I want to remotely access a Linux server in my private local LAN via HTTPS and SSH.
The server ist connected to my DSL router (German Fritz!Box). As I can't directly access my server because of this, I configured a NAT port forwarding to ports 443 and 22.
What I didn't consider was the drawbacks of NAT port forwarding: On my local server, I can only see the IP of my router as sender of each package.
I operate a small virtual Linux server, where I used fail2ban and some iptables rules to prevent some attacks (e.g. restrict the allowed IP addresses for connections to my country), and fail2ban automatically blocks IP addresses which had too many failed login attempts.
Because of NAT I can't do the same with my local server (or can I?). So what shall I do?
I thought about using my virtual server as a relay: Opening an SSH connection from my local server to my public vserver, and create two reverse SSH tunnels. The virtual server could then apply some firewall rules.
Is this a reasonable approach? Do you have some hints what else might make sense?