Security of port forwarding when the target is turned off

Question

I recently set up a server from an old computer case. I use docker to install and use different services on different ports and I would like to access some services from outside of my house.

I have a domain from namecheap and I set up dynamic dns which successfully sends my public IP to my domain periodically. Here’s the docker.

To reach different services on different ports with subdomains, I set up an nginx reverse proxy server with the help of a docker container. I only forwarded port 80 and port 443 from my router.

Now my setup works like a charm. Let’s say I want to reach service1 which is on port 2525, I go to service1.mydomain.com and my nginx server redirects me to localhost:2525

Here is where my concerns started; I shut down the server at nights. Even though it is shut down, when I ping service1.mydomain.com, it shows my home’s IP address. It doesn’t lead to anywhere on the browser, however, it can still be pinged.

• What problems can occur with this setup?
• Or does any problem occur at all?
• Can someone reach into my home network?

[Note that I use a standard router with low-level firewall. And although my IP is not static (I didn’t buy), it hasn’t changed in months as I observed.]

Answer 1

Pings from outside the network are handled by the router, that's why you are getting a response.

The inherent networking danger is if the IP that you forwarded to gets assigned to something else in your network that also has services on 80 and 443. This can happen if you have dynamic IPs in your network and IPs get reassigned (which is a daily possibility since you are turning the machine off every day).

A secondary danger is that you have a router with a public IP that responds to pings on port 80 and 443. That's going to get your router on many hacker lists and you will get scanned, probed, and tested quite a lot. I would look to blocking ICMP on the router, if you can, and even turning off the port forwarding, if it's convenient to do so (scripting, etc.).

The best case is to use a router that allows for multiple networks and set up your dev environment on the network that doesn't also have all your home equipment.

Otherwise, the port forwarding just goes to a machine that's turned off. There are no inherent networking dangers. But the dangers of a hacker discovering a flaw in your server and exploiting it are high using the server when its turned on.

Answer 2

Even though [the server] is shut down, when I ping service1.mydomain.com, it shows my home’s IP address.

Your router is the actual device using your public IP address, and it will respond when the server's name is pinged (since the server's name resolves to the router's public IP address).

If you turn off your router and manage some way to test without using the router to reach the Internet, you'll find your IP no longer responds to ping.