Putting Raspberry Pi Online with Caddy and SSH Tunnel • Hacker News Board

Re: Putting Raspberry Pi Online with Caddy and SSH Tunnel

#41

Post by fogihujy » Mon, Oct 26, 2020, 11:11 AM UTC

kzrdude wrote: post #31

quaintdev wrote: post #20

Earlier quoted context omitted.

NAT like security for IPv6 is just dumb. We should always configure firewall for v4 and V6. NAT is not for security!! It has different purpose which is now being taken care by V6 and NAT should just die.

Security has layers, no layer has to be perfect. What's wrong with having NAT as an obscurity layer?

The problem is that many people use NAT as the only line of defense, and that model fails utterly once IPv6 comes into the picture.

There's nothing wrong in using NAT to increase the cost of attack as a part of a larger defence strategy.

Re: Putting Raspberry Pi Online with Caddy and SSH Tunnel

#42

Post by fooblat » Mon, Oct 26, 2020, 11:13 AM UTC

As there isn't a single thing that is Raspberry Pi specific here, the title would be better written as

     Tunnel Public Internet Traffic To A Home Linux System via An Intermediary SSH Server

Re: Putting Raspberry Pi Online with Caddy and SSH Tunnel

#43

Post by floatingsmoke » Mon, Oct 26, 2020, 11:14 AM UTC

I use Cloudflare Argo Tunnel for this purpose and am very satisfied. It's easy to setup and if you have TLD on Cloudflare, the daemon(cloudflared) creates new A record for each host and creates a tunnel between your host and the nearest Cloudflare data center. You can also run multiple services on a single host. And all these connections are secure.

Re: Putting Raspberry Pi Online with Caddy and SSH Tunnel

#44

Post by culopatin » Mon, Oct 26, 2020, 11:45 AM UTC

Side conversation: I'm interested in being pretty good at this sort of thing: setting up servers, making them connect, understand the protocols enough to put them to practice. I believe this is in the realm of IT. What are some good resources to read to get to my goal? Thanks!

Re: Putting Raspberry Pi Online with Caddy and SSH Tunnel

#45

Post by nsomaru » Mon, Oct 26, 2020, 11:56 AM UTC

culopatin wrote: post #44

Side conversation: I'm interested in being pretty good at this sort of thing: setting up servers, making them connect, understand the protocols enough to put them to practice. I believe this is in the realm of IT. What are some good resources to read to get to my goal? Thanks!

A thorough understanding of the OSI model would go a long way

Re: Putting Raspberry Pi Online with Caddy and SSH Tunnel

#46

Post by loa_in_ » Mon, Oct 26, 2020, 11:57 AM UTC

hnarn wrote: post #40

belzebalex wrote: post #21

An esoteric alternative is to host a Tor hidden service. Tor hidden services don't require you open ports, and you don't need a static IP address. Your residential IP is protected by the onion router, and the .onion domain name is free!

> the .onion domain name is free! I mean, you’re technically correct, but isn’t this kind of like saying that the .local TLD is free of charge? It’s “free” because it’s not a part of the “normal” internet.

But .local aren't resolved by any public DNS server, so when outside your bubble you won't have them pointing where you expect while Tor names resolve whenever you can get connected to Tor Network

Re: Putting Raspberry Pi Online with Caddy and SSH Tunnel

#47

Post by bpizzi » Mon, Oct 26, 2020, 12:04 PM UTC

I don't get it, I may be missing some context thought: why the author didn't go for running said webapps directly on the VPS in the first place? Why bother running it on the Pi and set up the tunnel (which is a nice hack in itself, I get that)?

Re: Putting Raspberry Pi Online with Caddy and SSH Tunnel

#48

Post by hnarn » Mon, Oct 26, 2020, 12:08 PM UTC

loa_in_ wrote: post #46

hnarn wrote: post #40

Earlier quoted context omitted.

> the .onion domain name is free! I mean, you’re technically correct, but isn’t this kind of like saying that the .local TLD is free of charge? It’s “free” because it’s not a part of the “normal” internet.

But .local aren't resolved by any public DNS server, so when outside your bubble you won't have them pointing where you expect while Tor names resolve whenever you can get connected to Tor Network

Yeah, my point was just that if your host name is not a part of any “normal” or public DNS resolution, the point of it being free is kind of moot.

Re: Putting Raspberry Pi Online with Caddy and SSH Tunnel

#49

Post by lights0123 » Mon, Oct 26, 2020, 12:11 PM UTC

bpizzi wrote: post #47

I don't get it, I may be missing some context thought: why the author didn't go for running said webapps directly on the VPS in the first place? Why bother running it on the Pi and set up the tunnel (which is a nice hack in itself, I get that)?

Something that requires LAN connectivity: media library off a local NAS (e.g. Plex), generic storage (e.g. Nextcloud), or home automation (e.g. Home Assistant).

Re: Putting Raspberry Pi Online with Caddy and SSH Tunnel

#50

Post by crusso » Mon, Oct 26, 2020, 12:13 PM UTC

bpizzi wrote: post #47

I don't get it, I may be missing some context thought: why the author didn't go for running said webapps directly on the VPS in the first place? Why bother running it on the Pi and set up the tunnel (which is a nice hack in itself, I get that)?

Perhaps the Raspberry Pi is used to control a robot, collect sensor data, whatever. Perhaps it was just for the fun of it.

I've used similar techniques for doing a wide variety of operational tasks, so it can be worth it to take the time to figure out how to easily set up tunnels and reverse proxies.