10 ms·

What's actually being done here is buried in a mass of analogies. AFAICT it's: * Exposing a server running on the home network (behind NAT on a dynamic IP) to

What's actually being done here is buried in a mass of analogies. AFAICT it's: * Exposing a server running on the home network (behind NAT on a dynamic IP) to the internet. * Doing so by renting a cheap VPS and using wireguard to forward traffic to the server at home. I love wireguard and use it continuously. My phone has always on wireguard to my home network so all my phone traffic goes through my home router/dns, I can access the various private servers I have at home, get dns based ad blocking etc. I use an ISP that give me a static IP so it was easy to set up. It works like a dream. That said when I want to run a public server I just rent a VPS and run it on that. I don't want anything I don't own initiating connections to anything on my home network in any way.

BlueTemplar 5y ago
These days, your ISP would (hopefully) give you at least a whole (static) /56, so you can always reserve some prefixes for your not-really-home networks ? https://www.ripe.net/publications/docs/ripe-690#4-2-3--prefixes--longer-than--56 https://www.ripe.net/publications/docs/ripe-690#4-2-3--prefi...
- omnicognate 5y ago
  I have a static ip4 address, but were that not the case yes I'd take the ip6 plunge. Edit: Which I could do as my ISP and mobile network both support ip6. Y'all need better ISPs :D
  - folkrav 5y ago
    > Y'all need better ISPs :D If only there was one around here, but alas, they're all basically the same 2-3 ISPs - a couple of main ISPs, then smaller ones who are just using their network and renting bandwidth.
- mort96 5y ago
  Hahahahaha your ISP supports IPv6 already?
  - rglullis 5y ago
    What you mean already? In Europe it has been for at least a decade. Even in Brazil v6 has been standard since 2014 or so...
    - mort96 5y ago
      I'm in Europe, I have yet to have used a residential (or even corporate!) network which has any form of IPv6 support. Of all the networks I've interacted with over the years, only my cell carrier supports IPv6.
      - rglullis 5y ago
        Ok, at least in Germany I noticed since I moved here that all residential routers were dual-stack. I even ended up disabling v6 because I wanted to run some things in my home network and I wasn't too sure about the firewall configuration.
        HideousKojima 5y ago
        Germany is one of the better countries when it comes to IPv6 adoption, and even then it's only about ~55% https://www.google.com/intl/en/ipv6/statistics.html https://www.google.com/intl/en/ipv6/statistics.html
        BlueTemplar 5y ago
        Something that I find incredible, but have seen no one contradicting yet, is how when ISPs have started to roll residential IPv6 by default some years ago, they first had no firewall on IPv6 and/or later it was disabled by default (so only few % of users would enable it at best). (Not sure if the situation has changed ?) Now, IPv6 (when properly implemented, which is another failure mode) comes with much better safety out of the box (like not being able to scan all the suffixes in a reasonable amount of time to find computers on the local network to target), but I'm still impressed that now we seemingly have hundreds of millions of personal computers "directly" connected to the Internet with at best only the OS firewall as protection (when one exists), and it hasn't resulted in major hacking issues ! (yet.)
- emteycz 5y ago
  ISP might give me an IPv6 but my mobile can't connect to it.
  - BlueTemplar 5y ago
    You might be already in the minority here (even in the USA !), as it looks like that the cell carriers there now overwhelmingly run on IPv6, and tunneling IPv4, which doesn't always work well ? https://old.reddit.com/r/tmobile/comments/97ifsv/issues_with_ipv6_tmobile_lte_vpn_networks/ https://old.reddit.com/r/tmobile/comments/97ifsv/issues_with...
    - judge2020 5y ago
      In many parts of the world it's no IPv6 on mobile, just CGNAT with probably thousands of customers sharing one ip.
    - emteycz 5y ago
      I am in EU - Czechia. I have 5G, but unable to connect to any IPv6. :-/ I have the same network ISP for my apartment and they give me only IPv6. I hate it.
      - BlueTemplar 5y ago
        That's weird... have you tried to find out what was the cause for lack of 5G (!!) IPv6 ?
- AnIdiotOnTheNet 5y ago
  > These days, your ISP would (hopefully) give you at least a whole (static) /56 You must not have met many ISPs.
2Gkashmiri 5y ago
i do it even easier. i have zerotier running and everyone is on the same "network". you do need to look for an ISP that gives you a static ip which isnt even possible where i live
- KSPAtlas 5y ago
  My ISP only offers static in the business packages, which requires an actual business and it very expensive.
  - nyolfen 5y ago
    i just cron a curl to update my A records once an hour
  - xyzzy_plugh 5y ago
    I have a business package but I can't get a static IP because the managed switch is unavailable for the foreseeable future due to components shortage. I was told I'd be lucky if I get one before my contract expires.
- discardedrefuse 5y ago
  I recently did a deep dive into network overlays (like zerotier); mostly because I have a few self hosted services, and overlays seem to be the hot topic in the self-hosting community. I've come away with the feeling that most people using overlay networks at home are doing it completely wrong and opening themselves up to a world of hurt. First, network overlays are not easier to setup than VPNs. Installing and configuring a network overlay client on every device is much more work than setting up a single VPN tunnel for every network you want to access. Overlay networks are just easier to plan because there is no planning. But they're not easier to implement. Second, and far more important, meshing all your devices into a single flat network is dangerous. There is a reason why networks are designed with isolation strategies. Introducing an overlay into your networks breaks down these barriers for you, but also for an attacker. The only overlay network that has built in firewall capabilities is Nebula. When I started configuring its firewall rules I found myself just recreating my existing segmented networks, but in a much more obtuse way. Instead of configuring a central firewall, I was configuring firewall rules on each device. After all my research, I'm still running the same segmented network I was running before my overlay experiments. But I would like to give some praise to both Nebula and Yggdrasil. IMHO, these are the two most existing projects coming out of this space right now.
cloudbonsai 5y ago
> I just rent a VPS and run it on that. I don't want anything I don't own initiating connections to anything on my home network in any way. I do this for my personal web server, but also set up the network rule so that its SSH port is only reachable from my VPN. IMO, this is super convenient. I can keep my public servers out of my home network (so clear separation of private/public networks), but still a VPN connection is required to log into any of my servers.
- inportb 5y ago
  What do you do if your VPN goes down and you need access to your server to debug it? Is physical access required or do you have other contingency plans?
  - cloudbonsai 5y ago
    > What do you do if your VPN goes down and you need access to your server to debug it Here is exactly what I would do: 1. Sign in to AWS console (with my Yubikey). 2. Click "Lightsail > instances > <my-server>" 3. Click "Networking > Allow Lightsail browser SSH/RDP" 4. Click "Connect using SSH". 5. Do debugging! In short, you can use cloud providers' web interface as an escape hatch. This just works as long as you manage the firewall using your cloud provider's network filter, such as Security Group, rather than, say, iptables.
    - qw3rty01 5y ago
      Some providers like digitalocean use a serial connection for the terminal, so it works even when the network configuration is completely broken somehow (totally not because you set the input policy to drop without making an accept rule first)
      - yolovoe 5y ago
        EC2 has this too: https://aws.amazon.com/about-aws/whats-new/2021/03/introducing-ec2-serial-console/ https://aws.amazon.com/about-aws/whats-new/2021/03/introduci... Works even if you mess up the boot process somehow Disclaimer: I work here
jvanderbot 5y ago
yes this is precisely how I connect all my computers. I use a VPS as a relay solely for its public static IP. Then every device I own uses that relay to connect via wireguard. It's been a magical experience having 16 bits of private address space populated with vms, r-pis, pcs, phones, etc.
perrygeo 5y ago
> That said when I want to run a public server I just rent a VPS and run it on that I have a setup similar to the OP and there's a really good reason for it: cost. For $2k in hardware (one time) and a VPS + electricity at $20/mo, I can run a 64 core, 192Gb, 24TB server. Let's call that $4400 over the course of 10 years. You would burn through that budget in roughly 1 month to get the same specs on AWS. Obviously I'm neglecting the impact and cost of network, if it's a hobby you can just reuse your existing connection but you can always buy a dedicated line (and adjust the cost calculation accordingly) In terms of security, you can mitigate the surface area by running a reverse proxy on the VPS. I've got nginx on the front line which does TLS then proxy_passes to my basement server at its wireguard IP address. So it's strictly limited to http, no direct database or ssh access. I don't know if I'd ever run a "real" website this way but it's great for hobbies and side projects.
- deleted 5y ago
  [deleted]
- fgonzag 5y ago
  Explain how you got a 64 core 192 GB RAM 24 TB server or workstation for 2k please
  - hobs 5y ago
    Same, that's going to be like 4x that price refurbished around the best case...
  - dinosaurdynasty 5y ago
    Ebay I would guess. Requires a bit of luck though
  - mardifoufs 5y ago
    Not ideal but you can go for used rack mounted servers. You can easily get even better specs for less than 2k with reasonably recent CPUs too (E5-xxxxv3 and up). At least that was the case when I set up my home server rack ~2 years ago. (Though 24TB might be too much since server grade SAS storage is very expensive even when it's used. So what I did was to buy servers with as little storage as possible and then just put SATA HDDs that I can get for dirt cheap.)
rubatuga 5y ago
However, VPS and cloud providers generally have bad IP reputation or block ports. We created a service called Hoppy Network that addresses this. It provides a /32 IPv4 and /56 IPv6 over WireGuard, costs $8/month, and can be used to host anything from web servers to SMTP servers. Here's a link. https://hoppy.network https://hoppy.network

BlueTemplar 5y ago

These days, your ISP would (hopefully) give you at least a whole (static) /56, so you can always reserve some prefixes for your not-really-home networks ? https://www.ripe.net/publications/docs/ripe-690#4-2-3--prefixes--longer-than--56 https://www.ripe.net/publications/docs/ripe-690#4-2-3--prefi...

omnicognate 5y ago
I have a static ip4 address, but were that not the case yes I'd take the ip6 plunge. Edit: Which I could do as my ISP and mobile network both support ip6. Y'all need better ISPs :D
- folkrav 5y ago
  > Y'all need better ISPs :D If only there was one around here, but alas, they're all basically the same 2-3 ISPs - a couple of main ISPs, then smaller ones who are just using their network and renting bandwidth.
mort96 5y ago
Hahahahaha your ISP supports IPv6 already?
- rglullis 5y ago
  What you mean already? In Europe it has been for at least a decade. Even in Brazil v6 has been standard since 2014 or so...
  - mort96 5y ago
    I'm in Europe, I have yet to have used a residential (or even corporate!) network which has any form of IPv6 support. Of all the networks I've interacted with over the years, only my cell carrier supports IPv6.
    - rglullis 5y ago
      Ok, at least in Germany I noticed since I moved here that all residential routers were dual-stack. I even ended up disabling v6 because I wanted to run some things in my home network and I wasn't too sure about the firewall configuration.
      - HideousKojima 5y ago
        Germany is one of the better countries when it comes to IPv6 adoption, and even then it's only about ~55% https://www.google.com/intl/en/ipv6/statistics.html https://www.google.com/intl/en/ipv6/statistics.html
      - BlueTemplar 5y ago
        Something that I find incredible, but have seen no one contradicting yet, is how when ISPs have started to roll residential IPv6 by default some years ago, they first had no firewall on IPv6 and/or later it was disabled by default (so only few % of users would enable it at best). (Not sure if the situation has changed ?) Now, IPv6 (when properly implemented, which is another failure mode) comes with much better safety out of the box (like not being able to scan all the suffixes in a reasonable amount of time to find computers on the local network to target), but I'm still impressed that now we seemingly have hundreds of millions of personal computers "directly" connected to the Internet with at best only the OS firewall as protection (when one exists), and it hasn't resulted in major hacking issues ! (yet.)
emteycz 5y ago
ISP might give me an IPv6 but my mobile can't connect to it.
- BlueTemplar 5y ago
  You might be already in the minority here (even in the USA !), as it looks like that the cell carriers there now overwhelmingly run on IPv6, and tunneling IPv4, which doesn't always work well ? https://old.reddit.com/r/tmobile/comments/97ifsv/issues_with_ipv6_tmobile_lte_vpn_networks/ https://old.reddit.com/r/tmobile/comments/97ifsv/issues_with...
  - judge2020 5y ago
    In many parts of the world it's no IPv6 on mobile, just CGNAT with probably thousands of customers sharing one ip.
  - emteycz 5y ago
    I am in EU - Czechia. I have 5G, but unable to connect to any IPv6. :-/ I have the same network ISP for my apartment and they give me only IPv6. I hate it.
    - BlueTemplar 5y ago
      That's weird... have you tried to find out what was the cause for lack of 5G (!!) IPv6 ?
AnIdiotOnTheNet 5y ago
> These days, your ISP would (hopefully) give you at least a whole (static) /56 You must not have met many ISPs.

2Gkashmiri 5y ago

i do it even easier. i have zerotier running and everyone is on the same "network". you do need to look for an ISP that gives you a static ip which isnt even possible where i live

KSPAtlas 5y ago
My ISP only offers static in the business packages, which requires an actual business and it very expensive.
- nyolfen 5y ago
  i just cron a curl to update my A records once an hour
- xyzzy_plugh 5y ago
  I have a business package but I can't get a static IP because the managed switch is unavailable for the foreseeable future due to components shortage. I was told I'd be lucky if I get one before my contract expires.
discardedrefuse 5y ago
I recently did a deep dive into network overlays (like zerotier); mostly because I have a few self hosted services, and overlays seem to be the hot topic in the self-hosting community. I've come away with the feeling that most people using overlay networks at home are doing it completely wrong and opening themselves up to a world of hurt. First, network overlays are not easier to setup than VPNs. Installing and configuring a network overlay client on every device is much more work than setting up a single VPN tunnel for every network you want to access. Overlay networks are just easier to plan because there is no planning. But they're not easier to implement. Second, and far more important, meshing all your devices into a single flat network is dangerous. There is a reason why networks are designed with isolation strategies. Introducing an overlay into your networks breaks down these barriers for you, but also for an attacker. The only overlay network that has built in firewall capabilities is Nebula. When I started configuring its firewall rules I found myself just recreating my existing segmented networks, but in a much more obtuse way. Instead of configuring a central firewall, I was configuring firewall rules on each device. After all my research, I'm still running the same segmented network I was running before my overlay experiments. But I would like to give some praise to both Nebula and Yggdrasil. IMHO, these are the two most existing projects coming out of this space right now.

cloudbonsai 5y ago

> I just rent a VPS and run it on that. I don't want anything I don't own initiating connections to anything on my home network in any way. I do this for my personal web server, but also set up the network rule so that its SSH port is only reachable from my VPN. IMO, this is super convenient. I can keep my public servers out of my home network (so clear separation of private/public networks), but still a VPN connection is required to log into any of my servers.

inportb 5y ago
What do you do if your VPN goes down and you need access to your server to debug it? Is physical access required or do you have other contingency plans?
- cloudbonsai 5y ago
  > What do you do if your VPN goes down and you need access to your server to debug it Here is exactly what I would do: 1. Sign in to AWS console (with my Yubikey). 2. Click "Lightsail > instances > <my-server>" 3. Click "Networking > Allow Lightsail browser SSH/RDP" 4. Click "Connect using SSH". 5. Do debugging! In short, you can use cloud providers' web interface as an escape hatch. This just works as long as you manage the firewall using your cloud provider's network filter, such as Security Group, rather than, say, iptables.
  - qw3rty01 5y ago
    Some providers like digitalocean use a serial connection for the terminal, so it works even when the network configuration is completely broken somehow (totally not because you set the input policy to drop without making an accept rule first)
    - yolovoe 5y ago
      EC2 has this too: https://aws.amazon.com/about-aws/whats-new/2021/03/introducing-ec2-serial-console/ https://aws.amazon.com/about-aws/whats-new/2021/03/introduci... Works even if you mess up the boot process somehow Disclaimer: I work here

jvanderbot 5y ago

yes this is precisely how I connect all my computers. I use a VPS as a relay solely for its public static IP. Then every device I own uses that relay to connect via wireguard. It's been a magical experience having 16 bits of private address space populated with vms, r-pis, pcs, phones, etc.

perrygeo 5y ago

> That said when I want to run a public server I just rent a VPS and run it on that I have a setup similar to the OP and there's a really good reason for it: cost. For $2k in hardware (one time) and a VPS + electricity at $20/mo, I can run a 64 core, 192Gb, 24TB server. Let's call that $4400 over the course of 10 years. You would burn through that budget in roughly 1 month to get the same specs on AWS. Obviously I'm neglecting the impact and cost of network, if it's a hobby you can just reuse your existing connection but you can always buy a dedicated line (and adjust the cost calculation accordingly) In terms of security, you can mitigate the surface area by running a reverse proxy on the VPS. I've got nginx on the front line which does TLS then proxy_passes to my basement server at its wireguard IP address. So it's strictly limited to http, no direct database or ssh access. I don't know if I'd ever run a "real" website this way but it's great for hobbies and side projects.

deleted 5y ago
[deleted]
fgonzag 5y ago
Explain how you got a 64 core 192 GB RAM 24 TB server or workstation for 2k please
- hobs 5y ago
  Same, that's going to be like 4x that price refurbished around the best case...
- dinosaurdynasty 5y ago
  Ebay I would guess. Requires a bit of luck though
- mardifoufs 5y ago
  Not ideal but you can go for used rack mounted servers. You can easily get even better specs for less than 2k with reasonably recent CPUs too (E5-xxxxv3 and up). At least that was the case when I set up my home server rack ~2 years ago. (Though 24TB might be too much since server grade SAS storage is very expensive even when it's used. So what I did was to buy servers with as little storage as possible and then just put SATA HDDs that I can get for dirt cheap.)

rubatuga 5y ago

However, VPS and cloud providers generally have bad IP reputation or block ports. We created a service called Hoppy Network that addresses this. It provides a /32 IPv4 and /56 IPv6 over WireGuard, costs $8/month, and can be used to host anything from web servers to SMTP servers. Here's a link. https://hoppy.network https://hoppy.network