So I was looking into getting port forwarding set up and I realized just how closed-off the internet has gotten since the early days. It’s concerning. It used to be you would buy your own router and connect it to the internet, and that router would control port-forwarding and what-have-you.

Now, your ISP provides your router, which runs their firmware, which (in my case) doesn’t even have the option to enable port forwarding.

It gets worse - because ISPs are choosing NATs over IPv6, so even if you install a custom firmware on your router without it getting blacklisted by your ISP, you still can’t expose your server to the internet because the NAT refuses to forward traffic your way. They even devise special NAT schemes like symmetric NAT to thwart hole punching.

Basically this all means that I have to purchase my web hosting separately. Or relay all the traffic through an unnecessary third party, introducing a point of failure.

It’s frustrating.

I like to control my stuff. I don’t like to depend on other people or be in a position where I have to trust someone not to fuck with my shit. Like, if the only thing outside my apartment that mattered to my website was a DNS record, I’d be really happy with that.

Edit: TIL ISPs in the US don’t have NATs

Edit 2: OMG so much advice. My knowledge about computers is SO clearly outdated, I have a lot of things to read up on.

Edit 3: There’s definitely a CGNAT involved since the WAN ip in the router config is not the same as the one I get when I use a website that echos my IP address. Far as I can tell my devices don’t get unique IPv6 addresses either. (funnily enough, if I check my IP address on my phone using roaming data, there’s no IPv6 address at all). It’s a router/modem combo, at least I think since there’s only one device in my apartment (maybe there’s a modem managing the whole complex or something?). And it doesn’t have a bridge mode, except for OTT. Might try plugging my own router into it, but it feels like a waste of time and money from what I’m seeing. Probably best to just host services over a VPN or smth.

Edit 4: Devices do get unique IPv6 addresses, but it’s moot since I can’t do anything but ping them. I guess it wouldn’t be port forwarding but something else that I would have to do that my router doesn’t support

    • ⲇⲅⲇ@lemmy.mlEnglish
      1·
      1 year ago

      I’m of course referring to a real DMZ and not a DMZ host.

      Maybe but why would it matter, especially enough to pay cloud bills?

      Because we are talking home-made stuff, we didn’t talk about a real firewall or any infrastructure, and even doing that is much more expensive than the cheap VPS.

      I have a cheap VPS for my website but that is just because I’m behind a CGNAT and I won’t bother to solve that.

      Same, that’s why I am saying there is no need to expose your IP, unnecessary risks.

            • ⲇⲅⲇ@lemmy.mlEnglish
              11·
              1 year ago

              I’m getting a bit tired of your replies.

              Basically you learn everything from start to finish. Maybe you could even setup a proper VM host using proxmox or something.

              The cost of a server at home as you are saying is much more than hiring it online. The only difference is how you boot the BIOS to install the ISO burned into a USB. A hosting service would require you to do it different, and you will anyway learn it in this way, which could help you in the future to deploy some product ready or for your work. So there is no difference at all, and you also need to secure it.

              So as expected it isn’t really risky as long as you take the appropriate security actions.

              I don’t know if you really read it. It is saying that you can never expect when a new 0-day vulnerability comes out. Like: https://venafi.com/blog/ssh-vulnerability-allows-authentication-without-password/ → “attacker could successfully authenticate without any credentials”

              A VPS doesn’t solve any security issues with your website itself.

              Yeah, it solves that they only infect your server on a hosting provider and not your home where you have your phone, router, more devices where they can test more exploits to them. Also, your hosting provider normally also monitors for suspicious requests so if it is infected, your provider will inform you of suspicious activities.