Everything works fine now, but feels…hacky. My question is, what’s the best way of dealing with allowing only certain services to be accessible to the world while blocking other services to everything except local (+vpn) clients? Currently, because of my vps port forwarding, all external traffic appears to come from that machine. So, what I have now in my nginx config is to allow traffic from the local & wireguard subnets, except for traffic from the vps itself.
So: looking for advice on how to better manage access, but of course, if anyone has other improvements/suggestions, I’m all ears.
My current setup is:
Machines:
VPS (vps) with public IP.
Home router (router) with no public IP or open ports.
Home server (srv-home).
Remote server (srv-remote), located with family.
Network structure, ignoring vlans and whatnot, is:
vps <–wireguard–> router
vps <–wireguard–> srv-remote
router <–ethernet–> srv-home
srv-remote and srv-home can communicate through vps+router.
Services & structure, broadly speaking:
vps port forwards http/s to router, which port forwards to srv-home (can optionally have it port forward directly to srv-home, doesn’t really matter to me).
srv-home handles SSL, both for services on srv-home and srv-remote. This allows me to a) manage certificates locally in one place (not on vps), and b) use local DNS on my router to bypass vps for locally hosted services. Works great.
srv-home and srv-remote both host some services which I would like to be publically accessible and some that I would like to remain private.
vps also acts as my roadwarrior vpn, on the same wireguard interface that’s used for the vps<–>router link. One solution would be to just have separate wireguard interfaces (or maybe just separate address spaces?) for the vps<–>router and vps<–>[roadwarrior] links? Another would be to get the vps portforwarding set up in a way that doesn’t lose originating IP address, but so far I have been unsuccessful there.
I would move the SSL to your VPS, make that your nginx entry point.
Then use virtual servers in nginx to listen on the wiregiard nic for local stuff and it’s public IP for internet accessible stuff, you could also add in some Auth service for things without MFA.
So in order to access from local network (useful for e.g. photo uploading as it is way faster) would you just handle SSL locally too? So, SSL on VPS+SSL on local server (with only one being used per client of course)?
You are not logged in. However you can subscribe from another Fediverse account, for example Lemmy or Mastodon. To do this, paste the following into the search field of your instance: !selfhosted@lemmy.world
A place to share alternatives to popular online services that can be self-hosted without giving up privacy or locking you into a service you don’t control.
Rules:
Be civil: we’re here to support and learn from one another. Insults won’t be tolerated. Flame wars are frowned upon.
No spam posting.
Posts have to be centered around self-hosting. There are other communities for discussing hardware or home computing. If it’s not obvious why your post topic revolves around selfhosting, please include details to make it clear.
Don’t duplicate the full text of your blog or github here. Just post the link for folks to click.
Submission headline should match the article title (don’t cherry-pick information from the title to fit your agenda).
I would move the SSL to your VPS, make that your nginx entry point.
Then use virtual servers in nginx to listen on the wiregiard nic for local stuff and it’s public IP for internet accessible stuff, you could also add in some Auth service for things without MFA.
So in order to access from local network (useful for e.g. photo uploading as it is way faster) would you just handle SSL locally too? So, SSL on VPS+SSL on local server (with only one being used per client of course)?
You could, that would keep home stuff at home