I have a self hosted server running yunohost that I use for a few services for my own use all of which require login to use so they’re safe enough.

However I’m increasingly uncomfortable with the fact that anyone can discover my home IP via my domain name. Especially if I decided to install something like Lemmy or Mastodon.

Yunohost installs dyndns as part of it’s setup but, aside from buying a fixed IP from a VPN provider that allows incoming connections I’m not sure what other options I have

I can’t change very much on the modem router either. I can forward ports but that’s about it.

I can add and manage new domains if necessary.

Any and all ideas welcome but, as you can guess from the fact I’m using yunohost, my networking knowledge is limited so please eli5 :)

  •  redcalcium   ( @redcalcium@c.calciumlabs.com ) English
    2•1 year ago

    You have several options these days:

    1. Use cloudflare in DNS proxy mode and run a dynamic DNS updater so cloudflare always point to your correct IP address. By using cloudflare DNS in proxy mode, your real IP address will be hidden because all traffics will be routed via cloudflare servers first. The disadvantage is it only works for http/https service. If you need to route other service/port (e.g. ssh) you’ll need to use cloudflare tunnel

    2. Rent a small vps and use it as a bastion server. Add your home server and the vps server into tailscale or zerotier network, and then configure it to route traffics to your home server. I personally use this method because it gives me full control and flexibility over using cloudflare, but it does harder to setup.

    •  Retainer8510   ( @Retainer8510@beehaw.org ) English
      1•1 year ago

      both very good suggestions

      I’d argue that people who want to selfhost don’t want to rent a cheap VPS (i. e. aws lightsail is what I’d use)

      but honestly the vps route as a bastion server IMO is the way to go

  •  bdonvr   ( @bdonvr@thelemmy.club ) English
    1•1 year ago

    Running a federated service on your home network is just a bad idea in general. You’re screaming to the world “hey look, there’s a server running potentially exploitable software here!” Even if you hide the IP behind a VPN.

    For everything else not so public as a federated service, best bet is to install a WireGuard VPN server on your network. Set it to some random high number port. Undetectable, basically. Then when you’re away from home just connect to the VPN and it’s basically just like you’re still hooked to your WiFi at home.

  •  jax   ( @jax@lemmy.cloudhub.social ) English
    1•1 year ago

    I’d disagree with the other post (Running any software on your home network is insecure, but so is having your network connected to the internet).

    You should not be opening ports in general. There are various ways to do this:

    1. Create a site-to-site wireguard VPN with a lightweight VPS from someone like Digital Ocean, install a reverse proxy + WAF on this VPS, and setup a tunnel between it and your network.
    2. Use a service like Cloudflare Tunnels (free) to basically do the same thing

    Generally, your host should be on it’s own network/vlan with limited/no access to other VLANs within your network.

  •  naeap   ( @naeap@sopuli.xyz ) English
    0•1 year ago

    I’ve hidden everything behind Wireguard.
    externally my server doesn’t even have open ports. everyone who uses my services gets a Wireguard key.

    don’t know how many people you wanna service or if it’s just you - then Wireguard could be a viable solution

      •  naeap   ( @naeap@sopuli.xyz ) English
        1•1 year ago

        in my case Wireguard acts as access to my personal LAN, where all my services (in virtual containers or physical computers) are located. I’m just pointing to their address inside my LAN, which I can access through Wireguard.