varia/homebrewserver.club
14
0
Fork 0
Code Issues 1 Pull Requests Releases Activity

final draft port forwarding

Browse Source
This commit is contained in:
rra 2019-06-23 12:32:22 +02:00
parent c02df0443a
commit c6f54ec359
1 changed files with 60 additions and 16 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

76
content/fundamentals/port_forwarding.md
View File

@ -11,9 +11,9 @@ Status: published
##Introduction ##Introduction
The whole premise of the homebrewserver.club is the simple, yet often overlooked, fact that your home internet subscription theoretically also allows you to host services. The internet is in its essence a bi-directional medium. Anyone with an internet connection can not only look up on-line content but also host it! The whole premise of the homebrewserver.club is the simple — yet often overlooked — fact that your home internet subscription theoretically also allows you to host services. The internet is in its essence a bi-directional medium. Anyone with an internet connection can not only look up on-line content but also host it!
In times of 'cloud providers' and 'virtual private servers' it is an easy thing to forget, and internet service providers don't make it easy on you either, but a homebrew server can be as simple as an old laptop connected directly to your home router. In times of 'cloud providers' and 'virtual private servers' it is an easy thing to forget, and internet service providers don't make it easy on you either, but a homebrew server can be as simple as an old laptop connected directly to your home router. However, you do need to change some settings on the router to make that happen!
##Requirements ##Requirements
@ -29,18 +29,18 @@ To begin serving from home you need the following:
![A schematic representation depicting network address translation between a local area network and a wide area network, where ports are being forwarded from the WAN to home server on the LAN]({attach}images/port_forwarding.svg) ![A schematic representation depicting network address translation between a local area network and a wide area network, where ports are being forwarded from the WAN to home server on the LAN]({attach}images/port_forwarding.svg)
Most home routers are configured by default to make the devices behind your router inaccessible to the internet, using their inbuilt firewall. This is to prevent your private network from being public. By default home routers are configured to make the devices behind your router inaccessible to the internet. This is done using the router's inbuilt firewall, to prevent your private network from being public.
Machines behind your router (called your local area network or `LAN`) can make connections to the wider internet (known as `WAN`) but not the other way around. Machines behind your router (called your local area network or `LAN`) can make connections to the wider internet (known as `WAN`), but not the other way around.
In the case of hosting a server at home though, we DO want that server to be reachable from the internet. In order to do that we need to open so-called *ports*. However, when hosting a server at home, we do want that server to be reachable from the internet. In order to do that we need to open so-called *network ports*.
Ports are logical 'gates' that are open or closed to connections. These ports have numbers and are [standardized](https://en.wikipedia.org/wiki/List_of_TCP_and_UDP_port_numbers#Well-known_ports) for specific protocols or applications. Ports are logical 'gates' that are open or closed to connections. These ports have numbers and are [standardized](https://en.wikipedia.org/wiki/List_of_TCP_and_UDP_port_numbers#Well-known_ports) for specific protocols or applications.
For example, HTTP traffic from a website would default to port `80`. HTTPS defaults to `443` and SSH defaults to port `22`. For example, HTTP traffic from a website would default to port `80`. HTTPS defaults to `443` and SSH defaults to port `22`.
To make our server accessible we need to open and forward those ports on the router/firewall to our server in a process called port-forwarding. To make our server accessible over the internet we need to open the ports on the router and forward them to our server. This is called port-forwarding.
The exact method of port-forwarding differs from router to router but if follows always a similar scheme where you designate inbound traffic on a certain port to be forwarded to the IP address your server has on the local area network. The exact method (and terminology) of port-forwarding differs from router to router. However, it always follows a similar scheme where you designate inbound traffic on a certain port to be forwarded to the your server's IP-address and port on the local area network.
For this you need to have access to the administrative panel of your router. For this you need to have access to the administrative panel of your router.
@ -70,23 +70,67 @@ In this case the IP-address is `192.168.1.11` as a rule of thumb you can then ch
### Log in to your home router and get to know your LAN ### Log in to your home router and get to know your LAN
Using a webbrowser navigate to the IP-address you found above to reveal the router's admin panel. It should provide you with a log in field where you can enter the router's admin details to get access to the control panel. Using a web browser navigate to the IP-address you found above to reveal the router's admin panel. It should provide you with a log in field where you can enter the router's admin details to get access to the control panel.
There you will see a lot of possible settings. Look at the options "LAN", "DHCP Leases" or "Network" to get an overview of all the devices. There you will see a lot of possible settings. Look at the options "LAN", "DHCP Leases" or "Network" to get an overview of all the devices.
### Connect your homeserver ### Connect your home server
Use an ethernet cable to connect your homeserver to your router. In case that it has ethernet ports in different colors/markings make sure you take something that says either `LAN` or `INET`. Use an ethernet cable to connect your home server to your router. In case that it has ethernet ports in different colors/markings make sure you take something that says either `LAN` or `INET`.
Have a look at your router's interface again and look for the IP-address that your server was assigned. In this guide I'll assume it was 192.168.1.10 Have a look at your router's interface again and look for the IP-address that your server was assigned. In this guide I'll assume it was 192.168.1.10.
Next try to find an option called "Static (DHCP) Lease" or "DHCP Binding" or something similar in your LAN view. Then make sure to assign your server a static DHCP lease. The IP-address it has now is probably fine for that! This will make sure that the server is always reachable under the same IP-addres. Next try to find an option called "Static (DHCP) Lease" or "DHCP Binding" or something similar in your LAN view. Then make sure to assign your server a static DHCP lease. This will make sure that the server is always reachable under the same IP-addres.
## Forward the ports ## Forward the ports
Once you've set up a static lease to your homeserver you can start port forwarding. Once you've set up a static lease to your home server you can start port forwarding. Depending on the make of the router it can be also be called *Port Sharing* or *Traffic Forwarding*. Again, depending on the make of the router, it can be found under the tabs 'security', 'access control' or 'internet'.[^1]
The basic process is to determine which external port to open and to which IP address on the LAN and which port to forward it to.
You might be asked a few things, including the name of the rule, the protocol (TCP, UDP or both), the external port and the internal port. Sometimes you are given the option to open a range of ports.
To open the ports for the web server, we're opening two separate ports, one for plain HTTP and one for secure HTTP.
Open the external port `80` for plain HTTP and redirect it to the local IP-address of the homeserver:
```
Name: "HTTP Homeserver"
Protocol: TCP
Device: 192.168.1.10
External Port: 80
Port to device: 80
```
Open the external port `443` for HTTPS and redirect it to the local IP-address of the homeserver:
```
Name: "HTTPS Homeserver"
Protocol: TCP
Device: 192.168.1.10
External Port: 443
Port to device: 443
```
Lastly we will open a port for `SSH`. The change here is that we open the external port `9999` and map that to `22` internally. Setting SSH on a non-standard port is a low-level way to prevent automated scripts gaining access to your homeserver. TODO add link to basic security
```
Name: "SSH Homeserver"
Protocol: TCP
Device: 192.168.1.10
External Port: 9999
Port to device: 22
```
## Concluding
Now that you have opened the corresponding ports you should be able to type your external IP-address in your browser and should be automatically redirected to the website on your home server.
### How to find out which ports to open?
While a majority of applications will work on `80` and `443` you might need to open different port for different applications. For example in the series describing [self-hosted chat over XMPP]({filename}../instant-messaging/configuring_an_xmpp_server_prosody_0.11.md#set-up-firewall-and-dns) ports `5000`, `5222`, `5269` and `5281` are opened and forwarded.
Most installation guides for software will tell you whether you need to open ports. However it is also possible to see what applications are listening to what port using:
`$ netstat -tulp`.
## Additional Resources [^1]: [https://portforward.com/](https://portforward.com/router.htm) has a large list of routers and visual instructions on how to set up port forwarding on them.
* [https://portforward.com/](https://portforward.com/router.htm) has a large list of routers and visual instructions on how to set up port forwarding on them.