3 ms·

I'm all for self-hosting and run a few services on my LAN, but would never allow HTTP traffic from the internet to enter my network. If you've ever seen a publi

by imiric 4y ago

I'm all for self-hosting and run a few services on my LAN, but would never allow HTTP traffic from the internet to enter my network. If you've ever seen a public nginx log, you'll know it constantly gets hit by all kinds of bots and vulnerability scanners. No matter how secure and isolated I make the web server, I just don't want to see that traffic, nor expose my home IP to further scrutiny. It's trivial to host a static site on someone else's infrastructure for very cheap or free, and you get to benefit from CDNs if you need it. I don't see what you would gain from doing this from your home network.

ed25519FUUU 4y ago
Put it behind cloudflare if you’re worried about it. It’s free and increases performance.
gnramires 4y ago
I think an alternative you can use a cheap VPS (there are very inexpensive options for this[1] for like $15/y) and tunnel traffic from your home server. If you're only serving static content, that might be enough to host everything as well (or $20/y for a kvm slice; for anything more complicated, I think 1GB might be advised). edit: this way, you get a free IPv4 (static) address as well, as well as security and avoiding DDoS on your home connection. [1] https://buyvm.net/openvz-vps/ https://buyvm.net/openvz-vps/
timbit42 4y ago
You can create a second network behind your router to keep your LAN separate from the server's LAN.
megous 4y ago
Random http traffic seems about as harmless as it ever was, if you just host static pages, or your own scripts/software and nothing generic. What's a bit iffy is the privacy aspects. If you host anything that can identify you, your identity is just a HTTP request away for anyone who sees traffic from your IP address. But these concerns can be somewhat mitigated by making the server drop connections unless a known Host header or SNI is sent. Wholly recommended if you host stuff on your hope IP! Easily done with nginx by ensuring all server {} blocks have a proper server_name and a separate default server {} block just having return 444. So unless someone already knows the domain name of your home server, they'll not be able to access it with just an IP address. You'll stop many bots this way, too.
- etc-hosts 4y ago
  > If you host anything that can identify you, your identity is just a HTTP request away for anyone who sees traffic from your IP address. run it behind Cloudflare
  - megous 4y ago
    Not sure why I'd let some US company see all the traffic, if the same goal can be achieved other way and the goal is privacy... DDoS is probably mitigated at residential ISP level. At least I never had to deal with it with the current ISP I had for 14 years, and I had like 10 MBit/s upstream bandwidth most of that time.
8organicbits 4y ago
> would never allow HTTP traffic from the internet to enter my network The security aspect is a struggle. Something like shellshock [1] needs to be patched immediately, which really requires automation. With shellshock, even self-hosted static hosting could be impacted. Similar vulnerabilities be discovered in the future. I'd want to isolate anything external facing from the rest of my home network for that reason. [1] https://en.m.wikipedia.org/wiki/Shellshock_(software_bug) https://en.m.wikipedia.org/wiki/Shellshock_(software_bug)

by imiric 4y ago

ed25519FUUU 4y ago

Put it behind cloudflare if you’re worried about it. It’s free and increases performance.

gnramires 4y ago

I think an alternative you can use a cheap VPS (there are very inexpensive options for this[1] for like $15/y) and tunnel traffic from your home server. If you're only serving static content, that might be enough to host everything as well (or $20/y for a kvm slice; for anything more complicated, I think 1GB might be advised). edit: this way, you get a free IPv4 (static) address as well, as well as security and avoiding DDoS on your home connection. [1] https://buyvm.net/openvz-vps/ https://buyvm.net/openvz-vps/

timbit42 4y ago

You can create a second network behind your router to keep your LAN separate from the server's LAN.

megous 4y ago

Random http traffic seems about as harmless as it ever was, if you just host static pages, or your own scripts/software and nothing generic. What's a bit iffy is the privacy aspects. If you host anything that can identify you, your identity is just a HTTP request away for anyone who sees traffic from your IP address. But these concerns can be somewhat mitigated by making the server drop connections unless a known Host header or SNI is sent. Wholly recommended if you host stuff on your hope IP! Easily done with nginx by ensuring all server {} blocks have a proper server_name and a separate default server {} block just having return 444. So unless someone already knows the domain name of your home server, they'll not be able to access it with just an IP address. You'll stop many bots this way, too.

etc-hosts 4y ago
> If you host anything that can identify you, your identity is just a HTTP request away for anyone who sees traffic from your IP address. run it behind Cloudflare
- megous 4y ago
  Not sure why I'd let some US company see all the traffic, if the same goal can be achieved other way and the goal is privacy... DDoS is probably mitigated at residential ISP level. At least I never had to deal with it with the current ISP I had for 14 years, and I had like 10 MBit/s upstream bandwidth most of that time.

8organicbits 4y ago

> would never allow HTTP traffic from the internet to enter my network The security aspect is a struggle. Something like shellshock [1] needs to be patched immediately, which really requires automation. With shellshock, even self-hosted static hosting could be impacted. Similar vulnerabilities be discovered in the future. I'd want to isolate anything external facing from the rest of my home network for that reason. [1] https://en.m.wikipedia.org/wiki/Shellshock_(software_bug) https://en.m.wikipedia.org/wiki/Shellshock_(software_bug)