The Post Ninja

  • 0 Posts
  • 17 Comments
Joined 3 years ago
cake
Cake day: July 8th, 2023

help-circle






  • On your DNS provider, make an A record with your IP address, AAAA record with your IPv6 address. If these addresses change often, either setup a dyndns (your DNS provider needs to support this) or pay for a Static IP from your ISP. Firewall the hell out of your network, have a default deny (drop) new inbound rule, and only open ports for your service. Use an nginx reverse proxy if possible to keep direct connections out of your service, and use containers (docker?) for your service(s). Don’t forget to setup certbot and fail2ban. You need certbot to auto update your certs, and you need fail2ban to keep the automated login hacker bots from getting in.

    That’s the minimum. You can do more with ip region blocking and such, as well as more advanced firewalling and isolation. Also possible to use Tailscale and point the DNS A record to the Tailscale IP, which will eliminate exposing your public IP to the internet.








  • DHCP, when set up properly, makes for less work. Reservations will have the DHCP server hand out the same IP to the same hardware (MAC address) when it asks. If you have a device that is from the dinosaur age that doesn’t play nice with DHCP, then make sure you give it an address that is outside the DHCP range on the same subnet. ex: Some home routers use 192.168.1.100 to 192.168.1.200 as the dhcp range. Setting anything from 192.168.1.1 (or 2 if the router is on 1) to 192.168.1.99 is fine, as is 192.168.1.201-192.168.1.254 (or 253 if the router is on 254). However, by setting static ips, you have to remember those ips specifically to interconnect devices on the lan, whereas reserving via dhcp allows you to use local dns resolution to connect to devices via their hostname instead. In additon, you run the risk of ip conflicts from forgetting which device has what ip in an increasingly complex system, and if you change internet providers or routers, you have a lot of extra work to do to fix the network settings to get those static ips to connect.

    Alternately, just use the link-local ipv6 address to interconnect on the lan. That doesn’t change on most devices, as it is based on the MAC address, and is always reachable on the lan.