I have a small VPS (Ubuntu 16.04) that I use for hosting of a few personal websites, ownCloud, etc. It's fairly slow and doesn't have a lot of storage. I'd like to offload the ownCloud storage and MySQL database, basically anything resource-intensive, onto my home server (Ubuntu 17.10), without opening my home network any more than absolutely necessary.
What's the best way to do this from a security standpoint? There are three options that I can think of:
- Expose MySQL and NFS on nonstandard ports, firewall all but the VPS's IP.
- Establish an SSH tunnel, route all MySQL and NFS traffic through the tunnel.
- Set up a VPN, ditto.
My concern in the case of 2 and 3 is that if my VPS is compromised I may end up exposing more of my home network that I intend – it's the VPS that decides which remote ports/IPs it's going to tunnel to, so once the tunnel is set up, any attacker can add new tunnels.