Comment by eduction | Hacker News Reader

Comment by eduction | Hacker News Reader

Your approach is nice and easy and sensible. I personally preferred hetzner to linode (which has a history of bad security) but I imagine the minimum price is higher.

When you’re ready to reduce prices and increase privacy, take a look at a tiny (like t3a.micro or .nano) ec2 instance that forwards to/from your “real” server at home which can be beefier. The home server maintains a vpn connection to the ec2 instance. you also need to configure nat and port forwarding on both sides so you’ll need to get your hands dirty with nftables/netfilter (probably a night or two of pain realistically).

Once it’s set up and working and you can get your monthly spend down to $3-$4 (I pay up front for three years of ec2 credits). You need your own hardware but a used nuc for example is pretty cheap and adding storage is a matter of buying an external usb hard drive.

And if you stick to https/tls (via letsencrypt) the Amazon forwarding instance can’t see what’s in your traffic (just which ips are visiting you and when).

(You could obviously cut Amazon out entirely if you’re comfortable hosting directly from your home ip but I never wanted to deal with the potential isp headaches.)

Is there some reading about setting this sort of thing up that you could direct me towards? I am ignorant but competent (I even had a CCNA at one point) and not afraid of manuals, and this setup actually sounds ideal for me - I have a ton of disk space and compute power at home. If not for Starlink I might even just try running it from home anyways.

The only thing I don't have from your scenario is a public IP due to being on Starlink as I said, so there's no way for me to let anyone in my front door here even if I was willing to endure the pain, which I don't think I am. Is there a way to have my server always be the initiator of the VPN connection, and the bouncing server just say "sorry" if the home server isn't responding?

I am tempted to bring up the question of having a CDN cache (or whatever the terminology is) for those occasions, but that sounds like money, in the final analysis the straightforward setup might still be my best bet for now.

But yah, the idea of just having a small public bouncer that forwards stuff and doing everything from my home servers has occurred to me before, I just don't know yet how to set that up and I get nervous with anything public, it's a scary world out there.

Doing it the "dumb" way just gets me onboard and I can start looking at all the little parts, it's how I learn stuff really... like I said, very interested in doing some more reading on exactly how one would implement that, as detailed as possible because I am very stupid when I'm first setting out on something, I need the text equivalent of someone talking real slow like I'm five. :>

I think it'll be hard to find a specific article about this, but I've give you some pointers

You don't need a consistent public IP from Starlink with things like Wireguard, Tailscale, or Cloudflare Tunnels. You just need some server somewhere with a static IP which is pretty easy to get for cheap (see suggestions for where to get the server elsewhere in this thread). Once you have a public IP you can:

A) Setup wireguard on that server and configure your local machine to connect to it

B) Setup tailscale on both computers

C) Setup a cloudflare tunnel and point to it via a domain you manage in cloudflare (with added bonus of cloudflare protection out of the box)

From there you just need documentation on properly doing reverse proxying with Nginx or similar and setting up Lets Encrypt (certbot or acme.sh).

The "hard part" is getting past Starlink, but if you think about it you must be able to do that somehow otherwise how do you get internet? That is what the 3 options provide: a way to open the connection somewhere you trust to allow others to make requests. (The "others" may be you just outside the local network)

or you could use https://www.tarsnap.com/spiped.html instead of a VPN

> The home server maintains a vpn connection to the ec2 instance. you also need to configure nat and port forwarding on both sides so you’ll need to get your hands dirty with nftables/netfilter (probably a night or two of pain realistically).

You could simplify substantially by simply using the ec2 instance as a reverse proxy (well, that’s simpler to me, at least, as someone much more familiar with reverse proxies).

Yup but if you terminate tls at the ec2 side (as in a reverse proxy) the tradeoff is less privacy since the upload/download data is fully observable from the ec2 instance. (Correct me if I’m wrong here, this is my memory from when I decided on my own setup years ago.)

Some people might not care about this which is fine. Personally I’d rather take on slightly more overheard in setup (nftables vs nginx or whatever) and get the privacy in the bargain.

Ahh i understand now. So you’re basically just using ec2 for the IP address then, right?

Reply on news.ycombinator.com