• 0 Posts
  • 82 Comments
Joined 11 months ago
cake
Cake day: August 6th, 2023

help-circle



















  • What you probably want is a dmz or red/green localnets. A reverse proxy (as others have mentioned) like haproxy or nginx) are extremely unlikely to, themselves, be hacked. But they don’t really add security, either.

    What does add security is to have a router with a firewall, with one or more red networks, and a green network.

    The red network has all of your public-facing servers. They have virtually no external access, and no internal access except to respond. It’s even good to have a rule on the router that you can turn on/off that blocks all outbound connections from the red network to the external world. To upgrade a server, turn off the rule, upgrade, and then turn the rule on again. The router only forwards inbound connections from the internet on a specific port, and routes them to the server/servers on the red network(s) on a (possibly different) specific port.

    Most ownage-style hacks involve (once compromised) either calling home (can’t if the server is not allowed outbound connections) or opening an additional port (who cares, the router will never forward anything to that port).

    Then, back up your important info, and keep multiple copies of that info - daily for a week, monthly for a few months, and yearly.