1

I have a webserver running inside my private network and not exposed to the internet. I'd like to securely talk to this webserver from my mobile phone over the internet.

However, this webserver has no security on it whatsoever, and since I lack the confidence/expertise to implement security features myself, I don't want to expose it directly to the internet.

I thought maybe I could run something like nginx on a different machine (or maybe just different port on the same machine?) and route secure, authenticated requests to the dumb webserver. The firewall could be set so that the only IP address capable of talking to the dumb webserver was nginx.

Is this a common/reasonable/secure setup?

What would it probaby look like in practice? Would the phone be presented with a user/pass dialog before getting to talk to my webserver? Better yet, would it be possible for me to install some kind of certificate on the phone to make this magically work in (android) chrome without a password?

Thanks!

1
  • 2
    Thanks for the suggestion drewbenn, but unfortunately in my case that seems difficult, since this is an interactive webapp with a lot of different request types. I'm initially going to try the nginx reverse proxy suggested by Jonathan below, and then maybe the vpn if that doesn't work out.
    – E_G
    Commented Apr 23, 2016 at 5:50

1 Answer 1

1

A few ways.

Option 1:

A proxy server with authentication.

Phone -> proxy (check auth like basic auth if using https proxy, if not https proxy then no real security gain) -> internal-web-server

We use these in corporations. You set an automatic proxy file (pac) on your phone to route requests to your domain web page through the proxy and the rest direct.

But proxy on cellular is tough.

Option 2:

Setup nginx with reverse proxy settings, and https, and require basic auth. Then you'd not need to mess with pac files.

Option 3: install openvpn on the server and the client on your phone.

Option 4: install an ssh client on your phone, ssh to your home server and forward the web port.

Good luck

4
  • It sounds like he hasn't hardened his webserver at all, so the concern goes beyond just authentication and authorization. Option 1 doesn't address that. Option 2 may work, but then you have to secure your nginx setup. Option 3 or 4 is probably the best options. The only issue I see with option 4 though is that there's not a lot of software for android (that I know of) that is capable of doing this (including auto-reconnect after SSH fails when you move across networks). A mobile VPN is a specifc type of VPN for mobile devices. This is not an easy thing to do. No great solution.
    – Daisetsu
    Commented Apr 23, 2016 at 5:59
  • Thanks @Daisetsu. This all makes sense. You're right that my webserver is not hardened at all. I guess I've mainly been asking about option 2 because I want to learn about how difficult it is to secure nginx. I don't want to defend against numerous password attempts from strange IP addresses, but thought if I put some kind of certificate on my phone it might work. But I'm still unsure how that setup looks.
    – E_G
    Commented Apr 23, 2016 at 6:04
  • That's true. You need to harden the nginx and os and all the other requirements. This isnt a comprehensive question and i should caution not a comprehensive answer. Just the various high level options.
    – Jonathan
    Commented Apr 23, 2016 at 6:06
  • Client cert verification. Ask a new question but definitely possible. Also a 256 bit password will get you just as secure.
    – Jonathan
    Commented Apr 23, 2016 at 6:09

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .