3 ms·

To hijack the thread a bit, what's your favorite way of accessing your home server that's behind a NAT (and you can't port-forward)?

by dmos62 7y ago

whisk3rs 7y ago
Try a Tor hidden service, configured with the low-latency/lower-privacy settings. It is slower than many of the other solutions, but very reliable and very simple.
krazykringle 7y ago
Zerotier (mentioned below) is perfect for this! To expand a little bit: it provides an (almost) zero-configuration way to set up a private 'layer 2' network that you can connect your home server to, and any other machines that you want to be able to connect to it or to each other. It handles NAT traversal completely transparently. In practice, it means that if I have a (say) NFS server connected to a Zerotier network I control, I can connect to it transparently from anywhere from another machine on that network, no matter what NATs / firewalls either machine is behind, even if they change. Perfect for phones, roving laptops, etc. I've gone to a model where I do most of my development (over mosh/tmux) on my home machine, from wherever I happen to be. No home firewall configuration needed at all.
- johntash 7y ago
  +1 for Zerotier. I really like wireguard, but Zerotier is so much easier and quicker to set up from scratch. If wireguard had ACLs and ipam built-in, it probably would probably win me over.
- tbyehl 7y ago
  I've long been confused about Wireguard getting all the attention over ZeroTier. ZT is so good at finding a communications path that I had to figure out how to block it from traversing one of my IPSec tunnels.
- finchisko 7y ago
  Maybe because it's not open source, only free for personal use?
  - politelemon 7y ago
    According to their pricing page, > ZeroTier’s software is open source and free to use for most purposes including personal use, internal use within a business or academic institution, and evaluation for uses that require commercial licensing. I was able to find this: https://github.com/zerotier/ZeroTierOne https://github.com/zerotier/ZeroTierOne
    - mcfedr 7y ago
      That sentence is an contradiction, it's either open source or requires a commercial license, cannot be both.
  - Youden 7y ago
    It's open source (https://github.com/zerotier https://github.com/zerotier) but not Free Software.
ecnahc515 7y ago
I usually setup a reverse ssh tunnel from the destination to a VPS I own. For example, you could setup a reverse tunnel to sshd on the destination, exposing sshd of the destination on the VPS, to which I ssh and specfiy the VPS hostname + the reverse tunnel port, which tunnels me ssh the destination host. Also, if you can't open ports outbound at all, there's https://samy.pl/pwnat/ https://samy.pl/pwnat/ but it makes things very slow.
wcip 7y ago
I use a jump box. RDP to the box and access everything else from there.
DCKing 7y ago
Wireguard! And a VPS and HAProxy. You can use Wireguard to do remote port forwarding. Follow a tutorial [0] to expose the home server's port on a VPS. Now use HAProxy to reverse proxy that Wireguard port to the world. [0]: https://staaldraad.github.io/2017/04/17/nat-to-nat-with-wireguard/ https://staaldraad.github.io/2017/04/17/nat-to-nat-with-wire... - you can ignore 'NAT-B' in this one.

To hijack the thread a bit, what's your favorite way of accessing your home server that's behind a NAT (and you can't port-forward)?

by dmos62 7y ago

To hijack the thread a bit, what's your favorite way of accessing your home server that's behind a NAT (and you can't port-forward)?

whisk3rs 7y ago

Try a Tor hidden service, configured with the low-latency/lower-privacy settings. It is slower than many of the other solutions, but very reliable and very simple.

krazykringle 7y ago

Zerotier (mentioned below) is perfect for this! To expand a little bit: it provides an (almost) zero-configuration way to set up a private 'layer 2' network that you can connect your home server to, and any other machines that you want to be able to connect to it or to each other. It handles NAT traversal completely transparently. In practice, it means that if I have a (say) NFS server connected to a Zerotier network I control, I can connect to it transparently from anywhere from another machine on that network, no matter what NATs / firewalls either machine is behind, even if they change. Perfect for phones, roving laptops, etc. I've gone to a model where I do most of my development (over mosh/tmux) on my home machine, from wherever I happen to be. No home firewall configuration needed at all.

johntash 7y ago
+1 for Zerotier. I really like wireguard, but Zerotier is so much easier and quicker to set up from scratch. If wireguard had ACLs and ipam built-in, it probably would probably win me over.
tbyehl 7y ago
I've long been confused about Wireguard getting all the attention over ZeroTier. ZT is so good at finding a communications path that I had to figure out how to block it from traversing one of my IPSec tunnels.
finchisko 7y ago
Maybe because it's not open source, only free for personal use?
- politelemon 7y ago
  According to their pricing page, > ZeroTier’s software is open source and free to use for most purposes including personal use, internal use within a business or academic institution, and evaluation for uses that require commercial licensing. I was able to find this: https://github.com/zerotier/ZeroTierOne https://github.com/zerotier/ZeroTierOne
  - mcfedr 7y ago
    That sentence is an contradiction, it's either open source or requires a commercial license, cannot be both.
- Youden 7y ago
  It's open source (https://github.com/zerotier https://github.com/zerotier) but not Free Software.

ecnahc515 7y ago

I usually setup a reverse ssh tunnel from the destination to a VPS I own. For example, you could setup a reverse tunnel to sshd on the destination, exposing sshd of the destination on the VPS, to which I ssh and specfiy the VPS hostname + the reverse tunnel port, which tunnels me ssh the destination host. Also, if you can't open ports outbound at all, there's https://samy.pl/pwnat/ https://samy.pl/pwnat/ but it makes things very slow.

wcip 7y ago

I use a jump box. RDP to the box and access everything else from there.

DCKing 7y ago

Wireguard! And a VPS and HAProxy. You can use Wireguard to do remote port forwarding. Follow a tutorial [0] to expose the home server's port on a VPS. Now use HAProxy to reverse proxy that Wireguard port to the world. [0]: https://staaldraad.github.io/2017/04/17/nat-to-nat-with-wireguard/ https://staaldraad.github.io/2017/04/17/nat-to-nat-with-wire... - you can ignore 'NAT-B' in this one.