I’m in the process of setting up homelab stuff and i’ve been doing some reading. It seems the consensus is to put everything behind a reverse proxy and use a vpn or cloudflare tunnel.

I plan to use a VPN for accessing my internal network from outside and to protect less battle tested foss software. But I feel like if I cant open a port to the internet to host a webserver then the internet is no longer a free place and we’re cooked.

So my question is, Can I expose webserver, SSH, WireGuard to the internet with reasonable safety? What precautions and common mistakes do I need to watchout for.

    • MangoPenguin@lemmy.blahaj.zoneEnglish
      2·
      7 days ago

      If a port is forwarded in NAT and an application is listening, outside traffic can reach it directly without the application needing to initiate a connection first.

    • Björn Tantau@swg-empire.de
      2·
      7 days ago

      The application doesn’t have to actively reach outside, just to listen at that port. If there is no application listening an open port does nothing. Though a port can really only be called open if an application is listening.

        • Björn Tantau@swg-empire.de
          3·
          7 days ago

          That’s the point of port forwarding. Yes, normally applications aren’t reachable and have to reach out first. That’s how your browser can receive answers. With port forwarding you instruct your router to always forward incoming traffic for a specific port to a specific computer in your LAN.

    • thecoffeehobbit@sopuli.xyzEnglish
      2·
      7 days ago

      This post considers the situation where you expose your ports to the internet, on the edge of your residential network, for example by setting your router to forward requests with port 443 to a certain host in your network. In this case you do have a public ip address and the configured port on your home server is now reachable from the internet. This is different from just exposing a port on a machine inside a residential network for local use.

      • Auth@lemmy.worldOPEnglish
        1·
        3 days ago

        If you set your router to only forward traffic from port 443 to a certain host does this drop all non port 443 traffic to that host?

        • thecoffeehobbit@sopuli.xyzEnglish
          2·
          3 days ago

          I’d expect so, but you’ll need to test with your exact router model how it behaves. Some have a ‘DMZ’ function that you can use to pass all ports to a certain host. I use it to expose the WAN interface of my opnsense router to the internet through the ISP router. Then I can fine tune the open ports further in opnsense which is better designed for that than the usual ISP box.