8

I currently have a multitude of servers running on my home network. These include a Minecraft server, a Git server, and a Teamspeak server (the last two are running on docker on a Raspberry Pi).

To make things a bit easier for me and the people I want to share the servers with I decided to set up a DynDns, using a free DynDns provider (No-Ip), without thinking of potential security risks.

One of these risks occurred to me a few days ago when I started to ping the given domain name and it showed my clear public IP address. I then tried to use a generic "IP-lookup" website and sure thing, my public IP address was there for everyone I told the domain name (and everyone who somehow gets their fingers on it) to see.

I of course understand that this is a huge security risk and after days of trying to find a proper solution my question now is:

How do I hide/mask my public IP while still being able to efficiently share my servers with friends and fellow IT students?

Or in other words: How do I get rid of that risk?

14
  • 14
    There is no risk at all. There literally no way you can access a server without knowing the IP address. Dynamic DNS allows you to share a dynamic IP address via DNS. But there is no way to “cloak” or hide the destination IP address. Feb 18 at 22:27
  • 10
    “How do I hide/mask my public IP while still being able to efficiently share my servers with friends and fellow IT students?” - You can’t both host a service and not publish your IP address
    – Ramhound
    Feb 18 at 22:34
  • 36
    This is like "I want to order a package but I don't want Amazon to know where I live." - they kind of have to know so they can bring the package to the right place!
    – user253751
    Feb 19 at 0:31
  • 7
    You're after a reverse-proxy, which would allow you to hide your IP address. Feb 19 at 11:54
  • 5
    @user253751 well, you could order from Amazon to P.O. box instead to your home address, and then go pick it up yourself later, which would hide that information. Which is what Gregory Currie suggestion of reverse-proxy does, or for example TOR hidden service. Feb 19 at 15:24

6 Answers 6

32

One of these risks occured to me a few days ago when I started to ping the given domain name and it showed my clear public ip adress. I then tried to use a generic "IP-lookup" website and sure thing, my public ip adress was there for everyone I tell the domain name (and everyone who somehow get there fingers on it) to see.

Yes, that has always been the way DNS works (whether DynDNS or otherwise). Your connections never go through DNS; its job is just to point you at a specific IP address.

I of course understand that this is a huge security risk

No, it really isn't.

For one, as others have explained, knowing the IP address is necessary to contact the server in the first place, because the Internet actually has no way to send a packet "to a domain name" at all – it always needs to be translated to an IP address first. So in general, IP addresses are not something that's cautiously guarded; they're more like the baseline level of knowledge. (In some ways, knowing the domain name can actually give more access than knowing just the IP address!)

But even supposing that your IP address could have remained hidden (let's say if connections were relayed through the domain name, somehow), your server would still be accepting connections to the exact same services, in the exact same manner, and would therefore be subject to the same risks as before.

The main point is that attacks don't come through some kind of "backdoor access" through the IP address; they're done through the very same services that you're opening up for public access. Everything that can be done with your server is determined by the specific services that accept connections, such as your Minecraft server.

Finally, even given that communications require the IP address, not knowing the address isn't that big of a hurdle for attackers. Most attacks aren't from someone targeting you specifically, they come from botnets that are able to scan the entire Internet looking for some vulnerable service. There are relatively few IPv4 addresses – fewer than 232 – and it takes only a few hours, if not minutes (depending on network connection), to scan all possible IPv4 addresses for a specific open port – and then maybe a few more hours to probe them for some known vulnerability.

Meaning, even if you kept your IP address completely private, various bots would already start knocking on your door practically the same day your server went online. I left a freshly installed VPS for an hour without a firewall and it already logged several thousand SSH login attempts just like that.

Probably the only actual risk that comes from knowing your address is the possibility of becoming a DDoS target, but I wouldn't really consider it much of a risk if your intended audience is people that you know IRL. There do exist "proxy" services that mitigate this by allowing you to hide your own address by having the proxy in front. Most commonly these are used for HTTP-based services (not just to hide the backend servers, but also to provide caching during normal operation) – you might've heard of CDNs such as CloudFlare – but there are even some that specialize game servers, usually not for free.

How do I get rid of that risk?

You haven't described any specific risks – but just to repeat the point, knowing the IP address is not what makes the server vulnerable – the services running on it, which accept connections, are what may (or may not) make it vulnerable.

So the main methods of mitigating actual risks are:

  1. Make sure the services use strong authentication (i.e. no easily-guessable passwords), and keep the software up-to-date to reduce the risk of pre-authentication attacks.

  2. Use other ways – not DNS-based – of restricting who may connect to them. A firewall (nftables/iptables/ufw) is good to have, for various reasons – e.g. to make sure new services don't become publicly accessible before you've set them up, or to limit a service to specific client IP addresses.

    It's common to restrict access by using a private VPN (OpenVPN, Tailscale, etc) that would provide an additional authentication layer, especially if some clients have dynamic IP addresses.

  3. Use privilege separation within the server, so that if someone breaks in to a specific service, they cannot compromise other things. Run as few services as 'root' as possible; run different services under different system accounts (e.g. split up 'www-data'); run things in containers; use AppArmor.

  4. As Albin hinted, isolate your server from the rest of the network, so that if someone breaks in, they can only compromise the server but not the rest of your LAN. This usually means two separate subnets, one for your server (the "DMZ") and one for the rest, with the router having its own firewall to restrict where traffic goes.

  5. Check up on what the server is doing. Even if you don't have a fancy monitoring system, at least run htop every now and then; look at the latest system logs; maybe vnstat or systemd-cgls. In other words, look for anything unusual (whether it might be your own services crashing or whether it might be someone running a bitcoin miner or whether it might be your HDD about to give up).

7
  • The damn bot-nets scanning the internet is the real threat. Hiding the IP doesn't do jack. I spun up a VM on Digital Ocean, and within 30 minutes, I get random URLs trying to login via all sorts of credentials. Of course none of them work because the server has nothing to login to, other than SSH via SHA2-512 keys, but the bots don't care. They'll try everything and then move on.
    – Nelson
    Feb 19 at 8:10
  • So if I understood that right: As long as I keep my passwords on the running Services/Devices at a virtually unbreakable level the only thing I'd have to fear is a Potential Ddos? Which I could counter by Setting up ddos Protection? Thank you so much btw, this is the answer I've been looking for
    – Cyros
    Feb 19 at 14:04
  • 5
    @Cyros "and keep the software up-to-date to reduce the risk of pre-authentication attacks." You should use strong passwords, but that won't help if you are running out of date software with a known security exploit.
    – BurnsBA
    Feb 19 at 14:27
  • 4
    @Cyros: You still have the possibility of security issues in the services that you have open, such as bugs that lead to authentication bypass. But all of that is still exactly the same risk regardless of DNS vs IP, since it all involves communicating with the service and not just straight up bypassing it somehow. You reduce that risk by keeping the software up-to-date, as well as the other suggestions in the post. Feb 19 at 15:09
  • @Nelson that only apply to very small address space of 32-bit IPv4 Internet, though. If you assigned your server truly unique 128-bit IPv6 address (and not published it in DNS or made it known elsewhere), you'd get rid of bots trying to brute-force whole Internet. Feb 19 at 15:17
7

You can't "hide" your public IP address. The point of a public IP address is being public. If you would hide your IP address nobody would be able to access your servers anymore.

Knowing the public address is not what makes your server insecure. There are other multiple security concepts you need to consider (firewall, updating your servers, proxies, etc.). I would advise you to read up on how to secure a public server first. If you have specific questions on the implementation you can ask them here. A reverse-proxy might be what you are looking for. It makes it possible to "hide" any infrastructure behind it (including IP addresses etc.). However, you will still need a public IP address for that reverse proxy. So you either have to get a second public IP just for the proxy or you get a proxy server with some kind of service e.g. via a VM that's hosted on the internet (I'm sure there are all kinds of services you can use).

If you REALLY NEED to go online right away, set up a DMZ and put your public servers in there. This will not secure your servers but at least the rest of your network won't be compromised. But with your presumed knowledge of network security, I wouldn't advise this.

Please note: As grawity points out in some/most end consumer routers the build in DMZ function ist actually a "exposed host" function. Please note, "exposed host" function will not isolate the DMZ from your LAN as a proper DMZ would do, thus opening your LAN network to various security issues. Make sure you understand how the DMZ function works if you use your router's build in function.

9
  • 1
    “If you want to go online right away, set up a DMZ and put your public servers in there.”—Dangerous advice, considering how virtually all consumer routers simply do not support DMZs. They only support “Exposed Host”.
    – Daniel B
    Feb 18 at 21:24
  • 4
    @Albin: The problem is that what consumer routers call "DMZ" is not exactly the same as what enterprise networks call "DMZ". The DMZ feature in consumer routers is just DNAT – port-forwarding for all ports – so it secures absolutely nothing. If anything, it only opens things more. Feb 18 at 21:45
  • 1
    @u1686_grawity is interesting, I would have thought it keeps the DMZ port and the LAN port separated. Thanks for the heads up, I will add it to my answer.
    – Albin
    Feb 19 at 1:36
  • 2
    Here’s an example from Netgear. Here’s ASUS. Here’s TP-Link, which has the most explicit description about this feature.
    – Daniel B
    Feb 19 at 12:03
  • 2
    Well, with those routers' DMZ the idea is that some other device/computer/VM handles the firewalling/forwarding/filtering in whatever complex manner you would contrive. So by design (as those docs say) this computer's ports are all exposed. I suppose it would be prudent for that device to have 2 NICs, and for the rest of home LAN, or at least the specially protected servers, to use its "internal" NIC as the router (so if your AP permits, they are on a different VLAN... separate switch otherwise).
    – Jim Klimov
    Feb 19 at 12:30
5

As one of the comments said:

You're after a reverse-proxy, which would allow you to hide your IP address.

There are services on the internet, such as ngrok (commercial with a free tier; used it for some experiments), which allow to publish a DNS name on the internet using their server which yours connects to and establishes a port tunnel. Using free tiers of some VM/container hosting solutions, you can make a similar service that you fully own and set up.

This way, visitors from the internet know (from DNS) the IP address of this cloudy instance and access it by name, and packets are forwarded to the hidden server you want to use, via SSH tunnel or similar - initiated from your home LAN.

One use-case I had for this was to receive GitHub and similar services' web-hooks (notifications about new commits to test) into CI servers running inside a corporate LAN that has no public addresses/NAT/... deliberately.

4
  • 3
    Please note that even this does not improve the OP's security, since he will still have a public IP, available/visible to anyone to scan, even if it is only a DHCP address from his ISP.
    – MikeB
    Feb 20 at 8:17
  • Not necessarily: such "public" IP address may in fact be from a "private" subnet (10.* and others) and NAT'ed by the ISP for outward connections, with little chance for connections from the Internet to be initiated to customer's computer (more so if it is assigned to external interface of the router/AP, and home LAN with computers is a different subnet). Even if a true public IP is assigned to the AP, which is a NAT router for the home servers, connections from the world generally are not a thing. With such a cloud proxy, home servers initiate the tunnel to cloud and only then exchange bytes.
    – Jim Klimov
    Feb 20 at 19:12
  • 1
    That will be true for some people, but the OP clearly states that he has a Public IP, and I suspect that his NoIP name wouldn't work if he didn't have one.
    – MikeB
    Feb 21 at 10:28
  • 1
    @MikeB: You're missing what the actual threat is, especially in a gaming context. It's not that the published public IP address allows rando skript kiddies to pwn your box. It's that it reveals information about your physical location to assholes who you might be playing against, who may try to do things like get your ISP to take down your server, DDOS you, swat you, etc. Feb 21 at 15:39
5

Most of the answers and comments here, and possibly even the OP, seem to be misunderstanding whether/why publishing a home IP address might be unsafe, especially in the context of game servers.

Of course having a public-facing IP address of publishing it does not make you any more vulnerable to exploits against services running on your server or against its network stack. If this is the only concern, then indeed there's no problem.

However, lots of online communities, especially gaming related ones, have serious problems with angry assholes who retaliate for the slightest perceived offense with grossly disproportionate action. Possible threats may include:

  • doxxing
  • swatting
  • trying to get a person fired
  • trying to get a minor punished by their parents
  • trying to get ISP to disconnect service or block customer from running servers

Knowing the target's public IP address is a first step towards performing some of these attacks: locating the general geographic location of the target, which ISP to complain to or social engineer for information, etc. It does not automatically give them the target's name and address, but still people likely to be targeted might have good reason not to want their home IP address visible in certain contexts. (Note however that there are plenty of other ways to get someone's home IP address, like sending them a link to your personal webserver and reading the logs when they click.)

If these are concerns to OP, then indeed running a game server on their home IP address with dyndns pointed to it is not a good solution. The right fix is to look for reverse proxy services (like others have noted), VPN service with public IP and incoming connection support, or a VPS they can roll their own VPN on. This makes it so only the proxy/VPN service provider knows the real home IP address, and everyone else just sees a public IP hosted at this provider. However, this is likely to be undesirable for lots of types of gaming, as it will add some latency for the extra hops.

2
  • If this is actually a concern, then the best option would be IMHO to rent a VPS and just run the gaming server on the VPS itself. No extra latencies then, no worries about revealing home IP address etc. Problem solved.
    – raj
    Feb 28 at 20:38
  • 1
    @raj: Renting a VPS capable of running a game server easily costs 10-50x as much as renting one sufficient to route traffic through. Feb 29 at 21:32
4

What you're asking for is self-contradictory.

Your public IP address is public regardless of whether you're using DynDNS or not. Every site on the Internet you are connecting to knows your public IP address, otherwise you wouldn't be able to connect. This is just how TCP/IP protocol works.

If you send an email to anyone, probably your public IP address will be permanently visible in the headers of the email your recipient receives. There are other numerous cases where your public IP address will be known to many people.

If you want to host any services yourself, then you must make some IP address visible to the Internet. Even if you set up a reverse proxy - as some of the other answers suggested - then you must make the address of that reverse proxy publicly known. Any site you connect to on the Internet similarly has their IP address publicly known. It's an integral part of making a service available on the Internet.

Some VPN (or similar service) providers try to convince people through their marketing that "exposing" their public IP addresses to the Internet is "dangerous" (without actually explaining what the real danger could be), to gain more customers. It seems like you fell for these marketing tricks.

There's no security risk at all in your public IP address being known to anyone (that's what the word "public" means anyway). There is, however, security risk in connecting to the Internet insufficiently secured devices - regardless if your IP address is known to anyone or not. That is the part you should care for, and not "hiding" your IP address. Usually your home router - if its software doesn't contain any known security vulnerabilities (you should look for that information on specialized security-related websites) - should provide the basic protection for you by the very fact that it does NAT, so it is impossible to initiate connections from outside to services other than the ones you have explicitly allowed, by setting up port forwarding on your router. I guess you must have done that to expose your Minecraft and other servers to the Internet. So if you have only set up forwarding for the ports where these servers work, nobody from outside will be able to connect to any other service (eg. SSH) in your home network.

Why then VPN providers claim that "exposing" the IP address is somewhat "dangerous"? Well, that "danger" refers to one particular scenario - as I have mentioned at the beginning, every site on the Internet you visit knows your IP address. If you are afraid that this information may be used against you, for example to track you (imagine you are an anti-government political activist and the government is looking for you and wants to arrest you), it is a reasonable case to "hide" your IP address - but you have to remember that both your ISP and your VPN provider will know that address anyway (but if you use a VPN, then your ISP won't know where you are connecting to - yet the VPN provider will, so the matter is whether you trust them).

This is the scenario VPN providers refer to in their advertisement, claiming "exposing" the IP address is "dangerous". It is rather a potential risk to privacy (anonymity) than security. But in reality it affects only small percentage of people, because for most of us, no malicious organization is actually interested in tracking us down and punishing in some way...

14
  • Another danger of exposing your public IP address is DoS. Even if nothing on your network is insecure, a bad actor can just flood your network connection with junk packets (presuming their connection is faster than yours, or they have several) making your internet unusable. But it's usually not difficult to change your IP address by just turning your router off for several minutes (may depend on your ISP).
    – user253751
    Feb 20 at 0:31
  • @user253751 If one of the students is DoS-ing, then changing the IP won't help, as they will also have the new IP.
    – gre_gor
    Feb 20 at 8:29
  • 2
    "If you send an email to anyone, probably your public IP address will be permanently visible in the headers of the email your recipient receives" - unlikely unless you're running a mail server behind your public IP Feb 20 at 11:27
  • @ChrisDavies If you submit mail from your mail client to any mail server, the IP of your mail client will be in the first "Received:" header. This has nothing to do with running mail server yourself. Some mail clients (eg. Thunderbird) will even expose your private IP address in that header. Unless the sending server removes that header (which is uncommon), it will go all the way to the recipient.
    – raj
    Feb 20 at 17:18
  • I checked messages received from Gmail and Office365 before posting. Neither includes the client's IP address, but I suppose that's because neither uses SMTP from the client (application) to the originating MTA Feb 20 at 19:59
0

It is possible use a virtual Server in the cloud as a network Gateway In to your network using (VPN or perhaps a proxy).

And then only allow inbound traffic in your your "private" network using by letting a firewall only allow from specific source IP ranges.

This will add latency..

You would end up paying for the inbound traffic for the minecraft server. The question you can ask your self is why not host the whole Minecraft server in the Cloud instead.

1
  • As it’s currently written, your answer is unclear. Please edit to add additional details that will help others understand how this addresses the question asked. You can find more information on how to write good answers in the help center.
    – Community Bot
    Mar 26 at 18:59

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .