Hi, I live in Germany and only have public IPv6. My address changes only very, very rarely and has never changed in the time I’ve been self-hosting.

I also have a very small, pretty cheap VPS with static IPv4/IPv6 – which would seem like a great fit for some sort of tunneling/proxy setup. Now comes the question: What/how should I use it? I would like to not have the additional latency for IPv6 enabled hosts, can I just setup a reverse proxy for IPv4? Would Tailscale work for my usecase, what are some resources you found useful when using it?

Currently, I’m just hosting everything IPv6-only and hoping my address never changes, but that does not work for everyone, as especially many new buildings with fiber optic connections still only have IPv4 (strangely).

  • dblsaiko@discuss.tchncs.deEnglish
    51·
    12 hours ago

    Yes, you can just use a reverse proxy for IPv4 only and point it to the IPv6 upstream. That is what I do, with a separate DNS record which then combines the two. See the DNS records for id.knifepoint.net (CNAME), http.vineta.knifepoint.net (AAAA, A) and vineta.knifepoint.net (AAAA).

    The reverse proxy config and certificate management is set up with NixOS, if it helps: https://git.dblsaiko.net/systems/tree/nixos/defaults/v4proxy.nix https://git.dblsaiko.net/systems/tree/nixos/modules/sys2x/v4proxy.nix

    • rirus@feddit.orgEnglish
      16·
      12 hours ago

      But having a reverse proxy would enable someone getting access to it to read traffic, while having a VPN Tunnel won’t.

        • dblsaiko@discuss.tchncs.deEnglish
          1·
          8 hours ago

          Tbf, technically data is still decrypted at the reverse proxy and then re-encrypted. So if someone manages to reconfigure the proxy or read its memory somehow they could read traffic in plain text.

          However then since they have to control the VPS, they could also get a new cert for that domain (at least the way I’ve configured it) even if it was passed as is to the real host via a tunnel and read the plaintext data that way, so I don’t think a tunnel protects against anything.

          • hank_and_deans@lemmy.caEnglish
            1·
            5 hours ago

            Or just use Nginx stream proxy, and all the encryption happens on the endpoints. No need for certs on the proxy at all.

            This is how I make https and mqtts available on ipv4.

            • dblsaiko@discuss.tchncs.deEnglish
              1·
              16 minutes ago

              Oh interesting, I’ll have to look into that. Is this with that “proxy protocol” I’ve seen mentioned? If not, does this preserve it pass through the client socket address?

          • amdim@lemmy.dbzer0.comEnglish
            1·
            7 hours ago

            I use this setup and don’t terminate SSL at the VPS and solely tunnel the encrypted traffic over a wire guard tunnel to the home lab where SSL is terminated.

            The VPS solely serves to move the traffic from an external IP to an internal one.

            It’s possible that someone could log into my server, change the nginx config to terminate SSL and then siphon data but it would take a few steps and can be somewhat mitigated by stapling the SSL certs that should be seen from the homelab.