I looked through attacks in my access logs

Re:I looked through attacks in my access logs by pkulak on Sunday January 28, 2024 @08:34PM (#39171834)

I host so many services, but I gave up totally on exposing them to the internet. Modern VPNs are just too good. It lets me sleep at night. Some of my stuff is, for example, photo hosting and backup. Just nope all the way.

[ Parent | on HN ]

Re:I looked through attacks in my access logs by justaj on Sunday January 28, 2024 @08:51PM (#39171901)

If you're the only one accessing those services, then why use a VPN instead of port mapping those services to localhost of the server, and then forwarding that localhost port to your client machine's localhost port via SSH?

[ Parent | on HN ]

Re:I looked through attacks in my access logs by pkulak on Sunday January 28, 2024 @09:03PM (#39171952)

I didn’t understand any of that, sorry. Haha

A VPN lets me access my stuff from my phone while out of the house, for example.

[ Parent | on HN ]

Re:I looked through attacks in my access logs by justaj on Monday January 29, 2024 @05:22AM (#39174739)

This might clear up a few things then: https://web.archive.org/web/20220522192804/https://www.dbsys...

Original article which doesn't contain the first graphic: https://www.xmodulo.com/access-linux-server-behind-nat-rever...

[ Parent | on HN ]

Re:I looked through attacks in my access logs by redleader55 on Monday January 29, 2024 @04:22PM (#39182830)

I am in the same situation with the grandparent. I don't even expose the SSH port to the outside. The only port open is the UDP port of Wireguard which allows only the packets signed by the correct key. Everything works perfectly, no issues with NAT, I even give my mobile devices an IPv6 that my ISP allocates.

Tunneling through SSH is significantly worse because you encapsulate a TCP connection inside a TCP connection and it's userspace.

[ Parent | on HN ]

Re:I looked through attacks in my access logs by illiac786 on Tuesday January 30, 2024 @08:21PM (#39198487)

I have also set up wireguard but I changed my model and only use to troubleshoot.

The reason is privacy. I use VPN to obfuscate my IP which means I would have to VPN my entire network. Unfortunately this has proven surprisingly difficult to do properly, meaning with appropriate performance (MTU), IPv6, no blocking (exit IP reputation), etc.

Hence I switched to Argo/cloudflare tunnels for pretty much everything.

[ Parent | on HN ]