5 ms·

I've been diving pretty deep into networking recently, especially from a self-hosting perspective. Self-hosting tends to turn into a mess of domain name registr

I've been diving pretty deep into networking recently, especially from a self-hosting perspective. Self-hosting tends to turn into a mess of domain name registration, VPS management, TLS cert management, dyndns, port forwarding, hole punching, etc etc[0]. I think technologies like WireGuard are going to play an important role in reducing that complexity (once we get some higher abstractions). I started a list of useful software I've found in this space here[1]. [0]: https://news.ycombinator.com/item?id=24475946 https://news.ycombinator.com/item?id=24475946 [1]: https://github.com/anderspitman/awesome-tunneling https://github.com/anderspitman/awesome-tunneling

mrkurt 6y ago
We're building most everything on bare metal at Fly.io and it's the exact same deal. Wireguard is great for our infrastructure. Your GitHub list is super handy. :)
3np 6y ago
I'm in the exact same phase - been doing hosting/ops/sysadmin for most of my life but only starting to pay serious attention to the networking since recently. Something I've yet come up with a good solution for that I feel should be much more common and simple, maybe you can point me to the right direction for (and maybe the answer is iptables, urgh): (Containerized) P2P software that should be routed through some other endpoint before reaching/beaing reachable from the network. Example: Bitcoin full node or Bittorrent node running in a Docker container on one of my home servers (where the host runs other software too). For all intents and purposes I want the nodes to route traffic through a VPS in some other DC (in this case bridged via wireguard). Incoming's easy enough with reverse proxies/load balancers, but with all the UDP traffic on random ports, outgoing TCP connections, etc, I haven't figured out a way to make it not leak my IP in some way. Feels this should be dead easy but I'm stumped. Oh, and assume no support of SOCKS proxies in the software itself. I'm aware of hidden onion services but talking clearnet here.
- nprateem 6y ago
  Run it on a lightweight k8s (eg k3s) on your machine then use iptables to forward all traffic from k8s to your VPS
  - 3np 6y ago
    I'm using some other orchestration than k8s/k3s (and regardless different deployments should have different entrypoints). But yeah, maybe the real answer is "iptables" and I just have to step up my game a bit to grok it.
    - nprateem 6y ago
      K8s means you'll have a single source IP for all your application's traffic so you can just forward it all upstream instead of having to hunt for which ports it actually uses
      - 3np 6y ago
        Right, but I'm not going to use kubernetes, and I only want this for certain containers. Maybe there's a solution for this with CNI, though?
- anderspitman 6y ago
  Yeah sorry, I can't think of anything to solve that. But it does have me thinking that I bet someone out there has made a wrapper program that intercepts network system calls (using LD_PRELOAD hacks) from a target executable and routes them all through a specific interface. Failing that, you're probably stuck with iptables and maybe Linux namespaces.
puzzlingcaptcha 6y ago
Yeah, a VPN gateway on a VPS does away with a lot of that complexity. Having your LAN devices in the same virtual network makes dyndns, hole punching and port forwarding largely unnecessary. However, I still view wrapper scripts that you are supposed to curl | bash with some suspicion. I have a simple IPSec setup with strongswan and frankly I did not find the documentation to be as daunting as people make it out to be. If there is a certbot plugin [1] for your DNS provider's API then renewal of TLS certs is a matter of a single cronjob with some hooks for other services. I set it up 18 months ago and it has never failed to renew. [1] https://certbot.eff.org/docs/using.html?highlight=dns#dns-plugins https://certbot.eff.org/docs/using.html?highlight=dns#dns-pl...

mrkurt 6y ago

We're building most everything on bare metal at Fly.io and it's the exact same deal. Wireguard is great for our infrastructure. Your GitHub list is super handy. :)

3np 6y ago

I'm in the exact same phase - been doing hosting/ops/sysadmin for most of my life but only starting to pay serious attention to the networking since recently. Something I've yet come up with a good solution for that I feel should be much more common and simple, maybe you can point me to the right direction for (and maybe the answer is iptables, urgh): (Containerized) P2P software that should be routed through some other endpoint before reaching/beaing reachable from the network. Example: Bitcoin full node or Bittorrent node running in a Docker container on one of my home servers (where the host runs other software too). For all intents and purposes I want the nodes to route traffic through a VPS in some other DC (in this case bridged via wireguard). Incoming's easy enough with reverse proxies/load balancers, but with all the UDP traffic on random ports, outgoing TCP connections, etc, I haven't figured out a way to make it not leak my IP in some way. Feels this should be dead easy but I'm stumped. Oh, and assume no support of SOCKS proxies in the software itself. I'm aware of hidden onion services but talking clearnet here.

nprateem 6y ago
Run it on a lightweight k8s (eg k3s) on your machine then use iptables to forward all traffic from k8s to your VPS
- 3np 6y ago
  I'm using some other orchestration than k8s/k3s (and regardless different deployments should have different entrypoints). But yeah, maybe the real answer is "iptables" and I just have to step up my game a bit to grok it.
  - nprateem 6y ago
    K8s means you'll have a single source IP for all your application's traffic so you can just forward it all upstream instead of having to hunt for which ports it actually uses
    - 3np 6y ago
      Right, but I'm not going to use kubernetes, and I only want this for certain containers. Maybe there's a solution for this with CNI, though?
anderspitman 6y ago
Yeah sorry, I can't think of anything to solve that. But it does have me thinking that I bet someone out there has made a wrapper program that intercepts network system calls (using LD_PRELOAD hacks) from a target executable and routes them all through a specific interface. Failing that, you're probably stuck with iptables and maybe Linux namespaces.

puzzlingcaptcha 6y ago

Yeah, a VPN gateway on a VPS does away with a lot of that complexity. Having your LAN devices in the same virtual network makes dyndns, hole punching and port forwarding largely unnecessary. However, I still view wrapper scripts that you are supposed to curl | bash with some suspicion. I have a simple IPSec setup with strongswan and frankly I did not find the documentation to be as daunting as people make it out to be. If there is a certbot plugin [1] for your DNS provider's API then renewal of TLS certs is a matter of a single cronjob with some hooks for other services. I set it up 18 months ago and it has never failed to renew. [1] https://certbot.eff.org/docs/using.html?highlight=dns#dns-plugins https://certbot.eff.org/docs/using.html?highlight=dns#dns-pl...