Ask HN: Why shouldn't I use port forwarding?

What makes you think you shouldn&#x27;t?<p>Basically all the ways of exposing a service running in your house boil down to &quot;port forwarding&quot; in one way or another. You can use a cloud service (or a cloud server you run) to forward the traffic. The only relevant factors, as far as I can figure, are:<p>1. If you port forward on your router, you&#x27;re exposing your home IP to folks who access your service. That may or may not be something you&#x27;re OK with<p>2. You have to keep any DNS or hardcoded IPs up to date if your home IP changes. Pretty doable via a number of different methods, with varying lag time depending on how you do it.<p>3. Somebody who finds a vulnerability in the service you&#x27;re running have a foot in the door to your home LAN. But that&#x27;s a factor with &quot;making home services available on the internet&quot;, not specifically with port forwarding on your router.<p>The thing that I <i>would</i> say is a bad idea is what many routers refer to as &quot;DMZ&quot; mode or similar, where you broadly send incoming connections to a system. That&#x27;s got a lot more risk since you have to be a lot more cautious about what services are listening on your server.

Just take care. Port forwarding is perfectly valid, and sometimes the only practical way to do things. But:<p>- only open&#x2F;forward the ports you need.<p>- only expose ports that use appropriate security - try to avoid plain-text, NEVER use easy to guess passwords; prefer encrypted sessions and properly secured logins (eg. ssh keys).<p>- be very aware of what is listening on the open ports. Some Windows ports expose dangerous services, and&#x2F;or do so without authentication!<p>( Really, we shouldn&#x27;t need firewalls because there should be NO dangerous services exposed on any machine. But older boxes were so full of problems that firewalls became the default way to manage the situation ... &quot;we don&#x27;t know what services to enable&#x2F;disable, and they&#x27;ll get re-enabled on the next OS update!@!, so we&#x27;ll default to blocking everything using a firewall. )<p>- update, update, update. It seems like almost all code is broken. It&#x27;s just a question of how badly, so it&#x27;s very important to keep any exposed services up-to-date to limit the time you&#x27;re exposed to know-bad software.<p>- you WILL be attacked - not personally but by the millions of bots randomly trying addresses&#x2F;ports and guessing ids&#x2F;passwords. Something like fail2ban is useful to discourage such attacks, but you WILL be attacked and MUST be prepared for it.<p>- monitor the machine - the scourge of the interwebs is boxes sitting out there sending spam and&#x2F;or performing DOS attacks because the owner doesn&#x27;t keep an eye on them !%@$!#@$!!

My home setup uses port forwarding and it is much safer than DMZ, that exposes your entire device. I forwarded port 443 to a higher port on my RPi so I can serve TLS traffic using an unprivileged port, without the need of a root user, this alone is a great security improvement.<p>Setting this up was done on my router, and was really easy, the advantage over DMZ is that I stay behind my router&#x27;s firewall and DoS protection system and other protections.<p>I had dynamic IP from my ISP so I had to use a DDNS service, I chose ddclient[1], which is a very simple and ease to setup daemon. And it really works, never had DNS issues.<p>Now I acquired a static IP plan from my ISP, so I could ditch DDNS, the result is a simpler setup. It is being a pleasure to self-host. If my setup has any security holes please let me know. :-)<p>All in all the hardest part was buying the plan on my ISP, their customer service sucks.<p>PS.: In Brazil it is illegal for ISPs to block users from doing home servers or block some ports, but all major ISPs do it, so buying a static IP plan as a company was the easy solution. Plans for companies normally come with all ports unlocked and NAT disabled.<p>---<p>[1] <a href="https:&#x2F;&#x2F;ddclient.net&#x2F;" rel="nofollow">https:&#x2F;&#x2F;ddclient.net&#x2F;</a><p>Edit: Fix typos.

I use cloudflare tunnels. No need to do anything to my router. I have 1 open publicly accessible port (80) exposed to the internet via Docker container. In order to reach that port, you have to traverse the tunnel with TLS and my home IP is never exposed and always updated except to Cloudflare. Literally one command and few configs to set up on Cloudflare to proxy traffic to my localhost and various subdomains.<p>You can have application level security enabled on Cloudflare&#x27;s side for administrative interfaces, like portainer. That adds another level of security and there are a multitude of ways to verify (Email, token, one time pin, etc.). Super, super easy to set up.<p>I am a dolt when it comes to networking and don&#x27;t trust myself to make the correct configurations. I no longer pay for a VPS for my simple blog. I don&#x27;t want to spend my time becoming an expert Sys Admin&#x2F;Network Admin... so I chose to go with a tunnel.

Your ISP might detect the inbound traffic and shut you down. Most residential ISPs have a &quot;no servers allowed&quot; clause.<p>Better to tunnel traffic back to you, either through a 3rd party service (Cloudflare tunnels, like someone else mentions) or through a VPS that you control. That way, your home IP address is not directly exposed.<p>There is still some security concerns having a server directly on your home network. For example, if it was compromised it could access other systems on your LAN. With a more sophisticated router, you could mitigate that (isolate by putting it on its own network, block most outgoing traffic, etc.) The typical home router won&#x27;t have the features for that.

Are you planning to use this just for yourself. Or, are you planning to start a SaaS company from your home?<p>A flood of requests, bots, or even a ddos attack can cause issues with your internet connection. If you use that same connection for work for example that can be a serious issue.<p>Unless you have a static IP address you&#x27;ll have to deal with the IP changing.<p>If there is a vulnerability in your express app, it could lead to the compromise of other machines and other parts of the network (unless this windows machine is isolated from the rest of your LAN.)<p>Just things to consider, probably not deal breakers!

It&#x27;s the kind of caveat which carries it&#x27;s own penalty. If you do it, its unlocking that one window above the second storey you believe nobody can reach from a drainpipe and anyway the window is too small, and you forget about somebody coming in via the roof and being thin and flexible.<p>Just don&#x27;t forget you opened it, what you attach to it, and how to configure and disable it.<p>If the protocol(s) you use can support authentication, do that.<p>Don&#x27;t enable an inbound telnet port to your routers admin# console state basically.

If your app has a vulnerability someone can exploit it and gain access to your home server.<p>Best pragmatic approach I found when I needed to expose a service from home was to configure port knocking - the port would appear closed until I sent a series of tcp port open attempts in a particular sequence.

Who says it&#x27;s a problem? Can you link to some material that you&#x27;re referencing that makes you ask this?

This is perfectly acceptable and should be universially encouraged. True good old fashioned self-hosting, the way god intended.<p>It&#x27;d ditch the wifi and run cable, but that&#x27;s only because it&#x27;s better.

I used port forwarding for my Wireguard VPN... worked great....