Port knocking through NAT for self-hosted server

Question

I decided to move to self-hosting because it is cheaper.

What I want to host:

• My personal website
• Some apps for fun
• Maybe later a Honeypot

I have my old laptop acting as the main host. It has Ubuntu installed with virtualbox.

What I plan to do is create a VM on the main host. For the OS I think it will be Alpine Linux or another Ubuntu (advice for which one is better ?).

I plan the harden it as much as possible (fail2ban, apparmor etc.).

I plan to have a docker for every app inside the VM. The access for different apps will be through host header forwarding and nginx.

Now for the big question which is networking. I plan to use the bridge mode virtual box to the VM (is it the best choice ? Maybe switch to NAT network ?)

On my router admin page I can activate the NAT and create rules:

80, PUBLIC IP  ===> 80, VM IP
443, PUBLIC IP ===> 443, VM IP
22, PUBLIC IP ===> 22, VM IP 

Even though I allow authentication only through pub key and private key, I am still worried about port 22 being exposed.

I want to implement port knocking. Assume I chose 1000, 2000, 3000 as the sequence. My VM won't even know someone knocked because everything (except 443 and 80) is blocked by my router NAT ...

I though about creating more NAT rules in my router but this is visible to attackers: they just need to try 3!=6 permutation before finding the correct sequence ...

Any recommendation or critiques about hardening are very appreciated.

Answer 1

Exposing port 22 is not such a big deal if you are going to use Fail2ban. An attacker only has a limited number of attempts until their IP address gets blocked. And brute forcing for passwords is not going to work if you only allow key authentication anyway.

There is not much value in throwing port knocking in your setup. To limit your attack surface you should close (at firewall level) ports that are not needed. Probably you just need to expose ports 80 and 443 for your apps. Your Docker containers do not have to be exposed directly to the Internet. You can put a reverse proxy as a front which can also act as a WAF (web application firewall).

But if I'm reading this right, by self-hosted you mean in your own home. Then you don't even need to expose the SSH port on the Internet since you have direct access to the machine. The port just needs to be exposed within your LAN or on the host machine itself.

As for the VM networking, I feel like there is no right answer, this is a matter of convenience and how your current LAN is set up.