161–170 of 422 posts
Never expose your server IP directly to the internet, vps or baremetal.
Unless you need it to be reachable from the Internet, at which point it has to be... reachable from the Internet.
Backend access trivial with Tailscale, etc.
Never expose your server IP directly to the internet, vps or baremetal.
Any server? How do you run a public website? Even if you put it behind a load balancer, the load balancer is still a “server exposed to the internet”
Backend access trivial with Tailscale, etc.
Public IP never needs to be used. You can just leave it an internal IP if you really want.
Never expose your server IP directly to the internet, vps or baremetal.
You're going to hate this thing called DNS
DNS is no issue. External DNS can be handled by Cloudflare and their waf. Their DNS service can can obsfucate your public IP, or ideally not need to use it at all with a Cloudflare tunnel installed directly on the server. This is free.
Backend access trivial with Tailscale, etc.
Public IP doesn't always need to be used. You can just leave it an internal IP if you really want.
Earlier quoted context omitted.
Any server? How do you run a public website? Even if you put it behind a load balancer, the load balancer is still a “server exposed to the internet”
Public facing services routed through a firewall or waf (cloudflare) always. Backend access trivial with Tailscale, etc. Public IP never needs to be used. You can just leave it an internal IP if you really want.
Never expose your server IP directly to the internet, vps or baremetal.
Is there a way to do that and still be able to access the server?
Free way - sign up for a cloudflare account. Use the DNS on cloudflare, they wil put their public ip in front of your www.
Level 2 is install the cloudflare tunnel software on your server and you never need to use the public IP.
Backend access securely? Install Tailscale or headscale.
This should cover most web hosting scenarios. If there's additional ports or services, tools like nginx proxy manager (web based) or others can help. Some people put them on a dedicated VPS as a jump machine.
This way using the Public IP can almost be optional and locked down if needed. This is all before running a firewall on it.
Earlier quoted context omitted.
Yes, cloudflare tunnels do this, but I don't think it's really necessary for this. I use them for self-hosting.
That server is still exposed to the internet on a public IP. Just only known and courted through a 3rd party's castle.
If you are using Cloudflare's DNS they can hide your IP on the dns record but it would still have to be locked down but some folks find ways to tighten that up too.
If you're using a bare metal server it can be broken up.
It's fair that it's a 3rd party's castle. At the same time until you know how to run and secure a server, some services are not a bad idea.
Some people run pangolin or nginx proxy manager on a cheap vps if it suits their use case which will securely connect to the server.
We are lucky that many of these ideas have already been discovered and hardened by people before us.
Even when I had bare metal servers connected to the internet, I would put a firewall like pfsense or something in between.
Earlier quoted context omitted.
Is there a way to do that and still be able to access the server?
Yes, CloudFlare ZeroTrust. It's entirely free, I use it for loads of containers on multiple hosts and it works perfectly.
Never expose your server IP directly to the internet, vps or baremetal.
As in "always run a network firewall" or "keep the IP secret"? Because I've had people suggest both and one is silly.
Keeping the IP secret seems like a misnomer.
Its often possible to lock down the public IP entirely to not accept connections except what's initiated from the inside (like the cloudflare tunnel or otherwise reaching out).
Something like a Cloudflare+tunnel on one side, tailscale or something to get into it on the other.
Folks other than me have written decent tutorials that have been helpful.
Earlier quoted context omitted.
There would be, but a lot of docker containers are misconfigured or unnecessarily privileged, allowing for escape. Also, if you've been compromised, you may have a rootkit that hides itself from the filesystem, so you can't be sure of a file's existence through a simple `ls` or `stat`.
> but a lot of docker containers are misconfigured or unnecessarily privileged, allowing for escape Honestly, citation needed. Very rare unless you're literally giving the container access to write to /usr/bin or other binaries the host is running, to reconfigure your entire /etc, access to sockets like docker's, or some other insane level of over reach I doubt even the least educated docker user would do. While of c…