Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Locally hosting an internet-connected server

mjg59.dreamwidth.org

Post reply on HN
Print view View original

21–30 of 183 posts

Re: Locally hosting an internet-connected server

#21

Post by baobun »

mjg59 wrote: post #5
kinduff wrote: post #3

This is an interesting solution and wouldn't mind using one of my existing servers as a gateway or proxy (?). Is there a way to be selective about what ports are exposed from the host to the target? The target could handle it but fine grained control is nice.

You could just set a default deny iptables policy for forwarding to that host, and then explicitly open the ports you want

iptables is legacy now and if you're not already well-versed in it, better go straight to nftables (which should be easier to get started with anyway). On modern systems, iptables commands are translated to nftables equivalents by transitional package.

Re: Locally hosting an internet-connected server

#22

Post by baobun »

mjg59 wrote: post #9
lazylizard wrote: post #6

you can also run a proxy on the vps instead of the nat.

Depends on the protocol. For web, sure - for ssh, nope, since the protocol doesn't indicate which machine it's trying to connect to and so you don't know where to proxy it to.

You can still TCP proxy SSH just fine (one port per target host obv)

Certain UDP-based protocols may be hairier, though.

Re: Locally hosting an internet-connected server

#23

Post by neepi »

messe wrote: post #18
DougN7 wrote: post #2

Why not use a dynamic DNS service instead? I’ve been using dyn.com (now oci.dyn.com) for years and it has worked great. A bonus is many home routers have support built in.

Only works if you're not behind CGNAT, which has problems in and of itself. I pay my ISP an extra 29 DKK (about 4.50 USD at the moment) for a static address; my IPv4 connections and downloads in-general became way more stable after getting out from behind CGNAT.

CGNAT is hell. Here I had to choose between crap bandwidth or CGNAT. I chose crap bandwidth.

Re: Locally hosting an internet-connected server

#24

Post by Daviey »

The commentents suggest Tailscale, but the author assumes this could only mean Funnel, but you could use Tailscale/Headscale for handling the wiregiard and low-level networking / IP Allocation.

Then doing straight-forward iptables or L7, or reverse proxy via Caddy, Nginx, etc, directly to the routable IP address.

The outcome is the ~same, bonus is not having to handle the lower level component, negative is an extra "thing" to manage.

But this is how I do the same thing, and i'm quite happy with the result. I can also trivially add additional devices, and even use it for egress, giving me a good pool of exit-IP addresses.

(Note, I was going to add this as a comment on the blog, but it seems their captcha service is broken would not display - so it was blocked)

Re: Locally hosting an internet-connected server

#25

Post by koolba »

mjg59 wrote: post #19
herbst wrote: post #16

Earlier quoted context omitted.

You can port forward SSH to other internal machines, just like nginx + web.

I can port forward port 22 to a single machine. I can't proxy port 22 in a way that directs the incoming connection to the correct machine, at least not without client configuration.

You only need one inbound machine as your bastion. Then hop from there to the rest using local address. Once you set up the proxy config in ssh it’s completely transparent.

Re: Locally hosting an internet-connected server

#26

Post by mjg59 »

koolba wrote: post #25
mjg59 wrote: post #19

Earlier quoted context omitted.

I can port forward port 22 to a single machine. I can't proxy port 22 in a way that directs the incoming connection to the correct machine, at least not without client configuration.

You only need one inbound machine as your bastion. Then hop from there to the rest using local address. Once you set up the proxy config in ssh it’s completely transparent.

Right yes but I (for various reasons) end up using a lot of different client systems and I don't want to have to configure all of them to transparently jumphost or use different port numbers and why are people spending so much time trying to tell me that I should make my life complicated in a different way to the one I've chosen?

Re: Locally hosting an internet-connected server

#27

Post by zokier »

Yeah, this is the way to do this. I'm pretty sure that if you for some reason do not want to run wireguard on all your servers you could fairly easily adjust this recipe to have a centralized wg gateway on your local network instead.

I think I've seen some scripts floating around to automate this process but can't remember where. There are lots of good related tools listed here: https://github.com/anderspitman/awesome-tunneling

Re: Locally hosting an internet-connected server

#29

Post by JdeBP »

This and the comments highlight how bad many ISPs in North America and Western Europe are at IPv6, still, in 2025, and the lengths to which people will go to treat that as damage and literally route around it.

One of the biggest ISPs in my country has been promising IPv6 since 2016. Another, smaller, competitor, advertised on "World IPv6 Day" in 2011 that it was way ahead of the competition on supplying IPv6; but in fact does not supply it today.

One of the answers I see given a lot over the years is: Yes, I know that I could do this simply with IPv6. But ISPs around here don't route IPv6, or even formally provide statically-assigned IPv4 to non-business customers. So I have had to build this Heath Robinson contraption instead.

Re: Locally hosting an internet-connected server

#30

Post by mjg59 »

JdeBP wrote: post #29

This and the comments highlight how bad many ISPs in North America and Western Europe are at IPv6, still , in 2025, and the lengths to which people will go to treat that as damage and literally route around it. One of the biggest ISPs in my country has been promising IPv6 since 2016. Another, smaller, competitor, advertised on "World IPv6 Day" in 2011 that it was way ahead of the competition on supplying IPv6; but in…

Pretty much! My ISP was founded by https://en.wikipedia.org/wiki/Rudy_Rucker and is somewhat cheap and delightful and happily routes me a good amount of IPv6, and every 48 hours or so it RAs me an entirely different range even though I still have validity on the lease for the old one and everything breaks, so I've had to turn IPv6 off entirely (I sent dumps of the relevant lease traffic to support, they said they'd look into it, and then the ticket auto closed after being inactive for two years). I spent a while trying to make things work with IPv6 but the combination of it being broken at my end and also there still being enough people I want to provide access to who don't have it means it just wasn't a good option.
Post reply on HN