I am still very much a novice in the self-hosting space, Linux etc. having fairly recently switched from using macOS as my daily driver and not tinkering much at all.
One of the things that often confuses me is networking and making sure my setup is secure. This is currently holding me back from hosting more stuff locally that I would require access to from outside my home, as I am afraid I am doing something that could severely compromise my data. It can sometimes be difficult to follow explanations from more advanced users due to the many different components of networking and security, and different layers of abstraction, which prevents me from following completely. I might understand one particular case, but then be unable to make connections to another one. So I would want to research this more intensively, and ideally I would end up being able to easily understand the data flows - the paths the data takes (e.g. I make a HTTPS request to some server from my laptop, how is that traffic routed correctly through my local area network and later the wide area network), in what forms (i.e. different protocols, encryption layers etc.).
In communities like this, I see there are a lot of very knowledgeable people who maybe could recommended any resources that cover this from the basics and onto more advanced stuff? Maybe a textbook from a university course on ICT that is considered particularly good? A YouTube channel with great explanations and visualizations? I am looking both at home LAN and internet in general. Enterprise level networks are not very interesting to me (at the moment).
Hehe, yeah, but even here I run into a large forest of terms and concepts. For example (the questions are only examples of things I stumble upon in this process, not questions addressed at you): "Setup a firewall" - on my server or on the router? Or both? And since my router is provided by my ISP which has its settings exposed through their online portal (which I hate the thought of), how does that factor in? What use is a router firewall if someone gains access to this portal and can configure at will? Can I set up the router in bridge mode and incorporate my own router, and thus have complete local control of my network? Couldn't someone simply deactivate this in the online portal if they gained access there? And if I open ports in the firewall for a specific application, what risks am I running outside of exploits in the applications themselves? For example, I have opened a port in the router settings for torrenting Linux ISOs (for a specific local IP) - could traffic through the same port be used to compromise the network in other ways? etc. etc.
Suddenly I have fifteen questions. So when trying to research the answer to these questions, I often get slapped with five concepts I either barely have grasp of or don't know at all in one sentence that tries to explain what is going on. It's not that it is impossible to learn this way, but it tends to quickly become overwhelming, and I run into explanations of concepts I don't have enough prerequisites to learn properly yet. Which is why I am trying to get a coherent introduction to all the topics in a sensible, curated way to beef up my understanding of it, so that the research process becomes easier.
Cheers, I will have a look to see what I find :) Sounds very much what I am looking for.
I have been meaning to install it to learn more about the structure of the packages that are sent and received. Thanks for the reminder.
Both. Access from the internet to your devices is protected from your Router. You should only ever open ports to things you want to access outside of your house. For example, a website on TCP 443 is a good thing to allow. Database access on TCP 3306 is NOT something you want to access from the internet.
Internal to your network, you can open up the Database port on TCP 3306 if another computer in your network needs access to it. Don't leave it open for no reason.
Is it a private IP Address you use to access (IE http://192.168.0.1 or is it some other thing?) If it's a private IP address, that's standard and is no problem. I've never heard of logging into something like a public website to open ports on your router.
If someone has access to your Internet Providers firwall/router combo device thingy, then it's game over. they can open any ports, do anything they want to it. However, this is unlikely. Make sure to keep your Router up to date and only open ports that you know what they're for 100% and what they do. NEVER allow access to the admin panel from the internet (WAN port). Though, if you need to use their public website (which I doubt) then it's moot and you cant do anything.
Yes, if they support it. This is what I do and that's exactly what's it's for.
Sure but this would give them access to your Providers firewall, which you have your own firewall plugged into so it doesn't matter. You will still be protected by your self provided firewall, some things will stop working (you'll be double NATed so public services might not work) and it'll be a clue someone changed something on your Providers firewall.
Yeah, so if you open no ports. you block everything.... The only exposure (of people trying to connect to you) is the firewall/router you have sitting there watching what goes on. Keeping this up to date is VERY important and they have pretty good history of not being hacked so I'd say you're safe. For each port you open you add a service that people from anywhere in the world can talk to. So, if you open port TCP 443 and have Nginx or a website answering requests, you now need to make sure this is as secure as possible. ANYONE ANYWHERE can talk to it. If a exploit is found in Nginx/your website then it can be used to get access into that computer, From there, they are on your computer and can see anything that computer has access to. If you have 2 ports open. IE website + Torrenting, Now you have two things you MUST keep up to date because anyone can talk to them and exploit them to get into your computer. This is why you MUST know what is open to the internet and what it's doing. The more things you have the more options you give hackers to get in.
I would do what they said. Start small and at the first point of contact. Understand what is plugged into the internet (ISP Router) and all the settings on it. Understand what NAT means, understand how to open ports, etc. Then start small, Set up a computer and make sure you know what ports are open. If you want a website set it up so it works internally, test it, maybe port scan your server (with nmap or something) to see what's open and understand what they're for. Close the ports you don't need open then you can consider opening it from the internet.
the most important thing is keeping it up to date and only open what you need access to.
A side point is, if it's just you that needs access to it, consider a VPN (wireguard) or overlay network (tailscale) so you only need to open one port and that will give you access to everything you need in your network.
Wow, I didn't expect anyone to actually answer the questions, but it is very very appreciated. Thanks a lot for taking the time to do so.
Ok, good. So the firewall is already configured to block everything as far as I know, except for what I explicitly allow which for the time being is only my torrent client on two different machines (randomized ports).
In a homelab setting, I believe what I want to do is expose one port to a reverse proxy and redirect traffic to local services from there. But this is one of the things that I am uncertain about because I don't entirely understand how this works. In my head: I open port 8080 where e.g. Nginx Proxy Manager listens. This is the only port anyone can gain access to anything inside my home network, and the proxy manager will say "Hey, this traffic should be redirected to port 8096 and this traffic should go to 4533", but no direct connections to these ports can be made from outside my own network as they are not exposed. I am vulnerable only to the extent that there is an exploit in the proxy manager itself or the services. I intend to run all services in Docker containers, so they should not have access to anything else on the server, and the volumes that are mounted are ideally read-only (but that cannot always be the case). It sounds safe enough, but again, since I am not entirely certain that my understanding is correct, there might be a massive gaping hole somewhere I am unaware of.
No, it is https://wifi.myisp.tld. It seems to require being connected to the WiFi to work. If I'm connected to a VPN or through mobile, it will give me an error. With my previous ISP, it was a simple login with username and password with a SMS 2FA. I never attempted to login from elsewhere then, so it might've been likewise protected. In any case, they do it like this so that less tech-savvy people can have the support perform any necessary changes on their behalf instead of trying to guide them by phone through the local web interface. So it can be accessed without being connected to the WiFi, but I guess there are larger problems if the ISPs system has been compromised to allow this somehow.
Yeah, they support bridge mode. So is this essentially enabling free flow of traffic through and completely trusting the secondary router I provide myself? And if someone then disabled bridge mode in the online interface (again assuming that this would be possible), I am not exposed as long as I have my own router following the provider's router?
What happens if I have a port open that nothing is listening to? Is that a security concern? For example, the ports to my torrent clients when I am not using the torrent client.
As I mentioned above, I am considering a reverse proxy, which to my understanding also limits the number of ports open to 1. How does that compare securitywise in your opionin?
Thinking about the torrent thing, there's no better way to do it. I'd personally open a static port IE 12345 and point that at the torrent client on the PC. I would not randomize it and open a massive range on your firewall just in case. Then just close the client when you're done and know that packets for 12345 will still reach your PC, they're just dropped there.
Not that I support it, but if you're downloading more then just Linux ISOs and you're in a country with pretty strict laws around this sort of thing, you should be using a VPN that supports opening ports. then you do not need anything open on your firewall, just to connect to the VPN when you're ready to sail the high seas.
UPNP should be disabled on your firewall (unless you play xbox or whatever). This allows a device, like an xbox or PC, to request your firewall open a port. This is needed for some online games to work properly but is not very good for security.