Hi all, I’m running a small website off of a raspberry pi in my house. I have opened ports 80 and 443 and connected my IP to a domain. I’m pretty confident in my security for my raspberry pi (no password ssh, fail2ban, nginx. Shoutout networkchuck.). However, I am wondering if by exposing my ports to the raspberry pi, I am also exposing those same ports to other devices in my home network, for example, my PC. I’m just a bit unsure if port forwarding to an internal IP would also expose other internal IP’s or if it only goes to the pi. If you are able to answer or have any other comments about my setup, I would appreciate your comment. Thanks!
I have my services proxied through nginx and behind cloudflares free tier. That way I don’t have to worry about my IP getting exposed and opening myself up to DDOS/DOS attacks, which is a genuine threat if you do things that piss people off (I’m an admin on a popular minecraft server).
It’s 2023, the threat is there regardless if you piss anyone off. We’re all commodities that can/will be exploited for capitalistic gain.
I looked into nginx for minecraft, but minecraft doesn’t use http headers, so I’d have to open minecraft ports on the router. Would this alleviate that? What’s the difference between this setup and using something like a cloudflare tunnel? Obviously, there is still some reliance on Cloudflare.
The port forward only forwards to a single device so you aren’t exposing your PC (directly anyway). Sounds like you have the pi good and secured but if you wanted to add another layer you could segment it out into a DMZ or its own VLAN. That way if something did happen with it an attacker couldn’t move laterally inside your network.
Realistically though you’re in good shape.
You’ll be ok as long as whatever software you’re running that is listening to 80 and 443 never has an exploitable vulnerability, if it does… you may be in trouble depending on the vulnerability.
Or be careful of the service on the other side of your (I assume) reverse proxy, should it have a vulnerability you may still be in trouble depending on the setup of the reverse proxy and what it’s config is.
You could put the pi on its own subnet. That way if it’s hacked, the rest of the network is protected. Just make sure your router admin interface doesn’t answer on that subnet.
You could put the pi on its own subnet.
This option is sometimes referred to as a ‘DMZ’ and may be supported by the router. Also look for VLAN options.
DMZ in essence means “forward ALL ports” to X. You should only DMZ a host that you know is very secure as its attack surface is significantly increased. If you need just one or two services open, best to not use DMZ
