Looking for advice for self hosted networking.
Question first, details below:
Everything works fine now, but feels…hacky. My question is, what’s the best way of dealing with allowing only certain services to be accessible to the world while blocking other services to everything except local (+vpn) clients? Currently, because of my vps port forwarding, all external traffic appears to come from that machine. So, what I have now in my nginx config is to allow traffic from the local & wireguard subnets, except for traffic from the vps itself.
So: looking for advice on how to better manage access, but of course, if anyone has other improvements/suggestions, I’m all ears.
My current setup is:
Machines:
- VPS (vps) with public IP.
- Home router (router) with no public IP or open ports.
- Home server (srv-home).
- Remote server (srv-remote), located with family.
Network structure, ignoring vlans and whatnot, is:
- vps <–wireguard–> router
- vps <–wireguard–> srv-remote
- router <–ethernet–> srv-home
srv-remote and srv-home can communicate through vps+router.
Services & structure, broadly speaking:
vps port forwards http/s to router, which port forwards to srv-home (can optionally have it port forward directly to srv-home, doesn’t really matter to me).
srv-home handles SSL, both for services on srv-home and srv-remote. This allows me to a) manage certificates locally in one place (not on vps), and b) use local DNS on my router to bypass vps for locally hosted services. Works great.
srv-home and srv-remote both host some services which I would like to be publically accessible and some that I would like to remain private.
vps also acts as my roadwarrior vpn, on the same wireguard interface that’s used for the vps<–>router link. One solution would be to just have separate wireguard interfaces (or maybe just separate address spaces?) for the vps<–>router and vps<–>[roadwarrior] links? Another would be to get the vps portforwarding set up in a way that doesn’t lose originating IP address, but so far I have been unsuccessful there.
Thanks in advance for any insight!
What I do is have NGINX proxy manager running in the VPS with ACLs defined there and then forwarding traffic over the WG tunnel.
Alternatively you could treat the vps like a full VPN endpoint. Route all traffic over the tunnel and nat/masquerade on the vps.
Having done both. Option 1 is cleaner and you’re not routing unnecessary traffic over what is likely a metered link.
Thanks! So, for local (not VPN) traffic I like to access the local IP for bandwidth reasons — would you then just set up SSL on both the local server and the VPS?
Yeah. I have a couple of those. I’ll admit it’s a little bit of a hassle but if you’re using something like let’s encrypt you could have a Cron job sync the cert.
Let’s Encrypt’s certbot allows you to setup a script to be run after acquiring the certificate. No cron job needed.