Hacker News Reader

Comment by sergiomattei | Hacker News Reader

I’m curious. Are there any new major difficulties when setting up home servers?

Last time I tried it was a little annoying with dynamic IPs getting in the way, but possible with just a port forward or UPnP. Are ISPs making changes to prevent this?

View on HN

I've never run into trouble running stuff from home. SMTP from home is always going to be problematic, though.

The lack of IPv4 address space has started a trend of CGNAT which makes hosting from home nearly impossible. Luckily, IPv6 continues to be rolled out, but in many situations thst would lead to your services only being reachable through IPv6. There are still a great many outdated networks out there that can't reach IPv6, so you might run into trouble there.

If you can get a public IPv4 IP address, I see no reason why you'd run into issues. That's more of an ISP problem than a hosting problem, in my opinion.

In general using IPv6 reverse proxied by something like CF is the optimal solution to most problems.

If you're going the Cloudflare route, then just get a cheap VPS somewhere and run off that instead. Gets you both IPv4 and IPv6 connectivity, and you can always proxy stuff yourself if you need to access local hardware.

It's a solution, but it's hardly the home server project you could (and should be able to) run from your home internet.

If you're going to rely on cloudflare, who control access to a huge number of sites and explicitly choose to cut off some of them for political reasons, why even bother hosting something yourself? At that point you might as well be posting on facebook.

most ISPs in Australia offer a static IPv4 for a monthly fee ($5 to $10 a month).

If you're going to pay $10 a month, you might as well pay for a VPS instead and connect up to it with wireguard, nebula or tailscale. Especially if paying means dynamic IPv4 that isn't behind CGNAT rather than an actual static IPv4 address.

Paying gives you a static IPv4 that remains the same for as long as you're subscribed.

It's not a bad option if you're already paying for gigabit, sadly nearly impossible to get symmetrical gigabit here, but still for an extra $5 or $10 a month it's ok.

That's an ISP problem, though. For that price it's better to just rent a VPS for hosting/proxying traffic. A wireguard tunnel to your actual home server and an nginx proxy at a $4 VPS provide more options than just a guaranteed static IP. Hell, if you can nab some capacity, you can use free VPS solutions like the one AWS and Google provide for a year, or the one Oracle providers forever if you can live with the 50mbps uplink (you get 2 servers so maybe you could tunnel that into 100mbps?) and the annoying Web UI for setting them up.

Luckily, you don't need a static IP address in most use cases if you set up dyndns, as long as the IP is exclusively used by you and doesn't change too often (e.g. every week or month or so).

> For that price it's better to just rent a VPS for hosting/proxying traffic.

Why would it be better? It would be more complex technically, and certainly less resource efficient. Am i missing something?

It would be more complex, but you'd have a lot more flexibility. Your ISP might not be able to deflect DDoS attacks as efficiently as a remote proxy, you can set up your own caching with a high-speed connection, and you can secure your home network a bit better by only allowing the remote proxy access to your home server.

You'd also save costs moving some of the hosting to the cloud while you're at it, be use you don't don't need to pay a separate electricity bill for a cloud VPS. Plus, VPS storage is usually more reliable than a custom RAID config, as is the power grid around data centers and the internet connection itself.

If you're going for efficency or simplicity then you're totally right, but if you're trying to get value for money I think a cheap VPS would be better.

> SMTP from home is always going to be problematic, though

If your IP is not dynamic, and you can configure the reverse DNS, there's not going to be problems :)

Except with Gmail and Outlook of course, but well these are the problems, not us.

Most, if not all, residential IP blocks are in the various blacklists most mail servers query. Merely having a reverse PTR won't get your email delivered. Even SPF and DKIM with DMARC probably won't be enough to get over the blacklist rating.

Some business IP blocks aren't blocked, though, so in rare cases you might get away with running a mail server from a business internet subscription.

> Even SPF and DKIM with DMARC probably won't be enough to get over the blacklist rating.

I can confirm this. I recently tried to set up being able to send emails from an smtp server in my homelab to my gmail address. Even with all the good stuff - a domain, tls, spf, dkim, dmarc, gmail just straight up refuses to receive mail from residential IPs. I ended up proxying it through my VPS, which works better but still requires me setting up gmail rules to NEVER send messages from my special domain to spam. Which it would otherwise do for no apparent reason sometimes.

I -- along with many other mail server operators -- block dynamic IP space. Which is almost the same as blocking home users, but not quite -- I have a static /29 on my residential package and ran my mail server from the slow side of an ADSL connection for several years.

That's about it. In addition, some ISPs make sure you cannot change the resolver advertised on DHCP, and that your own IP is routed via the Internet and back (so local requests are slow as hell), both of which can be hacked around by running your own router behind the ISP's modem/router.

Of course, the real solution to the problem is to find a decent ISP, like a non-profit from FFDN.org federation. Then you have "real" internet and no worries for selfhosting.

And how much time/expertise do you need to not trigger all kinds of warnings in modern browsers?

Fairly little? I think you might be thinking of email where running your own email sever is tough

Receiving mail is also not hard. You may have to deal with the bonus mail (spam). But that's it.

Close to none. Just a letsencrypt cert and not completely outdated ciphers is enough.

:) "Just a letsencrypt cert". That's right for me and most off the HN audience. Is it right for the general public?

Yes, because if you web server publicly reachable, letencrypt can be automated easily. And there is plenty of letsencrypt software that does fully automates this.

A public web server is the easy part if you want to do letsencrypt.

Letsencrypt is easy, if you are running generic Linux distribution and can easily install whatever you want.

But you might run a device that already comes with software, and letsencrypt support is either limited (example: Synology; their implementation allows only http-01 challenge so if you need dns-01, tough luck. Even wildcards are a new feature) or non-existent (example: Ubiquiti, and their cloud keys (administration UI, guest portal) or routers (Radius/WPA Enterprise needs TLS cert too)).

dns-01 is possible on Synology, but you need to SSH in:

* https://github.com/acmesh-official/acme.sh/wiki/Synology-NAS...

* https://lippertmarkus.com/2020/03/14/synology-le-dns-auto-re...

* http://www.thedreaming.org/2020/11/18/synology-lets-encrypt/

It's possible as long as your ACME client has hook scripts, and your DNS provider has an API:

* https://github.com/AnalogJ/lexicon

It's unofficial, but https://github.com/kchristensen/udm-le lets you provision LetsEncrypt certificates for Ubiquiti kit.

Is the general public that much into running private web services on their home networks?

That is the lowest bar for setting your certificates. It should be right for the general public.

The general public's alternative is to buy a cert every year for $$. They'll figure it out. (or their shared hosting provider will)

Which audience exactly is cool with the register a domain name, figure out your ip, setup an A record to point there (maybe dynamically!), enable port forwarding, install a web server, etc, but gets stuck on letsencrypt?

Letsencrypt is almost certainly the easiest part of the entire process of self-hosting a website.

> Is it right for the general public?

My Asus router has a checkbox for dynamic DNS and for getting Let's Encrypt certs. See Method 2:

* https://www.asus.com/us/support/FAQ/1034294/#a2

Yes. Even the most complex technical setup can be accomplished by a non-technical person that can follow directions assuming that someone took the time to write clear and concise directions and included common caveats and troubles that one may run into and where to check for them. I have proven this many times over by having managers and directors that were non-technical follow my instructions. In the rare moments this breaks down, forums and chat rooms can be a very handy gap-filler and provides an indirect feedback loop to further improve documentation.

Reply on news.ycombinator.com