Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Putting Raspberry Pi Online with Caddy and SSH Tunnel

gist.github.com

Post reply on HN
Print view View original

81–90 of 157 posts

Re: Putting Raspberry Pi Online with Caddy and SSH Tunnel

#81

Post by swiley »

hnarn wrote: post #78
swiley wrote: post #73

Earlier quoted context omitted.

.local isn't part of a global namespace, it's part of a local namespace. Sure you don't get an interesting name but you do get one.

What I’m trying to say is that if you’re going to have to install additional software, or make additional configuration on the requesting node, it doesn’t really matter if it’s .local or .tor or whatever, because the only reason it works is because you did that extra work: and when you’re in that situation, it doesn’t really make sense to compare it to “paid” domains because the reason you pay for a domain is just th…

I think we're thinking of different use cases.

For me, all my personal machines have TOR installed anyway and I mostly want public address for gluing things together or being able to access things remotely. It's definitely not usable for everything you normally use domain names for (like showing people the menu at a restaurant.)

I will point out that you don't need to do any extra work to access web servers on TOR at least. I think cloudfront (and I know others) run a proxy that lets you access them with just a normal URL via a web browser. Most OSes need no extra configuration for .local.

Re: Putting Raspberry Pi Online with Caddy and SSH Tunnel

#82

Post by johtso »

driverdan wrote: post #79

I did something similar with Wireguard but wasn't able to get it to do what I need. I'm trying to give my VPS access to other computers on my home network. The Pi and my VPS can communicate with each other just fine. For some reason the pi won't forward any packets from the VPS, they just seem to drop. I've scoured all config that I could think of, iptables, network adaptors, Wireguard, but can't find the cause. Anyo…

I set something like this up the other day using ZeroTier rather than Wireguard. Followed the instructions here and it "just worked" https://zerotier.atlassian.net/wiki/spaces/SD/pages/22439527...

The key was enabling IP forwarding, and setting the right iptables rules.

Re: Putting Raspberry Pi Online with Caddy and SSH Tunnel

#83

Post by granra »

driverdan wrote: post #79

I did something similar with Wireguard but wasn't able to get it to do what I need. I'm trying to give my VPS access to other computers on my home network. The Pi and my VPS can communicate with each other just fine. For some reason the pi won't forward any packets from the VPS, they just seem to drop. I've scoured all config that I could think of, iptables, network adaptors, Wireguard, but can't find the cause. Anyo…

Is ip_forward[1] enabled on the rpi?

Also is your home network's cidr in allowed ips on the vps' wireguard interface?

[1]: https://docs.mysirena.xyz/centos-7/prefilight-configuration/...

Re: Putting Raspberry Pi Online with Caddy and SSH Tunnel

#84

Post by tylerfontaine »

nurettin wrote: post #23

I install a reverse proxy on every remote machine (raspberry pi or odroid) I manage. These machines are usually tucked behind someone's router, and it is hard to tell every router owner to forward the ssh port. When I install a reverse proxy, the machines can proactively tunnel right into a beacon machine whenever they are online and I can ssh into them from the beacon machine directly. I usually set up frpc as a ser…

I have started using Tailscale for this purpose. No beacon box required, super easy.

https://tailscale.com/

Re: Putting Raspberry Pi Online with Caddy and SSH Tunnel

#85

Post by jjice »

driverdan wrote: post #79

I did something similar with Wireguard but wasn't able to get it to do what I need. I'm trying to give my VPS access to other computers on my home network. The Pi and my VPS can communicate with each other just fine. For some reason the pi won't forward any packets from the VPS, they just seem to drop. I've scoured all config that I could think of, iptables, network adaptors, Wireguard, but can't find the cause. Anyo…

Have you tried this setting? This worked for me and I use my Pi as a media server and my VPN as a way to get all my machines to connect to it (a hub, I guess).

https://linuxconfig.org/how-to-turn-on-off-ip-forwarding-in-...

If you're running Docker, I believe it sets this by default, but try setting this on your VPS. I don't know enough about devops to know if there is an inherit danger to this, so take my advice with a grain of salt, but this worked for me.

Re: Putting Raspberry Pi Online with Caddy and SSH Tunnel

#86

Post by johtso »

msh wrote: post #80
viraptor wrote: post #61

Earlier quoted context omitted.

As an alternative, you could put it on a public mesh VPN. I use ZeroTier for that so I don't have to host an explicit beacon.

zerotier is nice, but I have migrated to tailscale. Its based on wireguard and seems even better performance wise.

Yeah, tailscale does look nice, only one user on the free tier was a deal-breaker for me though.

Re: Putting Raspberry Pi Online with Caddy and SSH Tunnel

#88

Post by driverdan »

jjice wrote: post #85
driverdan wrote: post #79

I did something similar with Wireguard but wasn't able to get it to do what I need. I'm trying to give my VPS access to other computers on my home network. The Pi and my VPS can communicate with each other just fine. For some reason the pi won't forward any packets from the VPS, they just seem to drop. I've scoured all config that I could think of, iptables, network adaptors, Wireguard, but can't find the cause. Anyo…

Have you tried this setting? This worked for me and I use my Pi as a media server and my VPN as a way to get all my machines to connect to it (a hub, I guess). https://linuxconfig.org/how-to-turn-on-off-ip-forwarding-in-... If you're running Docker, I believe it sets this by default, but try setting this on your VPS. I don't know enough about devops to know if there is an inherit danger to this, so take my advice wit…

Yes, IP forwarding is enabled.

Re: Putting Raspberry Pi Online with Caddy and SSH Tunnel

#89

Post by driverdan »

granra wrote: post #83
driverdan wrote: post #79

I did something similar with Wireguard but wasn't able to get it to do what I need. I'm trying to give my VPS access to other computers on my home network. The Pi and my VPS can communicate with each other just fine. For some reason the pi won't forward any packets from the VPS, they just seem to drop. I've scoured all config that I could think of, iptables, network adaptors, Wireguard, but can't find the cause. Anyo…

Is ip_forward[1] enabled on the rpi? Also is your home network's cidr in allowed ips on the vps' wireguard interface? [1]: https://docs.mysirena.xyz/centos-7/prefilight-configuration/...

Yes, IP forwarding is enabled and my home network is set under AllowedIPs.

Re: Putting Raspberry Pi Online with Caddy and SSH Tunnel

#90

Post by antoniomika »

Up until about 2 years ago, I used to use the same method as you've listed! Actually, I still use this method, but do it a bit differently. I have a ZeroTier network setup to connect a VM and RPI for internal communication, then I use nginx with the stream module [1] in order to do SNI proxying down to the RPI from the VM over the internal ZT network.

Why use the stream module vs the normal proxy module you might ask? You can forward TLS connections down to an edge device without needing to have the TLS certs on the cloud server. This is especially useful so I can easily share the VM with other people without having to worry about if they can intercept my network traffic, while still being able to host other things on the machine. This also has the added benefit of allowing me to forward full wildcard subdomains down to the edge device without having to create a new config entry for it each time.

Now, I use (shameless self plug) sish [2] to set this up. It uses SSH, so I get the added benefit of all of the above, but I don't really worry about using an internal network for ingress communication. It's also very easy to share the service with friends/coworkers so they can get the added benefit of it too. I also make use of the loadbalancing feature for test pi clusters when doing distributed testing which is a breeze now.

There are a bunch of these popping up now which I'm happy to see (serveo, remotemoe, even ngrok has a SSH gateway!) so there's a ton of competition here. I definitely recommend checking at least one of them out since they're pretty easy to setup and can be used in a variety of ways!

[1] http://nginx.org/en/docs/stream/ngx_stream_core_module.html [2] https://github.com/antoniomika/sish

Post reply on HN