8 ms·

>Nowadays, running a website from home is just about impossible. You may not have a public IP, and if you do, it likely changes from time to time. And even then

• sneak 5y ago
  Cox (USA) blocks inbound port 80, rendering it impossible to get Let's Encrypt certs via http validation. This started in the last year and affects millions of people.
  • chana_masala 5y ago
    I used to think "who cares? why would I want to self host?" but even if I or anyone doesn't care about self hosting, the fact that they block everyone from doing so is wrong.
    • sneak 5y ago
      Pointing a dyndns at your home connection for vhosting toy apps and sites on existing hardware with no additional cost is a long tradition in tech. Not everyone wants to give monthly Danegeld to Bezos.
  • jessechahal 5y ago
    I have the same problem with my ISP. Solution was easy, just use DNS validation. All my home service's have valid Lets Encrypt certs using this method.
• gjs278 5y ago
• jaytaylor 5y ago
  Blocking port 25 is pretty annoying. I know there are explanations, but a month ago I really wanted to run a mail server for jaytaylor.com myself. Only to find out it's basically impossible with mainstream ISPs. It's not a realistic option, regardless of Comcast, AT&T Fiber, no big boy ISP supports it at this point. I don't know if ATT even provides email with my service, much less for a custom domain. How did the de-facto solution become "Just use Gmail" or pay a third party to do it? It's a little sad for those of us who like running our own servers, total uphill battle. All that work in the early days of the internet to ensure such a feat was possible, only for it to become near impossible for most, regardless of technical prowess. Just give all your data to a huge company, it's fine. Pft. Sorry for the rant. Am I really becoming those old hags I used to make fun of on slashdot? Shoot... p.s. It's easier than ever to do, too, because high-quality docker images are abundant. Tragic for nerds like us!
  • genewitch 5y ago
    Which docker images? I've been having trouble finding "simple" mail servers for incoming and outgoing. Stuff like postfix and dovecot make my eyes cross, I just want to point DNS at an IP and send and receive mail there, securely. It's not that I can't set those other ones up, I just don't want to, nor should I have to for a small service...
    • doublerabbit 5y ago
      I've been using Zimbra 8 for years. Not a docker image but has a single install script and sits on ubuntu. It's a poor-mans enterprise email client for free. It's a bit chunky and when it doesn't fall apart it has a nice friendly client with support for mobile. Includes all the bells and whistles of spam assassin, dkim, briefcase etc. Mobile view is a bit dated but it works for elementary sending / receiving. The free version has no backups which is a pain and makes me scared to reinstall/move away from. But for a all-in-one email server client it does have a charm. Zimbra 9 looks nice but licensing.
      • prox 5y ago
• codetrotter 5y ago
  > our residential ISPs [...] generally only block port 25 (SMTP) While outbound connections to port 25 may be blocked, the ISP we are with still allows inbound connections to port 25. I have a few accounts on the net tied to an old domain, and what I've done with that domain is that I now have the MX record for that domain set to my home IP address, but I reject connections to port 25. Then, when I need to reset a password for an account tied to an email address on the old domain, I start a simple mail server on my computer that accepts incoming mail, and I open for incoming connections on port 25. I receive the password reset mail, and then I block port 25 again and shut down the mail server program. For services that are actually important, I’ve changed the email address associated with the account to a hosted one, so that I receive mails about billing and such related to those services. For less important accounts where I only need to be able to receive password reset mails but otherwise don't want mail related to the service, I keep them associated with the mail address of the old domain that has its MX record set to my home internet IP address, and where I only accept incoming connections when I am doing a password reset. This way I can receive those password reset emails while avoiding most spam since I only keep port 25 open for incoming connections for short and infrequent periods of time. It’s certainly too peculiar of a setup for most people. But I figure some others here on HN may find that they might want to do something similar. So if your ISP allows incoming connections on port 25, you could set up MX records on a new domain or on a subdomain of an existing domain, and run your own server for the sole purpose of registering accounts or receiving password reset emails, and like I do only run that server when you are creating an account or resetting the password for an account. It’s sort of a fourth option to other alternatives that I more often see other people use. The four ways that I commonly see others do it is: - Some use “+” addressing with your Gmail account. Not ideal because spammers know of the “+” trick and can just strip the suffix. - Some self host catch all mail. Not ideal because spammers also blast out email to commonly used names for email addresses. So if you have a domain and you accept mail to any address at that domain you will get spam for addresses like bob@ your domain, sales@ your domain and all sorts of random names @ your domain. - Some generate a uuid as name portion of email address, unique for each service, or some other scheme with unique name portion per service. This is pretty good but has a couple of drawbacks still. One of which is that you need to explicitly create a new account in your mail system each time, which also can take time – this can be set up so that the operation is pretty simple but still. - Some use a throwaway email from a free service like Guerrilla Mail or similar. Mostly fine if the account you are registering is really just some temporary thing, but if you do decide that you want access to it later then because the mail address was temporary you will not be able with most throwaway mail services to read mail for that address after like 1 hour or 24 hours or whatever limit they have set. So then password reset becomes difficult or impossible. Also some sites maintain lists of domains from such services and will not allow you to create an account with an email address using any of those domains. Whereas what you might do instead, which is what I am doing now, is to run catch all but only during the moments where you know you will be receiving an account creation or password reset mail. For this I use a very basic mail server that receives the mail and just dumps the mail in the terminal that the program is running in. Portions of some mail may be base64 encoded, but you can just copy the encoded text, run a base64 decoding program in another terminal and paste it into that. macOS, FreeBSD, most Linux distros etc all come with a base64 encoding and decoding program shipped with the default install of the system. At a glance it may seem like a bit of work, but I find this the simplest and fastest for the purpose of receiving one-off password reset mails. First of all, forward port 25 TCP from your router to your computer. Then, create an MX record on the domain or subdomain that you'll be using. Install aiosmtpd: pip3 install aiosmtpd And then run it: sudo aiosmtpd -l 192.168.x.x:25 -n where again 192.168.x.x is the LAN IP address of your computer. Then when an email is sent to any address at your domain you should see the message show up in the terminal where you have aiosmtpd running. When you've received the mail, shut down aiosmtpd on your computer and disable the port forwarding of port 25 TCP on your router. Also, remember to update the MX record next time you want to receive an email if your global IP address has changed in the meantime. Also, instead of running aiosmtpd as root you should find out how to bind it port 25 as a non-privileged user. See for example https://stackoverflow.com/questions/413807/is-there-a-way-for-non-root-processes-to-bind-to-privileged-ports-on-linux https://stackoverflow.com/questions/413807/is-there-a-way-fo... See also https://aiosmtpd.readthedocs.io/en/latest/cli.html https://aiosmtpd.readthedocs.io/en/latest/cli.html for aiosmtpd command line usage and https://aiosmtpd.readthedocs.io/en/latest/ https://aiosmtpd.readthedocs.io/en/latest/ for other details about aiosmtpd. If you are feeling adventurous you could write some code to make this even simpler to use. Perhaps going as far as to both automatically enabling and disabling the port forwarding for your router (for example by emulating the login and other HTTP calls that your browser would send when you manually manage the router), and updating the MX record for your domain if needed, as well as to write received mail to disk in Maildir format. https://en.wikipedia.org/wiki/Maildir https://en.wikipedia.org/wiki/Maildir
• H1Supreme 5y ago
  I'm outside of Pittsburgh, and I've had two different IP's in the last 10 years. The IP change only happened when I upgraded my service a few years ago. I suspect it would still be the same if I didn't change plans.
• lettergram 5y ago
  You can get 5 static IPs from AT&T for $5/month. I’ve done this recently, the techs were confused but I was able to configure well enough on my own
  • piperswe 5y ago
    Wow! Is this for residential or commercial service?
    • lettergram 5y ago
      Residential
      • csdvrx 5y ago
        Do you have the name of the offer, or how to ask for it?
        • lettergram 5y ago
          Just call and ask https://www.att.com/support/article/smb-internet/KM1181996/ https://www.att.com/support/article/smb-internet/KM1181996/
          • csdvrx 5y ago
            And I did, and I got that for just $15 for 5 IP. I think I may take their 16 IP (leaving 12 usable) if it works well enough
  • cft 5y ago
    Same here. They've also unblocked port 25.
• userbinator 5y ago
  From what I've heard and experienced, Southeast Asia is mostly "interNAT" -- you don't get a publicly routable IP unless you pay a lot more, CGNAT is all you get.
  • xwolfi 5y ago
    I have a fiber in Hong Kong and it seems "normal", even if I think we have what you say for mobiles. How do I check ?
    • userbinator 5y ago
      Start a listening service, portforward to it if you're behind a NAT router, then use one of the online port scanners or some other host you have access to from somewhere else on the Internet to attempt connecting to it. Yes, mobile internet has AFAIK always been behind a NAT --- I'm not sure if you can even get such a service with a publicly routable IP, since there's not much interest in e.g. hosting a server on your phone while you carry it everywhere, as useful as that could be.
• waynesonfire 5y ago
  when i signed up for verizon fios maybe.. 3-4 years ago, they blocked http port(s). i'm not sure if they still do. also, the author makes the point that you quote, >> You may not have a public IP, and if you do, it likely changes from time to time. you then go and deny this claim and contradict yourself, > generally do not change IPs frequently (unless your router/modem is restarted) That's the point the author is making. How frequent and what may cause it doesn't matter, the point is, your IP address will change. When it does and if you ignored that in your infrastructure, you'll have problems. Regardless of how frequently it happens, you have to deal with dynamic IPs.
• vladvasiliu 5y ago
  In France, it depends on the provider. The ones I've tried: Orange DSL would change the IPv4 fairly often, sometimes while using it during the day. Huge PITA. You could pay for a fixed IP. No IPv6 on DSL. I have no experience with their fiber offer. SFR used to have a fixed IPv4 on FTTH, but now they're rolling out CG-NAT. Which is even worse, because not even DynDNS can save you. Not sure if there's the option of paying for your own fixed IP. You do get a fixed routable IPv6 prefix (/56 I think). Older installs based on FTTC + Docsis get a new IPv4 on reconnection; no IPv6. Bouygues still seems to have a fixed IPv4 on FTTH. They're rolling out IPv6 with a fixed /60. There are "pro" offers, but they usually require you to have an actual registered business, which does incur some other costs. -- Edit: Added IPv6 info.
  • Arkanosis 5y ago
    Free also has been doing CG-NAT for years now.
  • alcover 5y ago
    I'm at OVH dsl. My IP has not changed in years.
• MauroIksem 5y ago
  I do the same..
• Semaphor 5y ago
  I get rare IP changes (not sure when exactly as I don’t care much because Dynamic DNS is a thing), have the option of a 5€/month static IP, and have no ports blocked. Germany, Vodafone cable.
• wingmanjd 5y ago
  At my previous home, Xfinity let me host my personal webpage/ webapps on 80/443. IIRC, they did block 25. I moved to a new location a few miles away, and Xfinity doesn't cover this area. The new ISP blocks the following: "TCP 25, TCP 80, TCP 443, TCP 445, TCP 1080, TCP 6667-6669, TCP 1433-1434, TCP&UDP 135-139, TCP&UDP 67 are blocked for security and network management reasons" The only way I can get high speed service that doesn't block these is to purchase a business plan from PennTeleData, but they won't even talk to you unless you have a federal tax ID for an actual business. I ended up putting haproxy on a free Oracle instance and changing what port I listen at here at home.
• hello0990911 5y ago
  This is one of the use case for the tor network. Gives access to local machine even if all the ports are blocked by isp