I’m pretty new to selfhosting and homelabs, and I would appreciate a simple-worded explanation here. Details are always welcome!

So, I have a home network with a dynamic external IP address. I already have my Synology NAS exposed to the Internet with DDNS - this was done using the interface, so didn’t require much technical knowledge.

Now, I would like to add another server (currently testing with Raspberry Pi) in the same LAN that would also be externally reachable, either through a subdomain (preferable), or through specific ports. How do I go about it?

P.S. Apparently, what I’ve tried on the router does work, it’s just that my NAS was sitting in the DMZ. Now it works!

  • pleksi@sopuli.xyzEnglish
    1·
    3 days ago

    I really feel like people who are beginners shouldnt play with exposing their services. When you set up Caddy or some other reverse proxy and actually monitor it with something like fail2ban you can see that the crawlers etc are pretty fast to find your services. If any user has a very poor password (or is reusing a leaked one) then someone has pretty open access to their stuff and you wont even notice unless you’re logging stuff.

    Of course you can set up 2FA etc but that’s pretty involved compared to a simple wg tunnel that lives on your router.

  • tofu@lemmy.nocturnal.gardenEnglish
    1·
    3 days ago

    You need a reserve proxy. That’s a piece of software that takes the requests and puts them toward the correct endpoint.

    You need to create port forwards in the router and direct 80 and 443 (or whatever you’re using) toward the host of the reverse proxy and that is listening to on those ports. If it recognized the requests are for nas.your.domain, it will forward the requests to the NAS.

    Common reverse proxies are nginx or caddy. You can install it on your raspberry, it doesn’t need it’s own device.

    If you don’t want that, you can create different port forwards on your router (e.g. 8080 and 8443 to the Raspi) and configure your service on the Raspi corresponding. But it doesn’t scale well and you’d need to call everything with the port and the reverse proxy is the usual solution.

  • towerful@programming.devEnglish
    0·
    3 days ago

    Who is externally reaching these servers?
    Joe public? Or just you and people you trust?

    If it’s Joe public, I wouldn’t have the entry point on my home network (I might VPS tunnel, or just VPS host it).

    If it’s just me and people I trust, I would use VPN for access, as opposed to exposing all these services publicly

    • Justin@lemmy.jlh.nameEnglish
      0·
      3 days ago

      Your stuff is more likely to get scanned sitting in a VPS with no firewall than behind a firewall on a home network

        • Justin@lemmy.jlh.nameEnglish
          0·
          23 hours ago

          all home routers have NAT which functions as a firewall, but VPSes don’t cone with any firewall by default, so you’d have to set one up. Also VPS ranges seem to hotter for scanning.

          • Possibly linux@lemmy.zipEnglish
            1·
            20 hours ago

            You don’t need NAT for a Firewall. NAT doesn’t provide any security benefits what so ever.

            If you put something on the internet it should always have a Firewall. Use either ufw or firewalld. I don’t see your argument since anything the bots can each will get probed.