mirror of
https://github.com/DoTheEvo/selfhosted-apps-docker.git
synced 2026-11-11 01:10:08 +01:00
update
This commit is contained in:
DoTheEvo committed
1 parent
324b4dba79
commit
3269a5b7e6
1 file changed
+60
-48
+60
-48
@@ -663,9 +663,44 @@ For some harderining of security.
|
|||||||
---
|
---
|
||||||
|
|
||||||
<details>
|
<details>
|
||||||
<summary><h1>Port fowarding and NAT reflection(hairpin/loopback)</h1></summary>
|
<summary><h1>Port fowarding</h1></summary>
|
||||||
|
|
||||||
[source](https://forum.opnsense.org/index.php?topic=8783.0)
|
[The source.](https://forum.opnsense.org/index.php?topic=8783.0)
|
||||||
|
|
||||||
|
A host with IP 192.168.1.200, has a service answering on port 8096.<br>
|
||||||
|
Want to create a port forwarding rule,
|
||||||
|
to make it accessible from the outside.
|
||||||
|
|
||||||
|
- `Firewall: Aliases`<br>
|
||||||
|
Create a new alias for the host.
|
||||||
|
- *Name*: Jellyfin
|
||||||
|
- *Type*: Host(s)
|
||||||
|
- *Content*: 192.168.1.200
|
||||||
|
- *Description*: Media Server
|
||||||
|
|
||||||
|
- `Firewall: NAT: Port Forward`<br>
|
||||||
|
Create a new port forwarding rule, leaving default stuff not explicitly named.
|
||||||
|
- *Interface*: `WAN`
|
||||||
|
- *TCP/IP Version*: `IPv4`
|
||||||
|
- *Protocol*: `TCP`
|
||||||
|
- *Destination*: `WAN address`
|
||||||
|
- *Destination Port range*: `(other) 8096 to (other) 8096`
|
||||||
|
- *Redirect target IP*: Alias `Jellyfin`
|
||||||
|
- *Redirect target Port*: `(other) 8096`
|
||||||
|
- *Filter rule association*: Add associated filter rule<br>
|
||||||
|
This setting makes sure that also WAN firewall rule is created
|
||||||
|
that allows in the traffic.
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
|
</details>
|
||||||
|
|
||||||
|
---
|
||||||
|
---
|
||||||
|
|
||||||
|
<details>
|
||||||
|
<summary><h1>NAT reflection - hairpin/loopback</h1></summary>
|
||||||
|
|
||||||
### NAT reflection
|
### NAT reflection
|
||||||
|
|
||||||
@@ -674,54 +709,31 @@ you are asking a DNS server for an IP address.
|
|||||||
When selfhosting that `a.example.com` it will give you your own public IP,
|
When selfhosting that `a.example.com` it will give you your own public IP,
|
||||||
and most consumer routers don't allow this loopback, where your requests
|
and most consumer routers don't allow this loopback, where your requests
|
||||||
should go out and then right back.<br>
|
should go out and then right back.<br>
|
||||||
So a solution for above-consumer-level routers/firewalls is to just have
|
Better tier firewalls have a simple solution,
|
||||||
checkboxes about NAT reflection, also called hairpin NAT or a NAT loopback.
|
a checkbox somewhere about NAT reflection, also called hairpin NAT
|
||||||
|
or a NAT loopback.
|
||||||
|
|
||||||
|
For opnsense it's:
|
||||||
|
|
||||||
`Firewall: Settings: Advanced`
|
`Firewall: Settings: Advanced`
|
||||||
- Reflection for port forwards: `Enabled`
|
- Reflection for port forwards: `Enabled`
|
||||||
- Reflection for 1:1: `Disabled`
|
- Reflection for 1:1: `Disabled`
|
||||||
- Automatic outbound NAT for Reflection: `Enabled`
|
- Automatic outbound NAT for Reflection: `Enabled`
|
||||||
|
|
||||||
*extra info:*<br>
|
But many consider NAT reflection to be a hack that should not be used.<br>
|
||||||
Many consider NAT reflection to be a hack that should not be used.<br>
|
That the correct way is to split DNS, where you maintain separate DNS records
|
||||||
That the correct way is split DNS, where you maintain separate DNS records for
|
for LAN side so that `a.example.com` points directly to some local ip.
|
||||||
LAN side so that `a.example.com` points directly to some local ip.
|
|
||||||
Reason being that this way machines on LAN side that use FQDN(a.example.com)
|
Reason being that this way machines on LAN side that use FQDN(a.example.com)
|
||||||
to access other machine on LAN are not hitting the firewall with traffic
|
to access other machine on LAN are not hitting the firewall with traffic
|
||||||
that goes between them.
|
that goes between them, it just goes straight through switches.<br>
|
||||||
But IMO in small scale selfhosted setup its perfectly fine
|
In a small scale selfhosted setup its perfectly fine and it requires
|
||||||
and it requires far less management.
|
less management.
|
||||||
|
|
||||||
### Port Forwarding:
|
|
||||||
|
|
||||||
a host with IP 192.168.1.200, with port 3100 open TCP<br>
|
|
||||||
want to port forward from the outside 3200 to 3100
|
|
||||||
|
|
||||||
- set up Aliases in `Firewall: Aliases`<br>
|
|
||||||
- name: A short friendly name for the IP address you're aliasing. I'll call it "media-server"
|
|
||||||
- type: Host(s)
|
|
||||||
- Aliases: Input 192.168.1.200
|
|
||||||
|
|
||||||
- register the portforwarding in `Firewall: NAT: Port Forward`<br>
|
|
||||||
- Interface: `WAN`
|
|
||||||
- TCP/IP Version: `IPv4`
|
|
||||||
- Protocol: `TCP`
|
|
||||||
- Under `Source > Advanced`:<br>
|
|
||||||
- Source / Invert: `Unchecked`
|
|
||||||
- Source: `Any`
|
|
||||||
- Source Port Range: `any to any`
|
|
||||||
- Destination / Invert: `Unchecked`
|
|
||||||
- Destination: `WAN address`
|
|
||||||
- Destination Port range: `(other) 3200 to (other) 3200`
|
|
||||||
- Redirect target IP: `Alias "media-server"`
|
|
||||||
- Redirect target Port: `(other) 3100`
|
|
||||||
|
|
||||||
</details>
|
</details>
|
||||||
|
|
||||||
---
|
---
|
||||||
---
|
---
|
||||||
|
|
||||||
|
|
||||||
<details>
|
<details>
|
||||||
<summary><h1>Switch to https</h1></summary>
|
<summary><h1>Switch to https</h1></summary>
|
||||||
|
|
||||||
@@ -862,6 +874,18 @@ To quit its `:q!` without save, or `:qw` with save.
|
|||||||
---
|
---
|
||||||
---
|
---
|
||||||
|
|
||||||
|
<details>
|
||||||
|
<summary><h1>Snaposhots on ZFS</h1></summary>
|
||||||
|
|
||||||
|
[The official docs](https://docs.opnsense.org/manual/snapshots.html) are great.
|
||||||
|
|
||||||
|
Boot process interupt key is space.
|
||||||
|
|
||||||
|
</details>
|
||||||
|
|
||||||
|
---
|
||||||
|
---
|
||||||
|
|
||||||
<details>
|
<details>
|
||||||
<summary><h1>Geoblock</h1></summary>
|
<summary><h1>Geoblock</h1></summary>
|
||||||
|
|
||||||
@@ -957,18 +981,6 @@ I am usually on wg-easy deployment in docker, but might start using this soon...
|
|||||||
---
|
---
|
||||||
---
|
---
|
||||||
|
|
||||||
<details>
|
|
||||||
<summary><h1>Snaposhots on ZFS</h1></summary>
|
|
||||||
|
|
||||||
[The official docs](https://docs.opnsense.org/manual/snapshots.html) are great.
|
|
||||||
|
|
||||||
Boot process interupt key is space.
|
|
||||||
|
|
||||||
</details>
|
|
||||||
|
|
||||||
---
|
|
||||||
---
|
|
||||||
|
|
||||||
<details>
|
<details>
|
||||||
<summary><h1>Monitoring</h1></summary>
|
<summary><h1>Monitoring</h1></summary>
|
||||||
|
|
||||||
|
|||||||
Reference in new issue
Block a user