I have a self hosted server running yunohost that I use for a few services for my own use all of which require login to use so they’re safe enough.
However I’m increasingly uncomfortable with the fact that anyone can discover my home IP via my domain name. Especially if I decided to install something like Lemmy or Mastodon.
Yunohost installs dyndns as part of it’s setup but, aside from buying a fixed IP from a VPN provider that allows incoming connections I’m not sure what other options I have
I can’t change very much on the modem router either. I can forward ports but that’s about it.
I can add and manage new domains if necessary.
Any and all ideas welcome but, as you can guess from the fact I’m using yunohost, my networking knowledge is limited so please eli5 :)
You have several options these days:
-
Use cloudflare in DNS proxy mode and run a dynamic DNS updater so cloudflare always point to your correct IP address. By using cloudflare DNS in proxy mode, your real IP address will be hidden because all traffics will be routed via cloudflare servers first. The disadvantage is it only works for http/https service. If you need to route other service/port (e.g. ssh) you’ll need to use cloudflare tunnel
-
Rent a small vps and use it as a bastion server. Add your home server and the vps server into tailscale or zerotier network, and then configure it to route traffics to your home server. I personally use this method because it gives me full control and flexibility over using cloudflare, but it does harder to setup.
I’ve had to find a solution similar to what you are looking for. My need was due to being double NAT’ed where I had no control over the internet facing router/NAT.
Personally, my solution was to use Oracle Clouds free tier service to host and NGINX reverse proxy as Oracle also offers free static IPs to there compute instances. From there I used Tailscale to join the instance to a Proxmox container running Docker on my server running services I wanted exposed to the internet (Emby, and a few 'Arrr apps). I’ve found it to be remarkably stable (much more than I expected).
An alternative method is to use Cloudflare tunnels, which are very easy to get setup. It in essence is the same principle as above but using Cloudflare’s ‘reverse proxy as a service’ type product. I was not able to use this for my needs as Cloudflare do not allow media streaming.
If you do choose the first option, I would recommend isolating the server running the exposed services to its own network that cannot touch your day-to-day network. I also recommend configuring ACLs in Tailscale to restrict traffic to specific ports from specific hosts to minimise any risk of having exposed services. Oh, and automatic updates to the OS and services is ideal.
I saw you are using basic HTTP auth, whilst it is secure enough it does have some issues with making connections more difficult, particularly if you are using any of your services API’s (it is also not the best user experience IMO). I would recommend setting up oAuth/SSO if yunohost supports it.
Lastly, as other users have said, even if you don’t use either suggestion, put a reverse proxy on it. NGINX Proxy Manager is a nice friendly solution with a web GUI if you are not too familiar with proxy configs
You have several options these days:
-
Use cloudflare in DNS proxy mode and run a dynamic DNS updater so cloudflare always point to your correct IP address. By using cloudflare DNS in proxy mode, your real IP address will be hidden because all traffics will be routed via cloudflare servers first. The disadvantage is it only works for http/https service. If you need to route other service/port (e.g. ssh) you’ll need to use cloudflare tunnel
-
Rent a small vps and use it as a bastion server. Add your home server and the vps server into tailscale or zerotier network, and then configure it to route traffics to your home server. I personally use this method because it gives me full control and flexibility over using cloudflare, but it does harder to setup.
I’d disagree with the other post (Running any software on your home network is insecure, but so is having your network connected to the internet).
You should not be opening ports in general. There are various ways to do this:
- Create a site-to-site wireguard VPN with a lightweight VPS from someone like Digital Ocean, install a reverse proxy + WAF on this VPS, and setup a tunnel between it and your network.
- Use a service like Cloudflare Tunnels (free) to basically do the same thing
Generally, your host should be on it’s own network/vlan with limited/no access to other VLANs within your network.
Exposing your IP doesn’t matter at all. Any site you browse will have it.
Except I don’t browse via my server, I browse behind a VPN client on my PC/phone etc. The server on the other hand is not behind a VPN client as most providers don’t offer a fixed IP or allow port forwarding. Therefore if anyone knows my domain name, they can get my ISP provided IP which resolves my location far too accurately for my liking.
Running a federated service on your home network is just a bad idea in general. You’re screaming to the world “hey look, there’s a server running potentially exploitable software here!” Even if you hide the IP behind a VPN.
For everything else not so public as a federated service, best bet is to install a WireGuard VPN server on your network. Set it to some random high number port. Undetectable, basically. Then when you’re away from home just connect to the VPN and it’s basically just like you’re still hooked to your WiFi at home.
If you are the only one using your services, sure but that’s way more of a PITA than 99% of users are going to put up with. Running a federated service is no different than running any other service - harden your network, use tunneling if you so desire (though if hosting media, the likes of Cloudflare are out of the question), have your local VLANs configured accordingly, and manage it like you would any other service. Hell, if you are super paranoid, go dual WAN as that’s likely cheaper than having a multiple VPS for your services or paying for the needed bandwidth on one (again, assuming media hosting)
