4 ms·

Dealing with changing residential ips is nothing new. It's interesting to see how it's still being solved for even in this overly complex k8s landscape we find

Dealing with changing residential ips is nothing new. It's interesting to see how it's still being solved for even in this overly complex k8s landscape we find ourselves in now. Back in the day we'd use free services like https://freedns.afraid.org/ https://freedns.afraid.org/ on a cron to refresh the ip every so often. I used afraid to refresh my dial up ip address, for my "hosting service" domain. The "hosting service" was an old tower pc living in the cabinet underneath a fish tank. Ops was a lot different back then... Nowadays, if you're poking holes in your firewall and exposing your ip address to the world, you're doing it wrong. We've moved away from that model. There's no need to do that and expose yourself in those ways, when you can instead tunnel out. Cloudflare/argo tunnels, or tailscale tunnels, dial out from your service and don't expose your system directly to the open internet. Clourflare will even automagically set the dns for your domain to always route through that tunnel. Your isp allocated ip address is irrelevant, and nothing ever needs it because nothing ever routes to it. Your domain routes to a cf endpoint, and your system tunnels out to it, meeting in the middle. No open ports, no firewall rules, no NAT bs. Only downside is, you're relying on and trusting services like cf and tailscale.

joecool1029 2y ago
Yeah, afraid.org used to work great. I mean the service still works great but Google appears to blacklist any domain with the nameserver there, all email goes to spam. I just found this out in the past month. Kept all my records the same and just moved the nameserver to Fastmail and the problem resolved immediately. I have an unusual dynamic ip situation I've been taking advantage of with a different system. Some years back I noticed T-Mobile phone lines allow inbound connections on ipv6 (T-Mobile Home Internet unfortunately does not). I have a small weather station I run on a rpi3b I can access anywhere by using ddclient on the pi with cloudflare api key and it sets the AAAA record which is proxied by cloudflare, I leave the A record blank. If any users on ipv4 try to visit the site, cloudflare proxies it for them, works pretty reliably.
- LoganDark 2y ago
  > Some years back I noticed T-Mobile phone lines allow inbound connections on ipv6 HELL YEAH. This is exactly how ipv6 is meant to be implemented. They deserve some real praise and recognition for this.
- lostmsu 2y ago
  > T-Mobile Home Internet unfortunately does not Why did they make it so inconvenient?
  - LoganDark 2y ago
    Home Internet is seemingly far more affordable than their phone plans. So they have other ways of encouraging you to use the phone plans.
    - joecool1029 2y ago
      Its about the same as my per-line cost. The real reason I suspect is to try to discourage upload usage. T-mobile's main spectrum is deployed with TDD which schedules send and receive on the same frequency. The config they use allocates 80% or 90% of the time to download and is set at network level, not dynamic per device. Basically, they are way more constrained on upload capacity the way things are currently built out.
TZubiri 2y ago
[flagged]
- yjftsjthsd-h 2y ago
  >> ddns > Yeah don't do that if you want to be a professional with pride in their craft Why not?
  - TZubiri 2y ago
    Taste
    - chgs 2y ago
      I’ve used ddns to deliver service to millions, it’s a helpful tool. There’s no “taste” in a professional world, there are results.
- sampullman 2y ago
  What's a better option than DDNS that doesn't add a bunch of latency to every connection?
  - TZubiri 2y ago
    Static, dedicated ip address
    - sampullman 2y ago
      Sorry, I thought the context was an environment in which static IPs aren't an option. For example, my home internet provider offers them, but the connection is guaranteed to go down once a month for maintenance. So I think DDNS is strictly better in this situation.
- gsich 2y ago
  DDNS does not imply foreign domain.
homodyne 2y ago
[dead]
npodbielski 2y ago
There are more downsides. Instead of maintaining 1 server you have to maintain server and tunnel or 2 servers and tunnel. If someone does not know how to maintain internal network DNS and dhcp then if internet is down then your services are down too, because likely there are only reachable through external domain. I agree though that someone who does know much probably should not do that. If you know what is SSH and root account, probably less is more.
globular-toast 2y ago
"Exposing your IP address to the world" seems like such an arbitrary thing to care about when you're opening a tunnel with the express intention of letting people in. No NAT bs, but you've got magic tunnel bs instead that you have no control over. And of course you're still "exposed to the world". Your IP address is public. That's the whole point. So you're going to be using a firewall regardless, what difference does one rule make really?

joecool1029 2y ago

Yeah, afraid.org used to work great. I mean the service still works great but Google appears to blacklist any domain with the nameserver there, all email goes to spam. I just found this out in the past month. Kept all my records the same and just moved the nameserver to Fastmail and the problem resolved immediately. I have an unusual dynamic ip situation I've been taking advantage of with a different system. Some years back I noticed T-Mobile phone lines allow inbound connections on ipv6 (T-Mobile Home Internet unfortunately does not). I have a small weather station I run on a rpi3b I can access anywhere by using ddclient on the pi with cloudflare api key and it sets the AAAA record which is proxied by cloudflare, I leave the A record blank. If any users on ipv4 try to visit the site, cloudflare proxies it for them, works pretty reliably.

LoganDark 2y ago
> Some years back I noticed T-Mobile phone lines allow inbound connections on ipv6 HELL YEAH. This is exactly how ipv6 is meant to be implemented. They deserve some real praise and recognition for this.
lostmsu 2y ago
> T-Mobile Home Internet unfortunately does not Why did they make it so inconvenient?
- LoganDark 2y ago
  Home Internet is seemingly far more affordable than their phone plans. So they have other ways of encouraging you to use the phone plans.
  - joecool1029 2y ago
    Its about the same as my per-line cost. The real reason I suspect is to try to discourage upload usage. T-mobile's main spectrum is deployed with TDD which schedules send and receive on the same frequency. The config they use allocates 80% or 90% of the time to download and is set at network level, not dynamic per device. Basically, they are way more constrained on upload capacity the way things are currently built out.

TZubiri 2y ago

[flagged]

yjftsjthsd-h 2y ago
>> ddns > Yeah don't do that if you want to be a professional with pride in their craft Why not?
- TZubiri 2y ago
  Taste
  - chgs 2y ago
    I’ve used ddns to deliver service to millions, it’s a helpful tool. There’s no “taste” in a professional world, there are results.
sampullman 2y ago
What's a better option than DDNS that doesn't add a bunch of latency to every connection?
- TZubiri 2y ago
  Static, dedicated ip address
  - sampullman 2y ago
    Sorry, I thought the context was an environment in which static IPs aren't an option. For example, my home internet provider offers them, but the connection is guaranteed to go down once a month for maintenance. So I think DDNS is strictly better in this situation.
gsich 2y ago
DDNS does not imply foreign domain.

homodyne 2y ago

[dead]

npodbielski 2y ago

There are more downsides. Instead of maintaining 1 server you have to maintain server and tunnel or 2 servers and tunnel. If someone does not know how to maintain internal network DNS and dhcp then if internet is down then your services are down too, because likely there are only reachable through external domain. I agree though that someone who does know much probably should not do that. If you know what is SSH and root account, probably less is more.

globular-toast 2y ago

"Exposing your IP address to the world" seems like such an arbitrary thing to care about when you're opening a tunnel with the express intention of letting people in. No NAT bs, but you've got magic tunnel bs instead that you have no control over. And of course you're still "exposed to the world". Your IP address is public. That's the whole point. So you're going to be using a firewall regardless, what difference does one rule make really?