Hi all, I’m running a small website off of a raspberry pi in my house. I have opened ports 80 and 443 and connected my IP to a domain. I’m pretty confident in my security for my raspberry pi (no password ssh, fail2ban, nginx. Shoutout networkchuck.). However, I am wondering if by exposing my ports to the raspberry pi, I am also exposing those same ports to other devices in my home network, for example, my PC. I’m just a bit unsure if port forwarding to an internal IP would also expose other internal IP’s or if it only goes to the pi. If you are able to answer or have any other comments about my setup, I would appreciate your comment. Thanks!

  • kamaii@lemmy.world
    link
    fedilink
    English
    arrow-up
    12
    ·
    1 year ago

    I have my services proxied through nginx and behind cloudflares free tier. That way I don’t have to worry about my IP getting exposed and opening myself up to DDOS/DOS attacks, which is a genuine threat if you do things that piss people off (I’m an admin on a popular minecraft server).

    • Darnov@lemmy.world
      link
      fedilink
      English
      arrow-up
      4
      arrow-down
      2
      ·
      1 year ago

      It’s 2023, the threat is there regardless if you piss anyone off. We’re all commodities that can/will be exploited for capitalistic gain.

    • gccalvin@lemmy.world
      link
      fedilink
      English
      arrow-up
      1
      arrow-down
      1
      ·
      1 year ago

      I looked into nginx for minecraft, but minecraft doesn’t use http headers, so I’d have to open minecraft ports on the router. Would this alleviate that? What’s the difference between this setup and using something like a cloudflare tunnel? Obviously, there is still some reliance on Cloudflare.

  • 64bitUser@lemmy.world
    link
    fedilink
    English
    arrow-up
    8
    ·
    1 year ago

    If you port forward to your Pi, only your Pi will be exposed. But, if your Pi gets pwned, it can in turn attack anything next to it. Safest is to isolate the Pi on it’s own subnet or a DMZ if your router has the functionality.

    Of note, many home ISPs block standard server ports like 80 and 443. You might need to use non standard ports like 8080 and 8443

  • ChrislyBear@lemmy.world
    link
    fedilink
    English
    arrow-up
    6
    ·
    1 year ago

    I did this for some time. But now I don’t want any ports open at home.

    That’s why I have a rented VPS that runs Traefik (a reverse proxy). This VPS has a VPN connection to my home net and is behind Cloudflare DNS. This is how I can safely expose services (even in my home net) to the Internet without forwarding any ports.

    Of course those services need to have some kind of authentication.

      • ChrislyBear@lemmy.world
        link
        fedilink
        English
        arrow-up
        1
        ·
        edit-2
        1 year ago

        If this was “top security” I’d need to change jobs, haha! I just hope it doesn’t fall apart and nobody breaches it too easily.

        Currently there are probably a lot of attac vectors available, that I’m not even aware of. I just have to hope, that my stuff won’t become interesting for a bad actor.

        Nothing to see here, move along. I have a few locks, not worth it… :D

    • constantokra@lemmy.one
      link
      fedilink
      English
      arrow-up
      2
      ·
      1 year ago

      I’ve been considering doing the same thing, but i’m not sure there’s much actual benefit over feeling like there’s more separation, because if someone accesses the vps, they get direct access into your server at home. What’s your opinion?

    • Contravariant@lemmy.world
      link
      fedilink
      English
      arrow-up
      1
      ·
      edit-2
      1 year ago

      If you’ve set up a VPN to your home net then why not run that VPN from the devices you use to access the reverse proxy? With wireguard at least this is quite easy.

      That way you don’t have to expose anything you just run a VPN with the reverse proxy in it.

      • ChrislyBear@lemmy.world
        link
        fedilink
        English
        arrow-up
        2
        ·
        edit-2
        1 year ago

        My setup is

        Internet <—> Reverse Proxy (on VPS) <—> OpenVPN Server (on VPS) <—> VPN Client (home router) <—> local stuff…

        I don’t understand what you mean? Generally I don’t like to require a VPN to access stuff. My use case is, when I’m away I’d like to be able to access things from e.g. a public device, a friends laptop, etc. That’s why I’m not using a VPN to access things.

        The VPN site-to-site connection is mainly responsible to make network shares available on my Nextcloud instance and provide access to other (local) services via the reverse proxy

        Currently I’m rethinking the VPN, but I don’t think I can ditch it in favor if e.g. Cloudflare Access tunnels (too unflexible, limited compatibility, or too much hassle to keep everything configured correctly).

        Also, I don’t use VPN to authorize requests. I use Authelia to authorize users with Free-IPA as directory in the backend.

        I know, this might be overkill for my “simple” use cases, but I like to play around with these kind of enterprise-adjacent solutions.

        • Contravariant@lemmy.world
          link
          fedilink
          English
          arrow-up
          2
          ·
          1 year ago

          I suppose it depends on what you want to do. I’m currently only hosting stuff for my own purposes so it is fine if I can just access it from devices I trust.

          My setup is more like

          Wireguard (on Phone/Laptop/etc) <–> Wireguard (on RaspberryPi) <–> Reverse Proxy (on RaspberryPi) <–> local stuff (mostly in docker on RaspberryPi)

          The advantage is that the only service accessible from outside is Wireguard, so even if some service running behind the reverse proxy is insecure I’m still the only one with access.

          Obviously one of the disadvantages is that I can’t access it (easily) from some random device, but I can access it from my phone and in an emergency I do have keys that I can use to install wireguard somewhere else, but I would require admin rights to some device to do so.

    • state_electrician@discuss.tchncs.de
      link
      fedilink
      English
      arrow-up
      1
      ·
      1 year ago

      Yeah, same. I have a small server that runs Wireguard and I only expose services on any device on the local Wireguard interface. That way I can safely access stuff in my home net from anywhere.

  • 0110010001100010@lemmy.world
    link
    fedilink
    English
    arrow-up
    6
    arrow-down
    1
    ·
    edit-2
    1 year ago

    The port forward only forwards to a single device so you aren’t exposing your PC (directly anyway). Sounds like you have the pi good and secured but if you wanted to add another layer you could segment it out into a DMZ or its own VLAN. That way if something did happen with it an attacker couldn’t move laterally inside your network.

    Realistically though you’re in good shape.

  • surewhynotlem@lemmy.world
    link
    fedilink
    English
    arrow-up
    4
    ·
    1 year ago

    You could put the pi on its own subnet. That way if it’s hacked, the rest of the network is protected. Just make sure your router admin interface doesn’t answer on that subnet.

    • TitanLaGrange@lemmy.world
      link
      fedilink
      English
      arrow-up
      5
      arrow-down
      1
      ·
      1 year ago

      You could put the pi on its own subnet.

      This option is sometimes referred to as a ‘DMZ’ and may be supported by the router. Also look for VLAN options.

      • Manbat@lemmy.world
        link
        fedilink
        English
        arrow-up
        3
        ·
        1 year ago

        DMZ in essence means “forward ALL ports” to X. You should only DMZ a host that you know is very secure as its attack surface is significantly increased. If you need just one or two services open, best to not use DMZ

  • NSA_Server_04@lemmy.world
    link
    fedilink
    English
    arrow-up
    4
    ·
    1 year ago

    You’ll be ok as long as whatever software you’re running that is listening to 80 and 443 never has an exploitable vulnerability, if it does… you may be in trouble depending on the vulnerability.

    Or be careful of the service on the other side of your (I assume) reverse proxy, should it have a vulnerability you may still be in trouble depending on the setup of the reverse proxy and what it’s config is.

  • VexCatalyst@lemmy.fmhy.ml
    link
    fedilink
    English
    arrow-up
    4
    ·
    1 year ago

    You should be fine. If you are using port forwarding the inbound traffic on that port should be sent only to the system you have designated. The only way that changes is if the system (rpi in this case) is operating as a reverse proxy. Even then net side should only see the proxy.

    The biggest vulnerability would be the system that you are forwarding to, and if that system is a reverse proxy whatever the backend systems are. Make sure everything is fully updated/patched and that you trust the services that you are running and you should be good.

    My only comment on your setup would be to make sure you fully understand what you are doing and more importantly, why. Cargo Culting is a bad way to admin. Good questions like yours are a good way to start.

  • pacology@lemmy.world
    link
    fedilink
    English
    arrow-up
    5
    arrow-down
    1
    ·
    1 year ago

    You are probably going to be ok unless someone really wants to hack you. The LastPass hack that exposed passwords of millions of people started from an open port in the home network of one of their engineers.

    If you want to be somewhat safer, you could try something like the cloudflare tunnel thing to proxy your home network through their server.

    • SpaceMan9000@lemmy.world
      link
      fedilink
      English
      arrow-up
      3
      ·
      1 year ago

      Honestly depends on what he’s hosting… Services like shodan are constantly scanning the web and are trying to see what is actually running in the machine.

      If he’s serving something that’s vulnerable and has rce it won’t take too long for him to get automatically pwned.

      We’ve seen this with the hafnium Echange vulnerability and all known vulnerable public facing web apps that used log4j.

      Regarding the LastPass breach, the second part of the breach was using a very outdated version of Plex. Chances are high that his home machine was already hacked by other malicious actors.

  • dan@upvote.au
    link
    fedilink
    English
    arrow-up
    2
    ·
    edit-2
    1 year ago

    It should be safe, as it just exposes the Raspberry Pi. Make sure you’ve configured fail2ban to also watch the logs of all your webapps and ban people that try to brute force them (for example, if you host your own Vaultwarden instance, fail2ban should be configured to watch the Vaultwarden log for authentication failures).

    For web apps that only you need to access (i.e. they do not have to be exposed publicly), consider using a VPN to access them remotely, instead of exposing the apps publicly. Wireguard and Tailscale work well for this. Tailscale is built on top of Wireguard and makes it very easy to get up and running.

  • taladar@sh.itjust.works
    link
    fedilink
    English
    arrow-up
    1
    ·
    1 year ago

    You could accidentally expose another device if the Pi and other devices all get dynamic IPs in your local network, you might want to set a fixed IP outside of the DHCP Server’s range for dynamically assigned addresses for the Pi.

  • knowncarbage@lemmy.fmhy.ml
    link
    fedilink
    English
    arrow-up
    2
    arrow-down
    1
    ·
    1 year ago

    I have no idea but am interested in answers.

    I’ve only exposed ports briefly for testing and got scared.

    I feel a little calmer using tailscale the past few months but still feels like putting a lot of faith in someone I don’t really know I can trust.

  • Gerowen@lemmy.world
    link
    fedilink
    English
    arrow-up
    1
    ·
    1 year ago

    Forwarding a port only forwards traffic to the device you specify. Be prepared for plenty of port scans though. If you have internal system email set up your Fail2Ban will be sending you daily messages. I get 5 or 6 a day from automated port scans triggering Fail2Ban.

  • entropicshart@lemmy.world
    link
    fedilink
    English
    arrow-up
    2
    arrow-down
    1
    ·
    edit-2
    1 year ago

    I would suggest signing up for a free Cloudflare account and setting up any DNS for your Pi through there, using the Cache feature.

    Once that is done, setup an automated script that will pull down Cloudflare IPs into a file (you can use a cronjob to run this daily):

    #!/bin/bash
    
    set -e
    
    cf_ips() {
      echo "# https://www.cloudflare.com/ips"
    
      for type in v4 v6; do
        echo "# IP$type"
        curl -sL "https://www.cloudflare.com/ips-$type/" | sed "s|^|allow |g" | sed "s|\$|;|g"
        echo
      done
    
      echo "# Generated at $(LC_ALL=C date)"
    }
    
    cf_ips > allow-cloudflare.conf
    (cf_ips && echo "deny all; # deny all remaining ips") > allow-cloudflare-only.conf
    

    Then in your web server config to only accept connections from Cloudflare IPs:

    server {
    	listen 80 default_server;
    	listen [::]:80 default_server;
    	server_name example.com;
            root /var/www/html;
    
    	include /etc/nginx/allow-cloudflare-only.conf;
    }
    

    I prefer this method over UFW/iptables block as it allows you to control the IP block per web config, so if needed, you can make exceptions by not adding the include /etc/nginx/allow-cloudflare-only.conf; into that specific site’s conf file.

    • alxx@lemmy.world
      link
      fedilink
      English
      arrow-up
      1
      ·
      1 year ago

      And with Cloudflare you could also only open up port 443, because Cloudflare will do HTTP ➡ HTTPS if you enable that in their settings.

  • Lung@lemmy.world
    link
    fedilink
    English
    arrow-up
    1
    arrow-down
    1
    ·
    1 year ago

    If you run your webserver in a sandbox, that adds an extra layer of security. Something like docker, or a classic setup where you have a special user account with limited access, is good. So if the server gets owned, the damage is still contained

    Random webservers online are still often attacked, so disabling all password based access is helpful. You may have to occasionally look at the connections log and ip ban some attempts

    • ThreeHalflings@lemmy.world
      link
      fedilink
      English
      arrow-up
      2
      ·
      edit-2
      1 year ago

      If you exploit a service running on Docker you can still use that to exploit other services running on the local network that are not directly exposed to the internet. Docker offers a layer between the service and the host it’s running on, not the rest of your unsecured internal network where you have samba shares with one letter passwords.