4 ms·
I install a reverse proxy on every remote machine (raspberry pi or odroid) I manage. These machines are usually tucked behind someone's router, and it is hard t
by nurettin 6y ago
I install a reverse proxy on every remote machine (raspberry pi or odroid) I manage. These machines are usually tucked behind someone's router, and it is hard to tell every router owner to forward the ssh port. When I install a reverse proxy, the machines can proactively tunnel right into a beacon machine whenever they are online and I can ssh into them from the beacon machine directly. I usually set up frpc as a service on the remote machine. It is also possible to use autossh with a monitoring port for this, but I noticed that frpc can bypass firewall restrictions much easier. This scheme also lets me use tools like Cockpit to view the health and status of my remotes.
https://github.com/fatedier/frp https://github.com/fatedier/frp
- kzrdude 6y agoJust so that I understand the setup, this still requires one intermediate box - the beacon machine - to be running?
- creztoe 6y agoThat's how I understand it. Basically you have a machine hosted somewhere with a dedicated IP so you can access all remote machines from anywhere at any time, as long as they are connected to it via reverse proxy.
- nurettin 6y agoIt does require the beacon machine to be up, but the system easily recovers from a reboot of the beacon, since frpc will keep on trying to reconnect. It is a poor man's firewall-resilient one-way vpn.
- xrendan 6y agoOooh, thanks for this, I'm currently using the autossh route but have had some issues with it. frp looks like it could solve my problems :)
- wil421 6y agoWhat are you using for your beacon machine? Do you have a static IP or a domain that your beacon uses?
- nurettin 6y agoSure, I just use the smallest size hetzner or DO available. I point its IP to a subdomain just like the article described.
- viraptor 6y agoAs an alternative, you could put it on a public mesh VPN. I use ZeroTier for that so I don't have to host an explicit beacon.
- nurettin 6y agoThis looks nice, Free tier even supports up to 50 devices.
- msh 6y agozerotier is nice, but I have migrated to tailscale. Its based on wireguard and seems even better performance wise.
- johtso 6y agoYeah, tailscale does look nice, only one user on the free tier was a deal-breaker for me though.
- anderspitman 6y ago> Its based on wireguard and seems even better performance wise. I hadn't considered that, but it makes sense. Since ZeroTier is layer 2, I'd expect it to become a leaky abstraction (at least for performance) in certain cases where algorithms are expecting other layer 2 hardware to be essentially directly connected with a wire when in reality they're connected over the internet.
- viraptor 6y agoWhat algorithms you have in mind? That would be a bad assumption, since layer 2 can be ethernet, but it may be i2c, or slip, or spacewire... Layer 2 does not mean "close" or "fast".
- narrationbox 6y agoAt Narration Box we use Tailscale with Caddy's Cloudflare Let's Encrypt DNS-01 for internal DNS resolution + TLS for the apps that need it. In essence you get something like Google's internal "go/ links" except everything's hosted on the external DNS server and automatically protected by default by Tailscale since the IPs pointed to cannot be accessed publicly.
- tylerfontaine 6y agoI have started using Tailscale for this purpose. No beacon box required, super easy. https://tailscale.com/ https://tailscale.com/