Is it safe to open a server application on the internal network to the public internet

Question

I am a programmer but I am currently learning about web development in general. I'm creating a server on my local host using nodejs and express. It's available on my local host but I want to test it with a domain I have, so I can access it from any device anywhere.

What I decided to do was change my router settings to direct any traffic it gets on its IP to my computers internal IP on port 3000 so anyone can access the my html pages from my local machine. This was working quite well.

But after some hours of working Bitdefender Antivirus alerted that It blocked some attacks from a specific IP on port 3000. This lead me to question how safe It was to be doing this. The server is running on my home machine that has my regular files and documents.

Of course I'm only serving the html pages for the site but can someone kindly explain the security implications of using your regular home router as a server as opposed to a dedicated server or a web hosting service.

Note 1: I'm not interested in other aspects such as bandwidth since that's not going to be a problem.

Note 2: Also I'm using Netlify's free web hosting right now as an alternate (or instead of the alternate) but it's god awfully slow to load my simplest html page. It takes a while (inconsistent as well) before the browser can even resolve the domain and then loads the content progressively slowly ( I mean you see things like the main image slowly reveal). when using my own router it's blazingly fast; not just on my local machine

Answer 1

Like everything, it is partly safe and partly risky.

It's safe because your application is the only thing other people can get access to.

It's also unsafe because other people can get access to your application.

If there's a security bug in your application, it might allow people to get access to things they're not supposed to access.

You say that your application only serves HTML files. There's not much that can go wrong in that case, but I can still think of one thing. If I (a web browser) ask your application for /index.html, I guess it will send me the file C:\Users\Brian\Documents\apps\test\index.html. What happens if I ask for ../../credit card.txt? Will it send me C:\Users\Brian\Documents\apps\test\..\..\credit card.txt a.k.a. C:\Users\Brian\Documents\credit card.txt? If it does, that is called a directory traversal attack. Maybe I can get your browser history and passwords that way. But if it just sends me a 404 page, then it's fine.

(Note: you couldn't test this just by going to http://localhost:3000/../../credit card.txt in a web browser - the browser will change it to http://localhost:3000/credit card.txt)

If you're confident that your program doesn't have any security bugs, then go ahead and open it up. If you're not confident, then don't.

Answer 2

It is not safe.

Simply port forwarding internet traffic to an application running in your local network essentially exposes your full internal network to some attacker in case of a bug in the application. And bugs are likely. If the server application is instead located at some hosting provider on the public internet it will not have access to your internal network.

If it is only about testing your application from outside or providing access to a few selected users you should at least add strong authentication with some proven setups, for example by using nginx as a reverse proxy. Or you could use solutions like ngrok for a more limited exposure of your internal application to the internet. You could also put the application into some container or VM with appropriate firewall rules so that it cannot access the internal network.