Selfhosted

you can reverse proxy other ports than 443 and ex. upstream ssh, the advantage of having reverse proxy over everything is to have traffic in one place so you can manage it, that's why for example kubernetes have ingress server, example nginx / openresty upstream ssh, you can restrict traffic to limited amount of IP etc.

stream {
    upstream ssh {
        server          127.0.0.1:22;
    }

    server {
        listen          2222;
        ssl_preread     on;
        proxy_pass      ssh;
    }
}

About 5 years ago I opened a port to run a test.

Within hours it was getting hammered (probably by scripts) trying to figure out what that port was forwarded to, and trying to connect.

I closed the port about a week later, but not before that poor consumer router was overwhelmed with the hits.

I closed the port after a week. For the next 2 years I'd get hammered with scans occasionally.

There are tools out there continually looking for open ports, they probably get added to a database and hackers/script kiddies, whoever, will try to get in.

Whats interesting is I did the same thing around 2000 with a DSL connection (which was very much a static address) and it wasn't an issue even though there were fewer always-on consume connections.

The only ports I have open are 80 and 443, and 80 just redirects to 443.

I also have a BeamMP server that has to have a port open because that's just how it works, but that VM sits on its own DMZ'd VLAN, and I only open the port when I'm actively playing the game.

Opening ports essentially allows other computers on the internet to initiate a connection with yours.

It's only dangerous if a service running on those ports can be exploited.

There’s definitely nothing magic about ports 443 and 80. The risk is always that the underlying service will provide a vulnerability through which attackers could find a way. Any port presents an opportunity for attack; the security of the service is the is what makes it safe or not.

I’d argue that long tested services like ssh, absent misconfiguration, are at least as safe as most reverse proxies. That doesn’t mean to say that people won’t try to break in via port 22. They sure will—they try on web ports too.

It is not just a matter of how many ports are open. It is about the attack surface. You can have a single 443 open with the best reverse proxy, but if you have a crappy app behind which allows remote code execution you are fucked no matter what.

Each port open exposes one or more services on internet. You have to decide how much you trust each of these services to be secure and how much you trust your password.

While we can agree that SSH is a very safe service, if you allow password login for root and the password is "root" the first scanner that passes will get control of your server.

As other mentioned, having everything behind a vpn is the best way to reduce the attack surface: vpn software is usually written with safety in mind so you reduce the risk of zero days attacks. Also many vpn use certificates to authenticate the user, making guessing access virtually impossible.

Firewalls, containers, separate subnets (or VLANs if possible), VPNs.
Keep really public stuff in a VPS though, and the private in your home server. Connect them via wireguard (using e.g. headscale).

It's not so much about the ports, its about what you're running that's accessible to the public.

If you have a single website on 443 and SSH on 22 (or a non-standard port like 6543) you're generally considered safe. This is 2 services and someone would need to attack one of the two to get in.

If you have a VPN on 4567 and everything behind the VPN then someone would need to hack the VPN to get in.

If you have 100 different things behind 443 then someone just needs to find a hole in one to get in.

Generally ssh, nginx, a VPN are all safe and they should be on their own ports.

If you are trying to access several different services through the internet to your home network, you are better off setting up a home VPN than trying to manage multiple public facing services. The more you publish directly to the public, the more difficult it is to keep up with everything; It is likely needlessly expanding your threat exposure. Plus you never know when a new exploit gets published against any of the services you have available.

With SSH it is easier to do key authentication. Certificate authentication is supported but it is a little more hassle. Don't use password authentication as it is deprecated and not secure.

The key with SSH (openssh specifically) is that it is heavily audited so it is unlikely to have any issues. The problem is when you start exposing self hosted services with lots of attack surface. You need to be very careful when exposing services as web services are very hard to secure and can be the source of a compromise that you may or may not be aware of.

It is much safer to use a overlay VPN or some other frontend for authentication like mTLS or an authenticated reverse proxy.

It just widens your attack surface for the ghost army of bots that roam the net knocking on ports, you don't want to be someone else's sap. I would imagine most home attacks fall into three categories: script kiddies just war driving, targeted attacks on someone specific, or just plain ol' looking for sensitive docs for identity theft or something. Its still the net, man. If you leave your ass hanging out someone's gonna bite it in a new way every time.

Not a sysadmin, just a casual IT.

If it is open, it is going to get hit by scanners, scrapers, everything and the sun, even if it is secure. Generally, 443 for your websites via reverse proxy with an IP whitelist + password is okay. Not special, lets you add subdomains, very convenient.

Now, there isn't anything special about any given port, but you still need to have some form of access control that you need to set up. If it is an API have some sort of API key in place. Implement 2FA. Try to isolate the service from the machine. Isolate the machine from bare metal. Keep the bare metal machine isolated from your home network. Take up farming. Change the default port and add some form of access alerts/logs. Have some sort of fail2ban service in place because you will be firehosed with scripts and bad traffic.

Maybe some of the stuff I recommend is paranoid overkill, but I don't know enough to cut corners. Security is a hassle, a breach is a nightmare.

Presuming you have not limited edge port 22 to one or two IPS and that you are not translating a high port to 22 internal, the danger is that you are allowing the entire internet to hammer away at your ssh. If you have this described setup, you will most definitely see the evidence of attempts to break in in your SSH endpoint and firewall logs.

Zero days for SSH do exist, so it's just a matter of time before you're compromised if you leave this open.

Imagine opening all the windows in your flat. Then leaving them open for a month. What would happen? How many insects would make their new home in your home? How many critters and cats would do the same?

Now, each window is a port. Your flat is your network. Each critter or cat is a bad actor. Each insect is a bot or virus.