* A SATA Cable and a SATA-PWR cable, the SATAP-PWR cable needs a JST connector on one end. This can be easily DIY'd or purchased [via the Olimex website](https://www.olimex.com/Products/Components/Cables/SATA-CABLE-SET/)
* Powersupply that is able to feed both (5v, 1.2Ah).
Title: Setting up port forwarding on your home router
Title: Port Forwarding on your home router
Date: 2019-01-14
Tags: port-forwarding, router
Slug: port-forwarding
Description: How to set up a spare computer as a server and make it reachable over the internet.
Tags: port forwarding, router, introduction, lan, wan
Slug: fundamentals-port-forwarding
Summary: How to make your homebrew server reachable over the internet using your home router.
Author: hbsc & friends
Status: draft
Category: fundamentals
Status: published
# UNDER CONSTRUCTION
##Introduction
The whole premise of the homebrewserver.club is the simple - yet often overlooked - fact that your home internet subscription theoretically also allows you to host on-line services. Since the internet is in its essence a bi-directional medium, anyone with an internet connection can not only look up on-line content but also host it!
In times of *cloud providers* and *virtual private servers* it is an easy thing to forget. Internet service providers (ISP) don't make it easy on you either. However, a homebrew server can be as simple as an old laptop connected directly to your home router.
The whole premise of the homebrewserver.club is the simple, yet often overlooked, fact that your home internet subscription theoretically also allows you to host services. The internet is in its essence a bi-directional medium. Anyone with an internet connection can not only look up on-line content but also host it!
In this article you will learn how to change the settings of the router provided by your ISP in order to make your homebrew server accessible from the internet!
In times of 'cloud providers' and 'virtual private servers' it is an easy thing to forget, and internet service providers don't make it easy on you either, but a homebrew server can be as simple as an old laptop connected directly to your home router.
##Requirements
@ -24,28 +22,25 @@ To begin serving from home you need the following:
- Make sure you have physical access to your home router.
- Get to know the password of the admin user (this is usually provided in the box or written on the label on the underside of the router).
- Have an available power socket next to your router.
- Have a home server running a web server and OpenSSH running on it.
- Have a homeserver with a web server and open SSH server running on it.
- An ethernet cable to connect your server to the router.
## Port forwarding theory
 A schematic representation depicting network address translation between a local area network and a wide area network, where ports are being forwarded from the WAN to home server on the LAN. The IP-addresses indicated in this schematic are used throught the article as for reference but might differ from your own situation.
Most home routers are configured by default to make the devices behind your router inaccessible to the internet using their inbuilt firewall. This is to prevent your private network from being public.
Most home routers are configured by default to make the devices behind your router inaccessible to the internet, using their inbuilt firewall. This is to prevent your private network from being public.
Machines behind your router (called your local area network or `LAN`) can make connections to the wider internet (known as `WAN`) but not the other way around.
In the case of hosting a server at home though, we DO want that server to be reachable from the internet. In order to do that we need to open so-called *ports*.
Ports are logical 'gates' that are open or closed to connections. These ports have numbers and are [standardized](https://en.wikipedia.org/wiki/List_of_TCP_and_UDP_port_numbers#Well-known_ports) for specific protocols or applications.
For example, HTTP traffic from a website would default to port `80`. HTTPS defaults to `443` and SSH defaults to port `22`.
To make our server accessible we need to open and forward those ports on the router/firewall to our server in a process called port-forwarding.
The exact method of port-forwarding differs from router to router. However, it always follows a similar scheme where you designate inbound traffic on a certain port to be forwarded to the IP address your server has on the local area network.
The effect of this is that all traffic with your home connection's IP-adress as a destination and bound for those ports will not be rejected by the firewall but forwarded to your server instead.
The exact method of port-forwarding differs from router to router but if follows always a similar scheme where you designate inbound traffic on a certain port to be forwarded to the IP address your server has on the local area network.
For this you need to have access to the administrative panel of your router.
@ -53,7 +48,7 @@ For this you need to have access to the administrative panel of your router.
To access the administrative panel of your router you need to find it's IP-address. You can do this by connecting to that router via Ethernet or Wi-Fi and then finding out what your own IP-address is.
On Debian based systems this is done like so in the terminal:
On Debian based systems this is done like this in the terminal:
`$ ifconfig`
@ -70,26 +65,27 @@ This will return information on your network connection. Look for the line sayin
inet6 fe80::eab1:fcff:acab:374e/64 scope link
valid_lft forever preferred_lft forever
In this case the IP-address of the machine is `192.168.1.11`. As a rule of thumb you can then change the last digit of your IP-address to either `1` or `254` to find the router.
In this case the IP-address is `192.168.1.11` as a rule of thumb you can then change the last digit to either `1` or `254` to find the router.
### Log in to your home router and get to know your LAN
Using a webbrowser, navigate to the IP-address you found above to reveal the router's admin panel. It should provide you with a log in field where you can enter the router's admin details to get access to the control panel.
Using a webbrowser navigate to the IP-address you found above to reveal the router's admin panel. It should provide you with a log in field where you can enter the router's admin details to get access to the control panel.
There you will see a lot of possible settings. Look at the options "LAN", "DHCP Leases" or "Network" to get an overview of all the devices.
### Connect your homeserver
Use an ethernet cable to connect your homeserver to your router. In case that it has ethernet ports in different colors/markings make sure you take something that says either `LAN` or `INET`. Once you have connected your home server to the router powered it on if you haven't already.
Use an ethernet cable to connect your homeserver to your router. In case that it has ethernet ports in different colors/markings make sure you take something that says either `LAN` or `INET`.
Have a look at your router's interface again and look for the IP-address that your server was assigned. In this guide I'll assume it was 192.168.1.10 as displayed in the graph above.
Have a look at your router's interface again and look for the IP-address that your server was assigned. In this guide I'll assume it was 192.168.1.10
Next try to find an option called "Static (DHCP) Lease" or "DHCP Binding" or something similar in your router interface's LAN view. Then make sure to assign your server a static DHCP lease. The IP-address it has now is probably fine for that! This will make sure that the server is always reachable under the same IP-addres.
Next try to find an option called "Static (DHCP) Lease" or "DHCP Binding" or something similar in your LAN view. Then make sure to assign your server a static DHCP lease. The IP-address it has now is probably fine for that! This will make sure that the server is always reachable under the same IP-addres.
## Forward the ports
Once you've set up a static lease to your homeserver you can start port forwarding. Depending on the make of the router it can be called Port Sharing or Traffic Forwarding and can usually be found in a section of the router admin interface dealing with 'security' or 'internet'.
Once you've set up a static lease to your homeserver you can start port forwarding.
@ -77,17 +77,17 @@ After you clicked Next, the registration process might take up to 20 seconds.
**Start chatting.**
To start a chat you need to add another Jabber friend under the '+' in the menu and insert your friend’s Jabber ID, e.g. your-friend@a-jabber-server.com. That’s it. You can now chat with your friend. However, this will be unencrypted!
To start a chat you need to add another Jabber friend under the '+' in the menu and insert your friend’s Jabber ID, e.g. `your-friend@a-jabber-server.com`. That’s it. You can now chat with your friend. However, this will be unencrypted!
**Encryption**
So let’s activate OMEMO encryption by pressing the padlock in the top menu bar:
OMEMO is an extension to XMPP for multi-client end-to-end encryption. OMEMO only works if the fingerprint of your and your friend’s device match. To compare them, open one of your conversations and click on your profile picture next to one of your messages. At the same time, your friend clicks on your icon on his phone.
Now, both of you should see a fingerprint that you can check. If they match, change the slider as you see in the screenshot to the right.
@ -95,22 +95,22 @@ If OMEMO cannot be activated, just send a message in the chat window. This somet
After you activated OMEMO, the input field at the bottom should say you can now send encrypted messages:
Troubleshooting Conversations
---
If OMEMO cannot be activated, just send a message in the chat window. This sometimes helps. Also, it may help to end a conversation by pressing the menu on the top right inside a conversation as shown in the following screenshot, and then re-open the conversation again.
Allow presence updates, this is used by OMEMO to exchange keys: In a conversation, click on the icon/image of your chat partner. In the new screen (as shown below), make sure that all checkboxes are activated:
Check fingerprints: You might be asked to trust fingerprints like this:
If you run into problems try asking for help in the Conversations XMPP groupchat: [conversations@conference.siacs.eu](xmpp:conversations@conference.siacs.eu?join)
@ -125,32 +125,32 @@ Get ChatSecure from the AppStore. `¯\_(ツ)_/¯`
Choose whether to create a new account or login with an existing one:
If you already have an XMPP account, you can log in with your username@hostname and password. After you selected "Add Existing Account" you have the option to connect with "XMPP" or with "Google Talk". Select "XMPP" and fill in your Nickname, Username (username@server.net) and password. Optionally fill in the Hostname of your XMPP server and select if you want to use Tor or not. If you're doubting about the port, 5222 is the default XMPP port and would likely be on your server as well.
**Enabling Push**
After you've logged in, the app proposes to establishe secure connections by sending an empty message to offline contacts. You have the option to "Enable push" or "skip" this part. iOS typically end the connection when an app runs in the background and requires use of Apple's Push servers to wake up and receive a message. By sending empty messages ChatSecure limits the data being sent to the Apple Cloud's Push Server but obviously still provide their vertically integrated cloud platform with meta-data. Read more about the Push issues [here](https://chatsecure.org/blog/chatsecure-v32-push/) and [here](https://chatsecure.org/blog/fixing-the-xmpp-push-problem/)
In the next screen you can "Share invite" (let people on social media know about the app) or tap the '✓' symbol in the top right corner to continue. This takes you to the general 'Settings' menu.
 >  > 
 >  > 
If you are successfully connected, the word "Connected" appears right under your username. Before you can edit your account settings, you need to log out. To do this, click your account/nickname in the settings menu and select "Log Out".
Choose "Create New Account" and give your preferred nickname. Under "show advanced options" you can customize your username, generate an automatic password, enable TOR (we didn't test it) and select a server where you would like to register your account on. This is the server you will use to communicate with other people's selected servers, and depending on the server settings it will also store your (encrypted) messages. ChatSecure let's you choose between 3 built-in servers options. Default is DuckDuckGo, but when you tap on "DuckDuckGo" the app will take you to the server selection screen where you can choose between DuckDuckGo, Calyxinstitute.org and OTR.im[ref]All three of these servers score poorly on the modern XMPP [compliance test](https://gultsch.de/compliance.html)[/ref], it also offers you the option to select another, custom, server. Here you can fill in the hostname of the XMPP server of a friend.
From the settings menu, tap 'Chats' (top left) to start chatting and adding friends. To add friends tap the 'Compose' icon, top left corner. Then tap "Add Buddy" and fill in your friends username and hostname (username@hostname) or scan their QR code.
@ -163,13 +163,13 @@ If you get a friend request, their nickname will appear in the "Chats" list.
When in a chat, tap the information icon on the top right (i) to change your encryption settings. The information menu displays your current and past verified fingerprints and allows you to specify an encryption method by tapping "Show Advanced Encryption Sett...".
At the time of writing OMEMO works well with other OMEMO clients, images shared over HTTPUpload however are not displayed inline but rather as a URL. If you click that your browser will open it and fail to decrypt the OMEMO encoded image, because it has no notion of your OMEMO fingerprints. So for now the images shared over HTTPUpload have to be shared using plaintext.
ChatSecure implements OMEMO and OTR on a TOFU or “trust on first use" basis. New "buddies" are automatically trusted.
You can also untrust your friends devices/fingerprints by sliding the green "Verified" button and share fingerprints by tapping them and selecting a medium to share your fingerprint over.
@ -232,7 +232,7 @@ And now for OMEMO! There is a package gajim-omemo on Debian Backports. So run:
Next, start Gajim. After Gajim has started, wait some seconds until it requests your permission to install updates:
Allow this. Afterwards, a new window will open that lists all components that can be installed and updated. In this list, activate the checkbox next to the following plugins:
@ -252,7 +252,7 @@ After the update has finished, go to the other tab **Installed**. There, make su
Then, you should see a wizard to setup your XMPP account. Select the option that you already have an account and follow all instructions yourself using the default settings.
After you finished the wizard successfully, Gajim will show your status as **Available**. Congratulations!
@ -260,13 +260,13 @@ Now, let’s send messages to your friends.
To do so, click on the Gajim window and move your mouse to the top of the screen. There, a menu should appear. Go to Actions -> Start chat… . In the new window, add the XMPP ID of your friend and click ok.
Go to the main menu again and select **View -> Show offline contacts…** . In the Gajim window, you should see your friend. Right click on the name of your friend and select **Manage contact -> Add to roster.** In the pop up, just click **Add**. Now your friend is permanently added to your list of contacts. Next, right click on your friend and select **Manage contact -> Allow subscription -> Allow contact to see my status**.
Your friend should see a request like this:
Your friend should click **Authorize**, which enables her to see if you are online or not. Also, this step is necessary for activating the encryption.
@ -274,7 +274,7 @@ Next, make sure that your friend also allows you to see her status.
Now, when you open the chat window to your friend, it should say OMEMO encryption enabled and show a red shield next to the input field, like this:
If you don’t see the OMEMO encryption enabled — just restart Gajim and have a look again.
@ -291,7 +291,7 @@ She should chose the tab Own devices, while you chose the tab Contact. Now, sele
Finally, all fingerprints should be green like this:
@ -39,21 +39,21 @@ You can find the source code for 'solar', the Pelican theme we developed [here](
One of the main challenges was to reduce the overall size of the website. Particularly to try and reduce the size of each page to something less than 1MB . Since a large part of both the appeal and the weight of the magazine comes from the fact it is richly illustrated, this presented us with a particular challenge.
Image from the blog showing 20th century telephone switchboard operators([original source](https://commons.wikimedia.org/wiki/File:Bell_System_switchboard.jpg)), 159.5KB
Image from the blog showing 20th century telephone switchboard operators([original source](https://commons.wikimedia.org/wiki/File:Bell_System_switchboard.jpg)), 159.5KB
In order to reduce the size of the images, without diminishing their role in the design and the blog itself, we reverted to a technique called dithering:
The same image but dithered with a 3 color palette, 36.5KB
The same image but dithered with a 3 color palette, 36.5KB
This is a technique 'to create the illusion of "color depth" in images with a limited color palette'[^illusion]. It based on the print reproduction technique called [halftoning](https://en.wikipedia.org/wiki/Halftone). Dithering, or digital half-toning[^digitalhalftone], was widely used in video games and pixel art at a time when a limited amount of video memory constrained the available colors. In essence dithering relies on optical illusions to simulate more colors. These optical illusions are broken however by the distinct and visible patterns that the dithering algorithms generate.
Dithered with a six tone palette, 76KB
Dithered with a six tone palette, 76KB
As a consequence most of the effort and literature on dithering is around limiting the 'banding' or visual artifacts by employing increasingly complex dithering algorithms[^dithering].
Our design instead celebrates the visible patterns introduced by the technique, this to stress the fact that it is a 'different' website. Coincidentally, the 'Bayesian Ordered Dithering' algorithm that we use not only introduces these distinct visible patterns, but it is also quite a simple and fast algorithm.
Dithered with an eleven tone palette, 110KB
Dithered with an eleven tone palette, 110KB
We chose dithering not only for the compression but also for the aesthetic and reading experience. Converting the images to grayscale and then dithering them allows us to scale them in a visually attractive way to 100% of the view port, despite their small sizes. This gives each article a visual consistency and provides the reader with pauses in the long articles.
@ -75,7 +75,7 @@ Increasing the uptime of the server to 99% on solar energy means increasing the
Rather than that we opted for a low-tech approach that accepts being off-line during longer stretches of cloudy weather. However, we wanted to provide the reader with off-line reading options. Our primary method of doing so currently is by providing an [RSS feed containing all the articles and images on the site](https://solar.lowtechmagazine.com/feeds/all.rss.xml). In the future we will explore other means of providing off-line reading of the magazine.
 Most browsers preview only the article titles and summaries of the RSS feed. In fact the feed contains the full articles. Once you add the feed to your favorite reader, it will download the full articles that you can read at any given time.
 Most browsers preview only the article titles and summaries of the RSS feed. In fact the feed contains the full articles. Once you add the feed to your favorite reader, it will download the full articles that you can read at any given time.
## Material Server
@ -399,7 +399,7 @@ Without further ado:
# Hardware
### Server
The server itself is an [Olimex Olinuxino A20 Lime 2](https://www.olimex.com/Products/OLinuXino/A20/A20-OLinuXino-LIME2/) single board computer.
@ -412,7 +412,7 @@ In addition to the power statistics the power chip can charge and discharge a Li
The server operating system all runs on an SD-card. Not only are these low-powered but also much faster than hard drives. We use high speed Class 10 16GB mirco-sd card. A 16GB card is actually a bit of an overkill considering the operating system is around 1GB and the website a mere 30MB, but considering the price it doesn't make sense to buy any smaller high-performance cards.
@ -14,7 +14,7 @@ If you have questions or would like to join check out our [mailinglist](https://
Unless otherwise specified, all the material on this website is published under a [Attribution-ShareAlike 4.0 International license](http://creativecommons.org/licenses/by-sa/4.0/).
rra
6 years ago
