[kwlug-disc] Home Web Servers Security

[Jason]

I would agree, a VPS for hosting the public websites is safer than putting
it inside your home network. Last thing you want is to expose a service
that can be exploited for remote code execution or shell access on the
underlying machine... Which are happening a lot more often now because of
AI.

For example - I was actually vulnerable to this Wordpress exploit, but my
CDN prevented it: https://youtu.be/SKuJ60kD8wg?si=ybyS9Sx1eO_9orlJ
Make sure to keep up to date on your Linux kernel version, regular software
updates, and full system snapshots and data backups.

I would recommend using a free CDN like CloudFlare in front of the sites -
that'll help obfuscate the source IP, make it harder for some exploits to
be used.
I do have my own issues with CloudFlare, but their free tier does work well
for small workloads, and it'll provide some DDOS protection.
https://www.cloudflare.com/products/cdn/

For your own personal (non-public) services, VPN, Tailsale, or an outbound
service like CloudFlare tunnels (again, I have my own issues with this),
are preferable to port forwarding.
https://developers.cloudflare.com/tunnel/

Cheers,
Jason

On Wed, Aug 5, 2026 at 1:13 PM Jon Thiele <jthiele at gmail.com> wrote:

> Thanx to Colin, Paul, Khalid and Remi for your help.  After discussing
> this with some other people, I think that Khalid's suggestion is
> obviously the best solution to my issues.  It drops my monthly costs
> by about 85% and it gives me everything I want in terms of security.
>
> Thanx again,
>
> Jon
>
> On Mon, Aug 3, 2026 at 3:52 PM Remi Gauvin <remi at georgianit.com> wrote:
> >
> > On 2026-08-03 2:09 p.m., Jon Thiele wrote:
> > > Looking for some advice.   I manage Wordpress sites for three
> > > charities I'm involved in. Very low traffic - maybe 500 hits a month
> > > combined.
> > >
> > > The cost is starting to get a bit pricey since I pay for these sites
> > > myself.   I was thinking that I could handle this using my own
> > > standalone PC.  So I cloned one site and set it up on Ubuntu 26.04.
> > > Everything went well - but now I'm thinking about exactly how to set
> > > up the networking part securely.   I'm on Rogers and right now and I'm
> > > forwarding ports 80 and 443 to my PC on my internal network.  Is this
> > > good enough?  I've used pfSense in the past and could use their port
> > > forwarding feature but not sure what the difference would be.  If you
> > > run a home server, what did you do?
> >
> > Generally speaking, you would want publicly accessible websites to be in
> > a dmz network, and another firewall between that and your home computers.
> >
> > This is probably considered outdated thinking, and *all* devices should
> > treat network like a hostile zone, but in the real world, I think most
> > people consider internal network to be safe zone.
> >
> > So in your example, you would need two routers, (The Rogers modem can be
> > considered one, but if your hosting websites, you might static ip
> > config, I'm not sure they work as router in that config.)
> >
> > The theory is that if someone exploited, for example, a Wordpress bug
> > that gives them remote command execution, and persistence presense on
> > webhost, they could not use that to launch attacks on your other,
> > private computers.
> >
> >
> >
> > > Thanx.
> > >
> > > Jon
> > >
> > > _______________________________________________
> > > kwlug-disc mailing list
> > > To unsubscribe, send an email to kwlug-disc-leave at kwlug.org
> > > with the subject "unsubscribe", or email
> > > kwlug-disc-owner at kwlug.org to contact a human being.
> >
> >
> >
> >
> > _______________________________________________
> > kwlug-disc mailing list
> > To unsubscribe, send an email to kwlug-disc-leave at kwlug.org
> > with the subject "unsubscribe", or email
> > kwlug-disc-owner at kwlug.org to contact a human being.
>
> _______________________________________________
> kwlug-disc mailing list
> To unsubscribe, send an email to kwlug-disc-leave at kwlug.org
> with the subject "unsubscribe", or email
> kwlug-disc-owner at kwlug.org to contact a human being.
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://mail.kwlug.org/pipermail/kwlug-disc_kwlug.org/attachments/20260805/46d8d142/attachment-0001.htm>