Using Fail2ban to protect exposed services | arvind.io
arvind.io
Fail2ban is a software application that protects you from brute-force attacks. The most common use-case is to protect your server's publicly exposed SSH service from being an easy target. If that is your only goal, you might find it quicker to follow the steps from this article by Linode for...

I’m wondering if I’m starting to outgrow Tailscale… my wife keeps having networking issues on Android due to Tailscale, the Nvidia Shield kills the Tailscale app randomly, and my parents’ TV doesn’t have a Tailscale app…

I feel like the time is approaching to publicly expose some of my services to the internet…

Any other tips?

  • paequ2@lemmy.todayOPEnglish
    6·
    16 hours ago

    I am kinda interested in WireGuard, but how does it work with multiple non-PC devices on different networks? Tailscale runs seamlessly on my Arch laptop, but Android, TVs, and streaming sticks have hiccups from time to time.

    I have services that I want to share with my non-techie family. If a service stops working, they suck at debugging and fixing the issue on their own.

    • Creat@discuss.tchncs.deEnglish
      12·
      16 hours ago

      Tailscale is WireGuard under the hood, if you didn’t know. It’s an overlay network that uses WireGuard to make the actual connections, and has some very clever “stuff” to get the clients actually to connect, even if behind firewalls without needing port forwarding.

      Using WireGuard directly basically just changes the app you use, which may or may not help with your issues. But the connecting technology is the exact same.

    • null_dot@lemmy.dbzer0.comEnglish
      10·
      17 hours ago

      I’ve never used tailscale but use wireguard extensively.

      There’s not much of a learning curve for you as the administrator. You have to discard some misconceptions you might bring from other VPNs but really after 30 minutes of looking at configs you’ll get it.

      I use wireguard for my small team of 5 people to access self hosted services. You install wireguard, load the config, and then it just works.

      The trick, if it can be called that, is using public dns for private services.

      On your server, suppose you have service-a service-b and service-c in containers with ip addresses in the 10.0.2.0/24 range. Then you’d have a reverse proxy like traefik at 10.0.2.1. You’d also create a wireguard container with an IP in that same 10.0.2.0/24 range, and configure it’s wireguard adapter to be 10.0.12.1 or soomething so you have “2” for the containers and “12” for the wireguard clients.

      Then in wireguard configurations you direct all traffic for 10.0.2.0/24 through the tunnel but everything else just uses their devices normal internet connection.

      Finally create a public dns record pointing to the reverse proxy like *.mydomain.com > 10.0.12.1

      now whatever.mydomain.com will resolve to your reverse proxy but is still only available to devices connected to the wireguard container on your server.