Proxy offsite to redirect traffic to home network machine

[bhogervorst]

Hello,

I have an idea for a network setup, as well as physical machines to do it with, but i'm having trouble wrapping my head around how to set it up and where even to start. Let me explain:

My friend would like to host a few small game servers but doesn't have the resources to have a server machine at his house. I happen to have some older enterprise grade systems, capable of what he needs. What i'd like to do, is setup the systems at my house as 24/7 servers, while allowing him to remotely access them and set them up as he wishes.

We've got all of that figured out and setup thus far, so here's where it becomes slightly more complicated. I don't want every one of his friends on Discord knowing my IP address and doing who knows what on a server hosted directly from my network. What I'd like to do is setup some kind of proxy server at his house, which will redirect traffic from his network to whatever server(s) he is using in my local network. So in short, I'd be managing the physical machines, while his network would be responsible for accepting and forwarding connection requests.

From what I understand, this can be done using a Squid Proxy Server, which I've worked with in the past. I've also seen people using NAT for this. I don't know the port forwarding and firewall details that need to be setup for this to work though.

Also, I should mention in case anyone asks; both my friend and I have sufficient upload/download bandwidth to do this. We won't be hosting a huge 1000+ player network or anything, this is just for fun and because why not! We both also have Dynamic External IP's. I know this adds complication, but it's something we're both fully willing to deal with regardless of the extra maintenance on both ends that's required.

So my question is:
How might I go about setting up what I've described here, and is it a viable solution?

Thanks for the feedback!
B

 

[bill001g]

A proxy in general only does web traffic you would need to use a vpn. If your router supports VPN server then his would need to run as a client or the reverse. He would access the game machines via the internal ip addresses. You would need to run dyndns on the server side or just manually change IP in the vpn config if the ip changes.

 

[bhogervorst]

A proxy in general only does web traffic you would need to use a vpn. If your router supports VPN server then his would need to run as a client or the reverse. He would access the game machines via the internal ip addresses. You would need to run dyndns on the server side or just manually change IP in the vpn config if the ip changes.

That makes complete sense now.

I could probably run something like OpenVPN on a small Linux computer like a Raspberry Pi at my friends house. I could then connect the client server at my house to the VPN server at his house using the VPN client software. But how would I go about making that VPN server at his house accessible to his friends, so they can connect to his servers?

 

[bill001g]

That is why it is better to use the router because all traffic must pass through it. You would have to put you vpn server in front of the router which is not so easy when you have wifi involved.

The vpn box needs to act as the router as well as the vpn for the lan users.

 

[failboat]

A proxy in general only does web traffic you would need to use a vpn. If your router supports VPN server then his would need to run as a client or the reverse. He would access the game machines via the internal ip addresses. You would need to run dyndns on the server side or just manually change IP in the vpn config if the ip changes.

That makes complete sense now.

I could probably run something like OpenVPN on a small Linux computer like a Raspberry Pi at my friends house. I could then connect the client server at my house to the VPN server at his house using the VPN client software. But how would I go about making that VPN server at his house accessible to his friends, so they can connect to his servers?

the easiest solution will be to let you put the servers at his house. if his internet can't handle it the vpn idea won't work.
renting servers isn't very expensive if you don't want to host it. a lot of them will price you based on your 95% use. so if you barely use it then the bill won't be bad. digital ocean is 1TB of transfer for $5 month with 1 core.

 

[androbourne]

A proxy in general only does web traffic you would need to use a vpn. If your router supports VPN server then his would need to run as a client or the reverse. He would access the game machines via the internal ip addresses. You would need to run dyndns on the server side or just manually change IP in the vpn config if the ip changes.

Correct but just remember that DYNDNS does not protect your public IP. All it does is give you a hostname mapped to the IP address. So all a user would need to do is ping the hostname to get the real IP address.

The only real way to do this would be to use a game server protection services. I believe Cloudflair has this and a few others vendors. Just look for "game server ddos protections" there are a few companies that do this. The way it works is that the service provider acts as a front man and uses their IP instead of yours for the public facing side and just passes down the traffic to your IP. However, with protections against attacks such as a DDOS.

The issue with using VPN etc... is that the game server would be using a VPN address which means slower connections and more hops on the public side for a user to even get connected to your game server. Especially if you don't have a good ISP connection. Your users on the server would have increased ping due to the increased hops and may lag. Also using something like a raspberry pi to make a VPN on the front end is still a bad idea, as if an attack was to come in, the raspberry pi would be the weakest link and first to die or by bypassed in an attack.

Even if you have a different front facing IP address (due to VPN enabled), it is still open to be attacked because you have no DDOS protection. One public IP would just filter down all traffic to your real public IP address. So it is still not very protected. Yes, they may not have your real IP but they wont need it, if all that is happening is IP to IP forwarding with no protection services enabled. Only way to do this truly is with a DDOS protection service.

This is why some times its better to use a service for hosting game servers instead of doing it yourself.

 

[bill001g]

I agree a hosting service tends to be the best option but i was just answering his question. It all depends on to what extent he can trust his friend to not give out the VPN information. The other people visiting should only see private IP behind the VPN. There only real indication that the server was not local was the longer latency. You would hope they would not be running DDOS attacks against these private ip while visiting someone but teenagers can be really really stupid sometimes.

 

[bhogervorst]

Okay, thanks everyone for all the feedback.

Unfortunately, this discussion landed on what always seems to be the go-to solution for server hosting: Purchasing a hosting service.
I have to emphasize here that neither my friend or I have the means to rent a hosting service to host the primary servers. This is why we would have just opted to host the servers at his house or mine, except for the risks involved with that.

I did try getting a server setup at his house, but was unsurprisingly met with an Apple Router which didn't want to portforward...another story for another day though.

After doing some research, I've kind of found something that might be a semi-viable option.
ovh.com has a hosting service that's relatively cheap per month (VPS SSD 1). If I could setup a VPN/proxy to redirect traffic from its IP to my network, that would be a good solution. The cost is acceptable, I just don't know how I would set it up or if it's possible.

So that's where i'm at right now, suggestions and help would be appreciated.
Thanks,
-B

 

[androbourne]

Okay, thanks everyone for all the feedback.

Unfortunately, this discussion landed on what always seems to be the go-to solution for server hosting: Purchasing a hosting service.
I have to emphasize here that neither my friend or I have the means to rent a hosting service to host the primary servers. This is why we would have just opted to host the servers at his house or mine, except for the risks involved with that.

I did try getting a server setup at his house, but was unsurprisingly met with an Apple Router which didn't want to portforward...another story for another day though.

After doing some research, I've kind of found something that might be a semi-viable option.
ovh.com has a hosting service that's relatively cheap per month (VPS SSD 1). If I could setup a VPN/proxy to redirect traffic from its IP to my network, that would be a good solution. The cost is acceptable, I just don't know how I would set it up or if it's possible.

So that's where i'm at right now, suggestions and help would be appreciated.
Thanks,
-B

Well just remember VPS is Virtual Private Server. So you will be hosting on their services. Not your own server at your house, and their cheap packages are very slow speced. Not suited for a gaming server. I do not believe they offer services like you are asking for (front IP by them and pushed down to your network). It appears they only offer protection to servers that are being hosted with them directly.

And when you account for gaming VPS. You would need to look here for the proper gaming server specs, which then starts getting more expensive. https://www.ovh.com/world/dedicated-servers/game/

This is what I was getting at. It's not easy hosting yourself. Trust me. I refused to host else where and have a custom PFSense router I created just for this reason, which has helped a lot in terms of protection but can only handle so much from a DDOS attack. I use OpenVPN on my PFSense router along with some hosting on Cloudflair to mask IPs of things like my game server, voice comms, website etc...

So it's not perfect but it can work.