Selfhosted
A place to share alternatives to popular online services that can be self-hosted without giving up privacy or locking you into a service you don't control.
Rules:
-
Be civil: we're here to support and learn from one another. Insults won't be tolerated. Flame wars are frowned upon.
-
No spam posting.
-
Posts have to be centered around self-hosting. There are other communities for discussing hardware or home computing. If it's not obvious why your post topic revolves around selfhosting, please include details to make it clear.
-
Don't duplicate the full text of your blog or github here. Just post the link for folks to click.
-
Submission headline should match the article title (don’t cherry-pick information from the title to fit your agenda).
-
No trolling.
Resources:
- selfh.st Newsletter and index of selfhosted software and apps
- awesome-selfhosted software
- awesome-sysadmin resources
- Self-Hosted Podcast from Jupiter Broadcasting
Any issues on the community? Report it using the report flag.
Questions? DM the mods!
view the rest of the comments
It's not an odd question actually it's a very good question.
Many people don't realize that "internal" services are just as exposed as "external" ones. That's because a reverse proxy doesn't care about domain name resolution, it receives the domain name as a HTTP header and anybody can put anything in there. So as long as an attacker can guess your "private" naming scheme and put a correct domain name in their request, they can use your port forward to reach "private" services. All it takes is for that domain name to be defined in your reverse proxy.
In order to be safe you should be adding allow/deny rules to each proxy host to only allow LAN IPs to access the private hosts (and also exclude the internal IP of the router that's doing the forward, if your router isn't doing masquerading to show up as the remote IP of the visitor).
Whether the proxies are one or two doesn't help in any way, they just forward anything that's given to them. If you want security you have to add IP allow/deny rules or some actual authentication.
This is exactly the type of answer I was looking for. Thanks a bunch.
So but in that way, having a proxy on the LAN that knows about internal services, and another proxy that is exposed publicly but is only aware of public services does help by reducing firewall rule complexity. Would you say that statement is correct?
Oh yes, if they're completely separate and the internal proxy can't be reached from port forward that's fine.
I was stuck thinking about two chained proxies for some reason.
I never specified, I think, and probably wasn't too clear on it myself. Thanks for your insights, I'll try to take them to my configuration now.