To expose a home video service to the internet without opening local ports or bypassing CGNAT, the author recommends using a VPS with a reverse SSH tunnel. The home computer initiates the connection to the VPS, while Nginx on the server handles incoming HTTPS requests and forwards them through the tunnel to the local network.
A critical security risk in this setup is Server-Side Request Forgery (SSRF). If a web application accepts arbitrary URLs from a client, an attacker can force the server to make requests to internal network resources, such as routers or other local devices, effectively using the server as a proxy to bypass internal security boundaries.
To mitigate these risks, the author suggests using an allowlist for backend URLs instead of accepting client-provided addresses. Additionally, all services, including REST APIs and HLS streams, should require server-side authentication for every request. Public exposure should be limited to a single HTTPS 443 port on the VPS, with all internal services bound strictly to the loopback interface (127.0.0.1).
For SSH tunnel security, it is advised to use a dedicated user account with restricted permissions. Using the 'permitlisten' directive in 'authorized_keys' limits the tunnel to specific ports, preventing unauthorized access. Furthermore, the tunnel should be managed by scripts that track process IDs to ensure it can be reliably stopped, rather than relying on closing terminal windows.
Regular verification of network states is essential. Tools like 'Get-NetTCPConnection' or 'ss' should be used to confirm that services are listening only on 127.0.0.1. If a security compromise is suspected, the author recommends revoking SSH keys, terminating active sessions, and rotating application passwords immediately.
