111–120 of 157 posts
Earlier quoted context omitted.
Privacy; keep data local, without exposing your residential IP.
Is exposing one's residential IP address such a bad thing? Is the threat model just that someone might wish to target you individually, and that they'll have better luck finding a vuln into your LAN if your services are listening directly on public ports?
This isn't quite what GatewayPorts does. By default, the client can open a tunnel to any ports the user has access to, but those ports can only be connected to from localhost on the server. So even if you don't have a firewall, external IPs can't connect to your tunnel (but your reverse proxy can, if it's running on the same machine). You can use GatewayPorts to allow binding from other IPs. This is useful if you want to tunnel arbitrary TCP traffic, not just HTTP through your reverse proxy.
I wish we were a little farther along so I'd have more to say, but we're hoping to solve this with https://hoppy.network/ . It's nothing you couldn't do yourself, but we host it for you so you don't have to. We host WireGuard servers which assign a stable public IPv4 and IPv6 on your device's WireGuard tunnel interface. As far as your device is concerned, it's like its tunnel interface is a publicly addressable conne…
I like it. Forwarding public ips through WireGuard is a nice level of abstraction. I maintain a list of tunneling solutions here: https://github.com/anderspitman/awesome-tunneling Happy to add hoppy if you think you're a good fit and submit a PR. A couple questions: * Do you provide any sort of reverse proxy service, ie HTTPS termination with Let's Encrypt support, similar to OP? * Do you provide any DNS integration…
A subdomain (*.hoppy.link) for the tunnelled IP address provided can be created if you send us a support email.
We do not provide any reverse proxy, but it could be a possibility if there is demand.
Tailscale uses the non-routable IP space, and is strictly for private networks, and cannot publish to public networks.
Am I correct that Wireguard and SSH are the more secure options?
I install a reverse proxy on every remote machine (raspberry pi or odroid) I manage. These machines are usually tucked behind someone's router, and it is hard to tell every router owner to forward the ssh port. When I install a reverse proxy, the machines can proactively tunnel right into a beacon machine whenever they are online and I can ssh into them from the beacon machine directly. I usually set up frpc as a ser…
As an alternative, you could put it on a public mesh VPN. I use ZeroTier for that so I don't have to host an explicit beacon.
Earlier quoted context omitted.
As an alternative, you could put it on a public mesh VPN. I use ZeroTier for that so I don't have to host an explicit beacon.
zerotier is nice, but I have migrated to tailscale. Its based on wireguard and seems even better performance wise.
I hadn't considered that, but it makes sense. Since ZeroTier is layer 2, I'd expect it to become a leaky abstraction (at least for performance) in certain cases where algorithms are expecting other layer 2 hardware to be essentially directly connected with a wire when in reality they're connected over the internet.
Up until about 2 years ago, I used to use the same method as you've listed! Actually, I still use this method, but do it a bit differently. I have a ZeroTier network setup to connect a VM and RPI for internal communication, then I use nginx with the stream module [1] in order to do SNI proxying down to the RPI from the VM over the internal ZT network. Why use the stream module vs the normal proxy module you might ask…
A comparison of the security of these several approaches would be helpful. Am I correct that Wireguard and SSH are the more secure options?
I don't get it, I may be missing some context thought: why the author didn't go for running said webapps directly on the VPS in the first place? Why bother running it on the Pi and set up the tunnel (which is a nice hack in itself, I get that)?
1. I have much better hardware in my house than any VPS can offer at a competitive price. This is particularly important for storage. Object storage like S3 is relatively cheap, but I just want a file system I can slap a static server (or whatever else I want) in front of. If you go for full block storage the price is way higher, and performance still isn't as good as a local SSD.
2. I hope the future of the internet involves more people self hosting over IPv6. I see tunneling solutions as an intermediate step to that world. If we make it easy for people to self host, it might even be able to help drive IPv6 adoption.
At this point you are pretty close to just being able to use your VPS for whatever you wanted to do access remotely. I have tried a ssh port forward solution earlier, but the connection fell down, did not always come up after boot and was generally unreliable. I found wireguard to be much easier to set up and highly reliable. It's in my own opinion not that hard to set up either, there are plenty of guides. The wireg…
WireGuard is a great solution, but I have heard people speak highly of autossh, which I believe may solve this.