How to self-host servers in your living room on static IPs
13 points by lim
13 points by lim
You should configure SSH to accept keys only and (optional) only listen on a local IP address (e.g. 10 network). This is beyond the scope of the article, but it’s quite trivial to set up.
Besides only doing public key sign in, running sshd on a non-standard port is also nice. Gets rid of considerable log spam from low effort drive by intrusion attempts. Not really a security thing just a log noise reduction measure.
My experience is that you have to run something else on TCP port 22 before the user name guessers don't try your real ssh on some other port.
I've got skeeto's endlessh running on port 22, sshd on some higher port on one of my servers. It gets virtually no guesser traffic. endlessh gets a ton of traffic. Before I had that setup, my higher port sshd got quite a bit of traffic.
I do something like this, using tinc.
I've got a machine on a "business" Internet circuit with several static IPs, and because we can't control the routing to our /29, we have to bridge. tinc allows that, so my home machine connects via tinc, keeps a route to the machine on the "business" Internet that runs tinc, and makes the "business" Internet default gateway its own.
It works quite well no matter where I am, and recovers quickly from network changes or network drops of all kinds. It works behind CG-NAT, or over IPv6, if available.
I've run other servers over tinc tunnels for months, with hardly any problems.
I do it with ranet and run Babel on top of the IPsec mesh with BIRD. All my machines (nixos btw) have publicly reachable v4/6 address advertised under my own ASN and IP blocks thru a few VPS providers with BGP sessions. Took me a while to wire up vrf and play with segment routing, but it’s a very interesting and fun learning experience ;)
e.g. I have a public NTP server (with nts ofc) in the pool in my shitty apt that had already served probably over 10B requests behind sfr copper wire
Hi @ysun I'm curious why having your own ASN? How does it help you? Or, is it more about your curiosity and learning internet-level networking concepts, etc.?
You’d be surprised that there is a pretty significant number of “hobby net”s in the full table
To answer your questions, you don’t have to have it and I did it bc why not 🤣
also it’s not THAT expensive to get one, ~500/ye for ARIN, cheap LIRs can sponsor one for you in RIPE region for ~100/yr, and about 300k yen for Japan
You’d be surprised that there is a pretty significant number of “hobby net”s in the full table
Fascinating! That is not what I expected. I mean, I can imagine some small numbers of hobby folks...but "pretty significant"? Wow, today i learned!
...I did it bc why not
Now, that's awesome! Kudos to you!
also it’s not THAT expensive to get one, ~500/ye for ARIN, cheap LIRs can sponsor one for you in RIPE region for ~100/yr, and about 300k yen for Japan
That sounds cheaper than i would have imagined! Not that i have a need for one...and not that those prices are necessarily super cheap...but if i did need one, I think those prices don't seem unreasonable. Thanks for sharing!
My idea to explore here is the Yggdrasil network.
Yes, people who want to access your servers has to be on Yggdrasil too. But on the other hand, the legion of residential proxies is not on Yggdrasil. And likely some web-of-trust system can be layered on top of Yggdrasil.
(Plus, how cool it is that if an Yggdrasil host moves to a different network on the Internet... its Yggdrasil IP address remains the same?)
Another option is something like Cloudflare tunnels, which works very well for me at least.
I've actually got it so the docker container itself ships with cloudflare tunnel installed and the app config lets it know connection details. I don't have to do anything or think about it.
or using a reverse proxy on a small vps, and connecting the machines with an overlay network like wireguard or tailscale
or using a reverse proxy on a small vps, and connecting the machines with an overlay network like wireguard or tailscale
Ah, this is exactly what I'm in the middle of starting! I had been hosting loads of little apps (and small static websites) on Digital Ocean for many years, and then about last year or so - for cost saving reasons - had started migrating awau from DO and towards Hetzner. (Never had tech issues with DO, it was really only to save a buck or so per month.) And then, wouldn't you know it, Hetzner had 2 non-trivial cost increases this year. So, now I'm seeking better ways to both host my apps, plus keep costs at a reasonable level. The approach of a reverse proxy via small VPS to home LAN seems at least reasonable (and hopefully not too maintenance-intensive...And, in fact, the audience for the apps that i host is literally only my small family and myself (so we're not talking any needs to support tons of users)...so of course, we'll see how it goes.
...except for the minor nitpick that Cloudflare is evil and is currently MITM for a huge chunk of the Internet, and likely are in bed with the US government...