How to selfhost with a VPN (95.181.238.34:40152)
submitted 1 year ago* (last edited 1 year ago) by to c/selfhosted@lemmy.world
 

These are some quick n' dirty instructions so people can get up and running fast.

I wish I had known this was possible sooner.

Instructions:

Check that your VPN supports port forwarding and you have it enabled.

Grab your VPN's internal IP with ip a

Find the interface for your VPN. For me it's called tun0.

Open up /etc/nginx/nginx.conf

You can back it up, or comment everything out, or pick what's necessary. Here's what my file looks like.

	worker_processes  1;
	include modules.d/*.conf;

	events {
		worker_connections  1024;
	}
	http {
		server {
			listen [VPN INTERNAL IP]:[VPN FORWARDED PORT];
			server_name  localhost;
			location / {
				root '[ABSOLUTE PATH TO YOUR WEBSITE ROOT FOLDER]';
				index index.html; # Relative to your website root.
			}
		}
	}

Make sure your permissions are correct. For me, the 'other' group needs read permissions to the root folder, including where it's mounted.

Start nginx with systemctl start nginx

You can visit your website on your host machine in a browser at [VPN INTERNAL IP]:[VPN FORWADED PORT]. For me, using the internal IP is required to view the website on my host machine.

To view the website on other machines, you can use [VPN EXTERNAL IP]:[VPN FORWARDED PORT]. The only thing you need to change is the IP address.

I hope this works for you and you are inspired to selfhost and take back power from those who stole it from us.

you are viewing a single comment's thread
view the rest of the comments
[–] 8 points 1 year ago* (last edited 1 year ago) (52 children)

You you setup a proper domain and https for your website instead of having a random IP address and port. Don't visit http pages in 2025. It is a major security risk.

Edit: If you need help setting up https let me know. You will need a domain but they are fairly inexpensive. If it is a matter of technical knowledge let me know as I can help.

  • source
  • hideshow 52 child comments
  • [–] 31 points 1 year ago (2 children)

    LOL. On the scale of risky things I've done today, visiting this guy's http website barely rates a mention.

    Someone posts about something they've learned and the best you can do is dump on them about whatever thing in order to demonstrate to everyone your superior knowledge.

    Everyone starts somewhere.

  • source
  • parent
  • hideshow 2 child comments
  • [–] 19 points 1 year ago* (15 children)

    There’s no security risk viewing this bit of html via http lmao

  • source
  • parent
  • hideshow 15 child comments
  • [–] 5 points 1 year ago* (4 children)

    How so?

    Data send back isn't validated so someone could tamper with the data. A bad actor could add some arbittary Javascript plus ISPs have been caught inserting marketing materials into pages.

    From a privacy perspective it is also bad as not only does it include your user agent in plain text it doesn't have any encryption on page contents which allows your ISP to snoop on what you are doing.

    All of these reasons are while we moved to https. X.509 certs are free and trivial to setup with Caddy or any other Reverse proxy/web server. If https was crazy had to setup I'd be more understanding but it is very easy to do in 2025.

  • source
  • parent
  • hideshow 4 child comments
  • [–] 3 points 1 year ago (3 children)

    Do you really think someone is going to set up a MITM attack for the dozen people who visit this blog?

  • source
  • parent
  • hideshow 3 child comments
  • [–] 4 points 1 year ago (2 children)

    No, but governments and ISPs can and have historically done so for all http traffic.

    It doesn't matter the page. They just care about http.

  • source
  • parent
  • hideshow 2 child comments
  • [–] 7 points 1 year ago* (1 child)

    specifically this is how QUANTUMINSERT worked (from the Snowden leaks.) also China used the same technique, injecting malicious JS through the GFW to get bystanders to DDoS github, in a much more obvious and indiscriminate way.

    nobody here is remotely likely to be targeted by NSA, of course, but you can actually do such attacks on a budget if you compromise any router in the chain. combined with a BGP hijack it's not far out of reach for even a ransomware gang to pull something like that these days.

  • source
  • parent
  • hideshow 1 child comment
  • [–] -2 points 1 year ago (1 child)

    Maybe there is, maybe it's only little. Maybe people browsing should be more aware of where they click on. Either way, this method shouldn't be used for any sensitive information least a personal cloud. Would be suicidal I guess.

  • source
  • parent
  • hideshow 1 child comment
  • load more comments (8 replies)
  • [–] [S] 14 points 1 year ago (27 children)

    Thanks.

    It's my understanding that https provides encryption for the data sent between you and the server. If you're not sending any sensitive data, then the encryption shouldn't be necessary.

    Don't get me wrong, encryption is great even when it isn't necessary. For my demonstration purposes though, I chose not to include it.

    I also believe it's possible to set up HTTPS encryption without a domain name, but it might result in that "we can't verify the authenticity of this website" warning in web browsers due to using a self-signed certificate.

  • source
  • parent
  • hideshow 27 child comments
  • [–] 21 points 1 year ago* (last edited 1 year ago) (10 children)

    Let's Encrypt are rolling out IP-based certs, you may wanna follow its development. I'm not sure if it could be used for your forwarded VPN port, but it'd be nice anyhow

    Edit: I believe encryption helps prevent tampering the data between the server and user too. It should prevent for example, someone MITM the connection and injecting malicious content that tells the user to download malware

  • source
  • parent
  • hideshow 10 child comments
  • [–] [S] 5 points 1 year ago (1 child)

    Thanks. This is new to me and I'm going to be looking into it.

  • source
  • parent
  • hideshow 1 child comment
  • [–] 0 points 1 year ago

    As I use docker for most of my deploys (as you should for websites exposed to the Internet anyway), I can wholeheartedly recommend traefik for this. Basically it has the functionality of nginx, but supports easy Let's Encrypt certificates.

  • source
  • parent
  • [–] -1 points 1 year ago* (last edited 1 year ago) (7 children)

    Let's Encrypt are rolling out IP-based certs, you may wanna follow its development. I'm not sure if it could be used for your forwarded VPN port, but it'd be nice anyhow

    It shouldn't be because you're not actually the owner of the IP address. If any user could get a cert, they could impersonate any other.

    I believe encryption helps prevent tampering the data between the server and user too. It should prevent for example, someone MITM the connection and injecting malicious content that tells the user to download malware

    No, encryption only protects the confidentiality of data. You need message authentication codes or authenticated encryption to make sure the message hasn't been transported tampered with. Especially stream ciphers like ChaCha (but also AES in counter mode) are susceptible to malleability attacks, which are super simple yet very dangerous.

    Edit: this post is a bit pedantic because any scheme that is relevant for LE certificates covers authenticity protection. But it's not the encryption part of those schemes that is responsible.

  • source
  • parent
  • hideshow 7 child comments
  • [–] 2 points 1 year ago (2 children)

    It shouldn't be because you're not actually the owner of the IP address. If any user could get a cert, they could impersonate any other.

    They're 'shortlived' 7 day certs, verified using a HTTP challenge. It doesn't matter who owns the IP, it's just a matter of who holds the IP.

  • source
  • parent
  • hideshow 2 child comments
  • [–] 18 points 1 year ago (1 child)

    That is a pretty bad take as all data is sensitive. Https also provides integrity to prevent man in the middle attacks.

  • source
  • parent
  • hideshow 1 child comment
  • [–] 4 points 1 year ago (2 children)

    It takes two seconds to get https and 10 bucks a year for a domain. Come on

  • source
  • parent
  • hideshow 2 child comments
  • [–] 3 points 1 year ago

    You can pickup a cheap domain from gen.xyz. The cheapest domain is $0.99 which is pretty affordable especially since you probably are already paying for a internet connection.

    Once you have the domain you can point it to your IP and then set port 443 on that address to point to Caddy. On Caddy you can either configure it as a server or use it as a reverse proxy to point to something else.

    Security wise I would put all of this on its own vlan with ACLs to control access. If that sounds confusing start with https.

  • source
  • parent
  • [–] 3 points 1 year ago

    but it is sensitive data. the webserver can send executable code to the web browser. if it does not that doesn't matter, what matters is that it can be inserted by a middleman. It's not like there's a dedicated person needed to do that, it can just happen automatically.

  • source
  • parent
  • [–] 1 point 1 year ago (3 children)

    It's my understanding that https provides encryption for the data sent between you and the server. If you're not sending any sensitive data, then the encryption shouldn't be necessary.

    As others have pointed out, everything can be sensitive. If I’m self hosting nextcloud instance with chat that under British law should check for age… self hosting is now sensitive.

    In addition to that, without a secure connection you’re stuck with HTTP/1.1 from 1999 instead of the modern 2 or 3 versions.

    I also believe it's possible to set up HTTPS encryption without a domain name, but it might result in that "we can't verify the authenticity of this website" warning in web browsers due to using a self-signed certificate.

    You can: https://letsencrypt.org/2025/07/01/issuing-our-first-ip-address-certificate

  • source
  • parent
  • hideshow 3 child comments
  • [–] 1 point 1 year ago (2 children)

    In addition to that, without a secure connection you’re stuck with HTTP/1.1

    That's not entirely true. A lot of requests, even with https, are send over HTTP/1.1. And this is kinda mind blowing that in 2025 we still rely on something so old and insecure...

    Same goes with SMS and the old SS7 protocol from 1970... 2FA SMS is probably the most insecure way to get access to your bank account or what ever service promotes 2FA sms login.

  • source
  • parent
  • hideshow 2 child comments
  • [–] 1 point 1 year ago

    Does that contradict what I said? Sure, HTTP 1 is still widely used, but without TLS you can’t use anything else.

    For SMS we don’t have a choice, but if you configure your own web server you do have a choice.

  • source
  • parent
  • [–] 1 point 1 year ago

    Anyone with the ability to inject or modify packets in the network path between server and client can inject malicious javascript or browser exploits into an unencrypted HTTP TCP stream. The client's User-Agent and other headers would allow the attacker to customize their attack to target that specific browser version, and compromise the client machine.

  • source
  • parent
  • [–] 0 points 1 year ago (2 children)

    I also believe it's possible to set up HTTPS encryption without a domain name, but it might result in that "we can't verify the authenticity of this website" warning in web browsers due to using a self-signed certificate.

    Just create your own rootCA and IntermediateCA and sign your certificate with those, put the CA in your trust store of your system and get rid of this self-signed warning on every device and happily access all your service via: *.home.lab or whater ever local domain pleases you.

  • source
  • parent
  • hideshow 2 child comments
  • [–] 3 points 1 year ago (1 child)

    I'm not installing OP's CA cert just to view his blog.

  • source
  • parent
  • hideshow 1 child comment
  • [–] 1 point 1 year ago

    Fair point ! Yeah sure if you host a blog online it doesn't make sense... But if you only self-host your services for family and some friends and access them over VPN, a local CA is actually a privacy respecting choice.

    Hosting something on the web (specially self-hosted) without the propre software and hardware is a bad idea in the first place anyway !

  • source
  • parent
  • [–] 2 points 1 year ago* (2 children)

    Is it not possible to set up https for just an ip address with no domain?

  • source
  • parent
  • hideshow 2 child comments
  • load more comments (2 replies)