I would like to set up a very simple node.js web application on raspberry pi and access it remotely, from outside the LAN.

There are no other hosts in that LAN with the Raspberry. I only need to access the web application from single location which has static IP assigned by ISP.

Is it possible to configure a firewall on a basic router with 'deny all, allow x' type of filter, x being my static IP? Also, is this security measure enough?

Please feel free to recommend ways of maximizing the security of my project.

closed as too broad by CaffeineAddiction, ThoriumBR, Xander, Rory Alsop Jun 19 '18 at 18:14

Please edit the question to limit it to a specific problem with enough detail to identify an adequate answer. Avoid asking multiple distinct questions at once. See the How to Ask page for help clarifying this question. If this question can be reworded to fit the rules in the help center, please edit the question.

  • Yes, you can configue a firewall to only allow traffic between two static IP addresses. that's pretty much the simplest config you can do. As for "maximizing the security of my project" it's impossible: security is about tradoff. Without meaningful detail, the answer to that is "don't turn it on, don't plug it it" – Stephane Jun 12 '18 at 7:41

Relaying purely on IP address to perform authorization is a bad idea. IP address can be spoofed.

Rather than attempting to verify user from the server, you should let the user prove to the server that they are authorized. This can be done by using simple login and password system. If you feel like this is not good enough you could always add 2NF. Here is a tutorial on how to implement 2NF in node.js, through bare it in mind that this is the first tutorial which I found on google. As it seems from this tutorial it should be relatively easy for you to implement 2NF for you application, and could result in higher security.

Another reason for why not to limit by IP address is, assume that the network from ISP goes down, or you are too far away from the network with specific IP and you must perform some action on the Raspberry. If you do authorization you could perform this action from the phone using mobile data. If you however block all different IP addresses, then your life will become harder in such situations, where this idea provides not enough security as the IP address can be spoofed.

While this post is based on PHP login system, I believe that the principles given there may be also useful for you.

  • Thank you, two-factor authentication is a great idea. I will look forward trying to implement it! – Bontano Jun 12 '18 at 7:57

Not the answer you're looking for? Browse other questions tagged or ask your own question.