this post was submitted on 13 Nov 2023
5 points (100.0% liked)

Self-Hosted Main

502 readers
1 users here now

A place to share alternatives to popular online services that can be self-hosted without giving up privacy or locking you into a service you don't control.

For Example

We welcome posts that include suggestions for good self-hosted alternatives to popular online services, how they are better, or how they give back control of your data. Also include hints and tips for less technical readers.

Useful Lists

founded 1 year ago
MODERATORS
communick@selfhosted.forum
5
What are the actual security implications of port forwarding? (alien.top)
submitted 10 months ago by Alt_Lightning@alien.top to c/main@selfhosted.forum
14 comments fedilink hide all child comments
 

Like, I hear all the time that you shouldn't open any ports on your networks fire wall for security reasons this and security reasons that. But what are the actual security implications/risks of forwarding a port for something like Jellyfin or a Minecraft server or something like that? Explain like im 16 (or something)

you are viewing a single comment's thread
view the rest of the comments
[–] dmdeemer@alien.top 1 points 10 months ago

I'll repeat a reply I made as a top-level comment, as I think it's a useful analogy:

Opening a port is like installing a door in what was a brick wall in a back alley, then leaving it unattended while people might try to pick the lock. Unfortunately, the internet is a crime-ridden neighborhood, and that lock will be tested, likely within minutes.

The "door" in this analogy is a port forward on your router, and the "lock" is whatever security is provided by the service you expose on that port. Some services are battle-tested and more trustworthy than others, but nearly everything has a bug in it somewhere.

I no longer leave any ports open, other than just one for Wireguard. Wireguard in general won't reply to unauthenticated packets at all, so it's essentially an invisible door. I can't speak to OpenVPN, it may or may not behave similarly. Leaving an SSH server visible is an invitation for automated password-guessing.