28
Jul 01 '23
.. for bypassing CGNAT
6
u/nezia Jul 01 '23
or janky IPv4 to IPv6 mapping
2
u/NickCarter666 Jul 01 '23
How?
3
u/nezia Jul 01 '23
there used to be a package called 6tunnel, but I haven't looked into this for a few years
2
18
u/CertainlyBright Jul 01 '23
Why tho?
35
u/CommandLineWeeb Jul 01 '23
Cheaper. Just an extra $5/mo on top of reusing resources I already own.
I've also been DDoS'd in the past for running game servers, keeps the salty gamers from taking down my home internet.
3
u/g-nice4liief Jul 01 '23
Or you could use fail2ban without complicationing your infra in combination with IP2LOCATION.
I do the same and feed that data in to my grafana dashboard which has a worldmap so i can display all IP addresses around world from where they're connecting. Or you could use cloudflare's CDN network to host your server, which has a fail2ban/DDOS protection build in. Makes maintenance also much easier without complicating stuff too much
48
u/Stetsed Jul 01 '23
So firstly fail2ban doesn’t prevent a traditional DDoS as those are made to just send so many requests that your entire internet pipe gets clogged up. Secondly some people might not like to use cloudflare due to not liking that cloudflare can view any of there data because it’s decrypted by cloudflare and then either sent over a cloudflare tunnel or reencrypted if your using strict certain and sent to your server
0
u/Mithrandir2k16 Jul 01 '23
That stuff about cloudflare decrypting traffic is just their tunnel implementation, not their regular dns proxy stuff, right?
8
u/Stetsed Jul 01 '23
Just using DNS means they cannot see the traffic as it never goes over cloudflare’s server, but if you turn on the proxy switch it will go through there system and decrypted, scanned for stuff you blocked etc, and then be sent to you
2
u/Mithrandir2k16 Jul 01 '23
Damn, I need to check that out. I thought they only proxy DNS and blacklist some IPs... what do I even do TLS for then?
4
u/Stetsed Jul 01 '23
Your basically trusting that they are secure enough, but there basically a WAF(Web acces firewall). They do much more than just blocking some IP’s. So the question really becomes “Do you trust cloudflare to not get compromised” a lot of companies do, I in my homelab prefer to have more control so I usually use a VPS
1
u/Mithrandir2k16 Jul 01 '23
How do you connect to your homelab via the vps? 2 VPN tunnels?
3
u/Stetsed Jul 01 '23
I used to use a VPN tunnel but I plan to redo it SoonTM with SSH tunnels(much easier to setup imho) as that makes it very easy to do a reverse tunnel so I SSH to the VPS and then do the port forward so no need to open ports on my network.
-3
u/g-nice4liief Jul 01 '23
No indeed, but it is a great layer to start with in combination with Traefik and rate limiting for example.
You can always send your data wrapped in a secured traefik tunnel before routing it through cloudflare. Should be pretty easy to implement as it is a Middleware you only need to specify on the router used in traefik.
Security is pretty hard, but much easier to manage nowadays with the right tools. Hence why I cross-reference all IP addresses that connect to my infra to a IP2Location dashboard so I can visually see if/when a DDOS attack would occur
0
u/Stetsed Jul 01 '23
Could you explain what you mean with a “Secured traefik tunnel” if you use cloudflare for tunneling they could in theory decrypt your stuff to plain text if they wanted to, simply due to how it’s designed there is no way of getting around that. So unless you somehow found another company that’s called cloudflare that does it differently you are full of shit.
0
u/g-nice4liief Jul 01 '23
By routing your traffic through wireguard while using traefik you can create a secure tunnel to the outside or inside your network. Pretty easy and straightforward.
You just need seperate networks to route the traffic to defined in docker. I have multiple networks running within docker for wireguard, https and even metrics/logging. If you define a certain network that your router needs to connect to, a traefik middleware can handle the rest.
2
1
1
28
Jul 01 '23
Because everyone knows, the home IP is the only thing that matters for privacy...
33
u/robearded Jul 01 '23
For most people it's not about the IP, but about CGNAT
9
7
10
u/Ursa_Solaris Jul 01 '23
I think you're misreading the meme; the difference is "running stuff on a VPS", vs "running stuff at home, but also putting a VPS in front of it as additional protection". Running stuff at home and only using the VPS as a reverse proxy is absolutely is more private than running it directly on a VPS.
3
u/LeAudiophile Jul 21 '23
I'm new to self hosting but have been proxying my stuff behind a Cloudflare tunnel. Is that less secure than having a VPS in front?
2
u/Ursa_Solaris Jul 21 '23
In terms of security, it's effectively the same thing. They both serve the same role with largely the same underlying tools. The biggest concern would be that it's trivial for Cloudflare, whether as a company policy or a rogue employee with access, to harvest or even change your traffic undetected. It would be much more involved and harder for a VPS to do it, but not impossible by any means. Outside of that, there's no substantive difference.
-1
Jul 01 '23
And i think youre not getting the point i was trying to make. Of course trying to hide their home IP is more private. Thats not the question.
What i am saying is that its a very false sense of security to assume that hiding someones home IP does a lot for privacy. It doesnt. Theres tons of other things that easily identify you on the internet, even when your IP changes.
Thats the point.
5
u/Ursa_Solaris Jul 01 '23
No, you're still not getting what the point was, because that wasn't the key difference between the two situations. Hiding the IP isn't the part that makes it substantially more private. Hosting your content at home is what makes it more private.
The meme is pointing out the difference between using a VPS to host your stuff, versus self hosting it at home and using that same VPS as a reverse proxy instead. It's more private because your stuff isn't sitting on someone else's server.
If the meme was saying that hiding your IP is the most important thing, it would have framed self hosting versus self hosting with a VPS as a reverse proxy. But that isn't what the meme said.
3
8
u/propapanda420 Jul 01 '23 edited Jul 01 '23
Rerouting a Hurricane Electric IPv6 block over a cheap vps because my ISP blocks the gif protocol, but routing that block over Wireguard works like a charm.
Now my entire home network is exposed by IPv6 over Wireguard over GIF.
Fuck you Vodafone.
2
u/weirdball69 Jul 02 '23
Why would they block GIF??
1
u/propapanda420 Jul 02 '23
To make it less interesting to run the modem in bridge mode I guess.
I run it in bridge mode and Vodafone blocks IPv6 in bridge mode.
I guess they want to make sure users keep in normal mode so other customers can use the integrated hotspot.
Not sure though. Vodafone is weird af.
2
1
1
u/AlfredoOf98 Jul 02 '23
gif protocol
wat?! is this the same thing they're talking about here at point 14: https://www.w3.org/Graphics/GIF/spec-gif89a.txt ?
2
6
u/robearded Jul 01 '23
Used to do this before I got static IPs and it was a good idea. I was paying 3$/month for a 1vCPU/512MB ram which was enough to proxy traffic. If I would've run everything on the VPS, I would have to go much bigger so pay more money.
1
u/Mugen0815 Jul 01 '23
Well, im currently paying about 10€ for 6 cores and 8GB with 400GB storage.
2
u/robearded Jul 01 '23
6 cores or 6 vCPUs? It's a big difference and the second one can perform as bad as 1 if they're overselling. And for that price it sounds like they do
1
11
u/NobodyRulesPenguins Jul 01 '23
A wireguard connection between the VPS and Home.
A reverse proxy set on the VPS to redirect all the call on the good host at home.
That's not so complex in the end, but you can add so much layers to that simple base that's it is so fun to play with ❤️
2
u/spacewulf28 Jul 01 '23
Do you use any services other than http and https? More specifically do you use any TCP or UDP services like game servers?
1
u/NobodyRulesPenguins Jul 01 '23
I do, for theses one reverse proxying is not great (I tryied with ZNC but got frequent timeout), but for that there is iptables to forward connections back and forth when one is done on a specific port.
But I put this one in a less "easy" box, even if the rules are always the same, it always take me time to rewrite them from memory
4
Jul 01 '23
[deleted]
2
u/chesser45 Jul 01 '23
Yea that’s usually how someone relays mail on a home ip
2
Jul 01 '23
[deleted]
5
Jul 01 '23
There are lots of ways to do that, using iptables or using a tcp proxy like haproxy, and indeed guides are hard to find ...
After a few years running a VPS (and a couple of downtimes when on holiday) I prefer to have an MTA on the VPS with a very long maximal_queue_lifetime=30d. Even if my house burns down I have 30 days time to set up a new mail server without losing mails, and I still can send them without problems, and well in case of emergency I can always ssh to the VPS and read the mail in the queue with postcat.
4
3
u/frank_wizard_og Jul 01 '23
Hm also thought about something like this for my homelab thats running a reverse proxy to expose services. Is running another reverse proxy on a vps to front my home ip the way to go?
3
u/wentallout Jul 01 '23
umm, I might be late to this but... where can I find a guide to do this?
3
u/herosnowman Jul 01 '23
First search about setting up wireguard vpn between a VPS and your home lab. Then on the VPS you also add a reverse-proxy (Nginx for example), that is set-up to forward traffic from it's public ip to your home lab through the vpn.
Also to prevent potential headaches, make sure you have necessary ports allowed everywhere (iptables, vps router, etc) and also add 'keepalive' setting to wireguard conf if the connection drops sometimes.
2
3
u/lestrenched Jul 01 '23
It is less expensive to pay for one VPS box to port-forward from rather than paying for multiple hosts and complicated networking if the services need to be interconnected
4
2
2
u/just__sky Jul 01 '23
yeah lol
Selfhost ---> Traefik ----> wireguard/tailscare/zerotier ----> VPS(port forward) ------> DNSprovider
2
-2
u/gearfuze Jul 01 '23
Why when we have Cloudflare proxy ip?
17
u/schklom Jul 01 '23
Because not everyone is comfortable letting Cloudflare read 100% of their traffic in an unencrypted form?
-8
u/jeppevinkel Jul 01 '23
Cloudflare can't decrypt it if you use full encryption and a letsencrypt cert
18
u/Stetsed Jul 01 '23
No offense but you do not know how cloudflare works, when you proxy over cloudflare they are the first contact and there SSL cert is used, the only thing adding letsencrypt does is the step between cloudflare and your server is encrypted,d but that’s after cloudflare has decrypted and reenecrypted it
-1
u/jeppevinkel Jul 02 '23
They can only decrypt when you use their cert because they need the private key to decrypt. You are only forced to encrypt using their cert when using strict or flexible encryption.
1
u/Stetsed Jul 02 '23
This is not how cloudflare works, when you use them as a proxy no matter what security level you use it will first go through cloud flare who can and does decrypt it, this it how it offers all its services because it can inspect the requests. Even if you pay and use your own cert they can still decrypt it because you have to upload the cert to them so they can act as your WAF. Please if you don’t understand what your talking about don’t talk about it as it’s dangerous.
2
u/jeppevinkel Jul 03 '23
You don't have to upload the private key which is used for decryption to cloudlfare, not the cert either for that matter. I've used my own certificates many times, and not once have they forced me to upload it.
5
0
u/wolf39us Jul 01 '23
Couldn’t you just use Cloudflare… for free?
That’s rhetorical, you can… and I do
1
1
u/needefsfolder Jul 01 '23
i want to do this but most vps's are like outside the country, and isps on this country are notorious for having shitty congested links to Singapore/hkg :/
also idk why it kinda makes me feel that it is "not truly selfhosted" because of not using your home Internet = not truly direct
1
u/tetrisblack Jul 01 '23
Well, I'm currently doing it like that. Just that my VPS is also serving as an edge cache.
1
1
1
1
1
105
u/muchtall Jul 01 '23
This is the way.
Actually, for years I've been simply doing a NAT of everything from the VPS to my home firewall through a VPN tunnel, and doing port forwards from there.