requires one intermediate box - the beacon machine - to be running?
It does require the beacon machine to be up, but the system easily recovers from a reboot of the beacon, since frpc will keep on trying to reconnect. It is a poor man's firewall-resilient one-way vpn.