<div dir="ltr">I would agree, a VPS for hosting the public websites is safer than putting it inside your home network. Last thing you want is to expose a service that can be exploited for remote code execution or shell access on the underlying machine... Which are happening a lot more often now because of AI. <div><br></div><div>For example - I was actually vulnerable to this Wordpress exploit, but my CDN prevented it: <a href="https://youtu.be/SKuJ60kD8wg?si=ybyS9Sx1eO_9orlJ">https://youtu.be/SKuJ60kD8wg?si=ybyS9Sx1eO_9orlJ</a><br>Make sure to keep up to date on your Linux kernel version, regular software updates, and full system snapshots and data backups.<br><br>I would recommend using a free CDN like CloudFlare in front of the sites - that'll help obfuscate the source IP, make it harder for some exploits to be used.<br>I do have my own issues with CloudFlare, but their free tier does work well for small workloads, and it'll provide some DDOS protection.<br><div><a href="https://www.cloudflare.com/products/cdn/">https://www.cloudflare.com/products/cdn/</a><br><br>For your own personal (non-public) services, VPN, Tailsale, or an outbound service like CloudFlare tunnels (again, I have my own issues with this), are preferable to port forwarding.<br><a href="https://developers.cloudflare.com/tunnel/">https://developers.cloudflare.com/tunnel/</a><br><br>Cheers,<br>Jason<br></div></div></div><br><div class="gmail_quote"><div dir="ltr" class="gmail_attr">On Wed, Aug 5, 2026 at 1:13\u202fPM Jon Thiele <<a href="mailto:jthiele@gmail.com" target="_blank">jthiele@gmail.com</a>> wrote:<br></div><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex">Thanx to Colin, Paul, Khalid and Remi for your help. After discussing<br>
this with some other people, I think that Khalid's suggestion is<br>
obviously the best solution to my issues. It drops my monthly costs<br>
by about 85% and it gives me everything I want in terms of security.<br>
<br>
Thanx again,<br>
<br>
Jon<br>
<br>
On Mon, Aug 3, 2026 at 3:52\u202fPM Remi Gauvin <<a href="mailto:remi@georgianit.com" target="_blank">remi@georgianit.com</a>> wrote:<br>
><br>
> On 2026-08-03 2:09 p.m., Jon Thiele wrote:<br>
> > Looking for some advice. I manage Wordpress sites for three<br>
> > charities I'm involved in. Very low traffic - maybe 500 hits a month<br>
> > combined.<br>
> ><br>
> > The cost is starting to get a bit pricey since I pay for these sites<br>
> > myself. I was thinking that I could handle this using my own<br>
> > standalone PC. So I cloned one site and set it up on Ubuntu 26.04.<br>
> > Everything went well - but now I'm thinking about exactly how to set<br>
> > up the networking part securely. I'm on Rogers and right now and I'm<br>
> > forwarding ports 80 and 443 to my PC on my internal network. Is this<br>
> > good enough? I've used pfSense in the past and could use their port<br>
> > forwarding feature but not sure what the difference would be. If you<br>
> > run a home server, what did you do?<br>
><br>
> Generally speaking, you would want publicly accessible websites to be in<br>
> a dmz network, and another firewall between that and your home computers.<br>
><br>
> This is probably considered outdated thinking, and *all* devices should<br>
> treat network like a hostile zone, but in the real world, I think most<br>
> people consider internal network to be safe zone.<br>
><br>
> So in your example, you would need two routers, (The Rogers modem can be<br>
> considered one, but if your hosting websites, you might static ip<br>
> config, I'm not sure they work as router in that config.)<br>
><br>
> The theory is that if someone exploited, for example, a Wordpress bug<br>
> that gives them remote command execution, and persistence presense on<br>
> webhost, they could not use that to launch attacks on your other,<br>
> private computers.<br>
><br>
><br>
><br>
> > Thanx.<br>
> ><br>
> > Jon<br>
> ><br>
> > _______________________________________________<br>
> > kwlug-disc mailing list<br>
> > To unsubscribe, send an email to <a href="mailto:kwlug-disc-leave@kwlug.org" target="_blank">kwlug-disc-leave@kwlug.org</a><br>
> > with the subject "unsubscribe", or email<br>
> > <a href="mailto:kwlug-disc-owner@kwlug.org" target="_blank">kwlug-disc-owner@kwlug.org</a> to contact a human being.<br>
><br>
><br>
><br>
><br>
> _______________________________________________<br>
> kwlug-disc mailing list<br>
> To unsubscribe, send an email to <a href="mailto:kwlug-disc-leave@kwlug.org" target="_blank">kwlug-disc-leave@kwlug.org</a><br>
> with the subject "unsubscribe", or email<br>
> <a href="mailto:kwlug-disc-owner@kwlug.org" target="_blank">kwlug-disc-owner@kwlug.org</a> to contact a human being.<br>
<br>
_______________________________________________<br>
kwlug-disc mailing list<br>
To unsubscribe, send an email to <a href="mailto:kwlug-disc-leave@kwlug.org" target="_blank">kwlug-disc-leave@kwlug.org</a><br>
with the subject "unsubscribe", or email<br>
<a href="mailto:kwlug-disc-owner@kwlug.org" target="_blank">kwlug-disc-owner@kwlug.org</a> to contact a human being.<br>
</blockquote></div>