I am behind a NAT, but I have a single RPi 3 running on a public IP. Now
I found that to use a specific application properly on my Windows laptop
I would need to have it on a public IP occasionally, so some clients
could connect to it.
Is there a way to make some sort of port forwarding from the Raspberry
(which has both a publich eth0 IP and a private wlan0 IP) to my Windows
machine via an app on the Raspberry? I tried with miniupnpc, but it
demands a router that can be set to forward ports, and my ISP doesn't
like that.

kyonshi <gmkeros@gmail.com> wrote:
> I am behind a NAT, but I have a single RPi 3 running on a public IP. Now
> I found that to use a specific application properly on my Windows laptop
> I would need to have it on a public IP occasionally, so some clients
> could connect to it.
> Is there a way to make some sort of port forwarding from the Raspberry
> (which has both a publich eth0 IP and a private wlan0 IP) to my Windows
> machine via an app on the Raspberry? I tried with miniupnpc, but it
> demands a router that can be set to forward ports, and my ISP doesn't
> like that.

If you're running SSH on the Pi on a public port you can make a port
forward. This tunnels port 1234 to port 4567 on the Windows machine:

ssh -L 1234:windows-pc.lan:4567 pi@raspberrypi.my.house

with windows-pc.lan and raspberrypi.my.house being the DNS names or IP
addresses of the machines concerned. Then you tell whatever app you're
using to connect to localhost port 1234. eg if the Windows box is running a
web app you're tell your browser to go to http://localhost:1234/

To do this you need to run SSH first, and the connection will go away once
the SSH session is closed.

You can also tunnel a SOCKS proxy:

ssh -D 3456 pi@raspberrypi.my.house

and then configure Windows / browser / etc to use the SOCKS proxy on
localhost port 3456. This will allow connection to all machines on your
network as if you were there.

It is also possible to have the Pi permanently port forward, but for that
you expose the Windows machine to every attacker on the internet. SSH is
designed for that and is probably more secure.

Another option is to run a VPN server on the Pi and connect to it via a VPN
client, which allows you into your home network. Wireguard is a simple and
efficient VPN, or OpenVPN has some ways to get around ISP blocking of VPNs.

Theo

On 2/5/2024 7:06 PM, Theo wrote:
> kyonshi <gmkeros@gmail.com> wrote:
>> I am behind a NAT, but I have a single RPi 3 running on a public IP. Now
>> I found that to use a specific application properly on my Windows laptop
>> I would need to have it on a public IP occasionally, so some clients
>> could connect to it.
>> Is there a way to make some sort of port forwarding from the Raspberry
>> (which has both a publich eth0 IP and a private wlan0 IP) to my Windows
>> machine via an app on the Raspberry? I tried with miniupnpc, but it
>> demands a router that can be set to forward ports, and my ISP doesn't
>> like that.
>
> If you're running SSH on the Pi on a public port you can make a port
> forward. This tunnels port 1234 to port 4567 on the Windows machine:
>
> ssh -L 1234:windows-pc.lan:4567 pi@raspberrypi.my.house
>
> with windows-pc.lan and raspberrypi.my.house being the DNS names or IP
> addresses of the machines concerned. Then you tell whatever app you're
> using to connect to localhost port 1234. eg if the Windows box is running a
> web app you're tell your browser to go to http://localhost:1234/
>
> To do this you need to run SSH first, and the connection will go away once
> the SSH session is closed.
>
> You can also tunnel a SOCKS proxy:
>
> ssh -D 3456 pi@raspberrypi.my.house
>
> and then configure Windows / browser / etc to use the SOCKS proxy on
> localhost port 3456. This will allow connection to all machines on your
> network as if you were there.
>
>
> It is also possible to have the Pi permanently port forward, but for that
> you expose the Windows machine to every attacker on the internet. SSH is
> designed for that and is probably more secure.
>
> Another option is to run a VPN server on the Pi and connect to it via a VPN
> client, which allows you into your home network. Wireguard is a simple and
> efficient VPN, or OpenVPN has some ways to get around ISP blocking of VPNs.
>
> Theo

Cool, thanks, I will try that out and see if it works.

On 2/5/24 12:40 PM, kyonshi wrote:
> I am behind a NAT, but I have a single RPi 3 running on a public IP. Now
> I found that to use a specific application properly on my Windows laptop
> I would need to have it on a public IP occasionally, so some clients
> could connect to it.
> Is there a way to make some sort of port forwarding from the Raspberry
> (which has both a publich eth0 IP and a private wlan0 IP) to my Windows
> machine via an app on the Raspberry? I tried with miniupnpc, but it
> demands a router that can be set to forward ports, and my ISP doesn't
> like that.

IF you can get it, spend a few extra $$$ on a static IP.
Makes things a LOT easier.

To deal with dynamic IPs ... first off there are $$$
services. Basically they monitor your real IP, then
update DNS servers to match per change.

However I don't like paying extra $$$, or giving
commercial entities too much access/info.

So, I wrote a little Python sockets daemon that
polls for a coded packet from the dest - plus
one for the dest that detects an IP change and
sends it on via the tiny packet over a selected
port. The client polls this port, and uses the
packet to update the current IP address. A
'personal' version of DDNS utils. Not 'public'
however, no providers DNS nums are changed. COULD
be in theory though ...

If I can find it in The Mess I could post the
daemon/poller code. Not very flexible, but
it worked ok for years. Thing is, the desired
target for the IP daemon WAS a static IP. For
broader use you'd have to have the same or
post the info elsewhere (a provider acct
that offers ssh access to a file maybe.

On Tue, 6 Feb 2024 00:51:21 -0500
"68g.1499" <68g.1499@etr6.net> wrote:

> To deal with dynamic IPs ... first off there are $$$
> services. Basically they monitor your real IP, then
> update DNS servers to match per change.

There are free DNS services that support dynamic DNS (eg he.net),
and most domain registrars provide DNS with the domain including dynamic
entries.

--
Steve O'Hara-Smith
Odds and Ends at http://www.sohara.org/
For forms of government let fools contest
Whate're is best administered is best - Alexander Pope

On 2/6/24 3:38 AM, Ahem A Rivet's Shot wrote:
> On Tue, 6 Feb 2024 00:51:21 -0500
> "68g.1499" <68g.1499@etr6.net> wrote:
>
>> To deal with dynamic IPs ... first off there are $$$
>> services. Basically they monitor your real IP, then
>> update DNS servers to match per change.
>
> There are free DNS services that support dynamic DNS (eg he.net),
> and most domain registrars provide DNS with the domain including dynamic
> entries.

All the "big" services quit offering free versions
a long time ago. DynDNS was good. But now ... $$$

Obscure services, um ... don't want them in my boxes
and it was funner to kinda write my own.

On Wed, 7 Feb 2024 01:39:07 -0500
"68g.1499" <68g.1499@etr6.net> wrote:

> On 2/6/24 3:38 AM, Ahem A Rivet's Shot wrote:
> > On Tue, 6 Feb 2024 00:51:21 -0500
> > "68g.1499" <68g.1499@etr6.net> wrote:
> >
> >> To deal with dynamic IPs ... first off there are $$$
> >> services. Basically they monitor your real IP, then
> >> update DNS servers to match per change.
> >
> > There are free DNS services that support dynamic DNS (eg
> > he.net), and most domain registrars provide DNS with the domain
> > including dynamic entries.
>
> All the "big" services quit offering free versions
> a long time ago. DynDNS was good. But now ... $$$

no-ip is still around and still free, joined these days by dynu,
afraid.org, duckdns and clouddns all of which provide much the same service
as dyndns used to. If you have a domain registered then there's the
registrar and he.net.

> Obscure services, um ... don't want them in my boxes

The only thing that goes in your box is the daemon that registers
changes of IP address, many of them publish the details so you can write
your own.

> and it was funner to kinda write my own.

Fair enough that's always a good reason.

--
Steve O'Hara-Smith
Odds and Ends at http://www.sohara.org/
For forms of government let fools contest
Whate're is best administered is best - Alexander Pope

On 2024-02-07 07:39, 68g.1499 wrote:

>   Obscure services, um ... don't want them in my boxes
>   and it was funner to kinda write my own.

With duckdns you do that yourself (or they provide a simple script)

My crontab contains a script containing this (obfuscated)
Not very obscure

#!/bin/bash
domain=some.name.duckdns.org
token=xxxx-x-x-x-x-x-x-xxx
url="https://www.duckdns.org/update?domains=${domain}&token=${token}&ip="
echo url=${url} | curl -k -o /var/log/duck.log -K - 2> /dev/null
echo "$(date)" >/tmp/duckdns.log

--
/Björn

On 07/02/2024 07:19, Ahem A Rivet's Shot wrote:
> On Wed, 7 Feb 2024 01:39:07 -0500
> "68g.1499" <68g.1499@etr6.net> wrote:
>
>> On 2/6/24 3:38 AM, Ahem A Rivet's Shot wrote:
>>> On Tue, 6 Feb 2024 00:51:21 -0500
>>> "68g.1499" <68g.1499@etr6.net> wrote:
>>>
>>>> To deal with dynamic IPs ... first off there are $$$
>>>> services. Basically they monitor your real IP, then
>>>> update DNS servers to match per change.
>>>
>>> There are free DNS services that support dynamic DNS (eg
>>> he.net), and most domain registrars provide DNS with the domain
>>> including dynamic entries.
>>
>> All the "big" services quit offering free versions
>> a long time ago. DynDNS was good. But now ... $$$
>
> no-ip is still around and still free, joined these days by dynu,
> afraid.org, duckdns and clouddns all of which provide much the same service
> as dyndns used to. If you have a domain registered then there's the
> registrar and he.net.
>
>> Obscure services, um ... don't want them in my boxes
>
> The only thing that goes in your box is the daemon that registers
> changes of IP address, many of them publish the details so you can write
> your own.
>
>> and it was funner to kinda write my own.
>
> Fair enough that's always a good reason.
>

afraid.org works very well for $0

I have a script called by cron every 15mins

#! /bin/bash

wget -O - http://freedns.afraid.org/dynamic/update.php?<some_magic_UID>
>> /tmp/afraid_dns.log 2>& 1

In message <20240207071904.4821f2362f045ff803d62b57@eircom.net>
Ahem A Rivet's Shot <steveo@eircom.net> wrote:

> On Wed, 7 Feb 2024 01:39:07 -0500 "68g.1499" <68g.1499@etr6.net> wrote:
>
> > On 2/6/24 3:38 AM, Ahem A Rivet's Shot wrote:
> > > On Tue, 6 Feb 2024 00:51:21 -0500 "68g.1499" <68g.1499@etr6.net> wrote:
> > >
> > > > To deal with dynamic IPs ... first off there are $$$
> > > > services. Basically they monitor your real IP, then
> > > > update DNS servers to match per change.
> > >
> > > There are free DNS services that support dynamic DNS (eg he.net), and
> > > most domain registrars provide DNS with the domain including dynamic
> > > entries.
> >
> > All the "big" services quit offering free versions
> > a long time ago. DynDNS was good. But now ... $$$
>
> no-ip is still around and still free

.... and I use it successfully. Also dynv6.com for IPv6 DDNS (I have two
entries).

David

On 2/7/24 3:55 PM, mm0fmf wrote:
> On 07/02/2024 07:19, Ahem A Rivet's Shot wrote:
>> On Wed, 7 Feb 2024 01:39:07 -0500
>> "68g.1499" <68g.1499@etr6.net> wrote:
>>
>>> On 2/6/24 3:38 AM, Ahem A Rivet's Shot wrote:
>>>> On Tue, 6 Feb 2024 00:51:21 -0500
>>>> "68g.1499" <68g.1499@etr6.net> wrote:
>>>>
>>>>>      To deal with dynamic IPs ... first off there are $$$
>>>>>      services. Basically they monitor your real IP, then
>>>>>      update DNS servers to match per change.
>>>>
>>>>     There are free DNS services that support dynamic DNS (eg
>>>> he.net), and most domain registrars provide DNS with the domain
>>>> including dynamic entries.
>>>
>>>     All the "big" services quit offering free versions
>>>     a long time ago. DynDNS was good. But now ... $$$
>>
>>     no-ip is still around and still free, joined these days by dynu,
>> afraid.org, duckdns and clouddns all of which provide much the same
>> service
>> as dyndns used to. If you have a domain registered then there's the
>> registrar and he.net.
>>
>>>     Obscure services, um ... don't want them in my boxes
>>
>>     The only thing that goes in your box is the daemon that registers
>> changes of IP address, many of them publish the details so you can write
>> your own.
>>
>>>     and it was funner to kinda write my own.
>>
>>     Fair enough that's always a good reason.
>>
>
> afraid.org works very well for $0
>
> I have a script called by cron every 15mins
>
> #! /bin/bash
>
> wget -O - http://freedns.afraid.org/dynamic/update.php?<some_magic_UID>
> >> /tmp/afraid_dns.log 2>& 1
>

DO gloss over the source code, just in case :-)

I'm inclined to NOT trust 3rd-party daemons
these days. If anyone is offering $0 services,
well, HOW do they stay in biz ???

BTW, the code needed for a dynamic DNS daemon
should be quite SHORT. I know this because I've
writ my own more than once. If your "free" service
is hundreds or thousands of lines then BEWARE.

Just sayin'

On 2024-02-09 10:14, 68g.1502 wrote:

>> I have a script called by cron every 15mins
>>
>> #! /bin/bash
>>
>> wget -O -
>> http://freedns.afraid.org/dynamic/update.php?<some_magic_UID>  >>
>> /tmp/afraid_dns.log 2>& 1
>>
>
>   DO gloss over the source code, just in case  :-)
>

Gloss over wget's source code?
Because that is the only one mentioned here. no daemons, just plain
wget. And I got an example with curl. Installed by the OS

--
/Björn

On 09/02/2024 09:30, Björn Lundin wrote:
> On 2024-02-09 10:14, 68g.1502 wrote:
>
>>> I have a script called by cron every 15mins
>>>
>>> #! /bin/bash
>>>
>>> wget -O -
>>> http://freedns.afraid.org/dynamic/update.php?<some_magic_UID>  >>
>>> /tmp/afraid_dns.log 2>& 1
>>>
>>
>>    DO gloss over the source code, just in case  :-)
>>
>
> Gloss over wget's source code?
> Because that is the only one mentioned here. no daemons, just plain
> wget. And I got an example with curl. Installed by the OS
>
>
>
>

I blocked the nym changing troll sometime back. At first I thought it
was someone's AI experiment. But it's too full of shit and wrong so much
of the time that even AI isn't that dumb.

On 2/9/24 5:00 AM, mm0fmf wrote:
> On 09/02/2024 09:30, Björn Lundin wrote:
>> On 2024-02-09 10:14, 68g.1502 wrote:
>>
>>>> I have a script called by cron every 15mins
>>>>
>>>> #! /bin/bash
>>>>
>>>> wget -O -
>>>> http://freedns.afraid.org/dynamic/update.php?<some_magic_UID>  >>
>>>> /tmp/afraid_dns.log 2>& 1
>>>>
>>>
>>>    DO gloss over the source code, just in case  :-)
>>>
>>
>> Gloss over wget's source code?
>> Because that is the only one mentioned here. no daemons, just plain
>> wget. And I got an example with curl. Installed by the OS
>>
>>
>>
>>
>
> I blocked the nym changing troll sometime back. At first I thought it
> was someone's AI experiment. But it's too full of shit and wrong so much
> of the time that even AI isn't that dumb.

Feelings of inadequacy dude ? :-)

Wget and the daemons for dynDNS and friends are very
different things BTW.

And hmmmm ... when IS the last time anyone actually
DID look-over wget's source code ??? The best place
to hide evil is inside something deemed "old and
reliable" .....

On Fri, 9 Feb 2024 20:41:11 -0500
"68g.1503" <68g.1504@exr3.net> wrote:

> Wget and the daemons for dynDNS and friends are very
> different things BTW.

No they are not - every dynamic dns service I know of updates in
essentially the same way, you make an http(s) request with the domain, an
authentication key and optionally the IP address (otherwise it uses the
source). Usually curl or wget is used to make the request, it is good
practice to minimise the requests by checking for IP changes but not
necessary. My ddns daemon looks like this:

#!/bin/sh
old_external=''
while true
do
external_ip=`fetch -q -o - http://ifconfig.me/ip`
if [ "$external_ip" -a "$old_external" != "$external_ip" ]
then
curl -s -4 "https://<HOST>:<KEY>@dyn.dns.he.net/nic/update?hostname=<HOST>"
fi
sleep 30
done

--
Steve O'Hara-Smith
Odds and Ends at http://www.sohara.org/
For forms of government let fools contest
Whate're is best administered is best - Alexander Pope

Ahem A Rivet's Shot wrote:

> every dynamic dns service I know of updates in essentially the same
> way, you make an http(s) request with the domain, an authentication
> key and optionally the IP address

And then there are DNS providers which accept RFC1996 compliant NOTIFY
transactions, rather than rolling their own ...

On Sat, 10 Feb 2024 07:40:58 +0000
Andy Burns <usenet@andyburns.uk> wrote:

>
> Ahem A Rivet's Shot wrote:
>
> > every dynamic dns service I know of updates in essentially the same
> > way, you make an http(s) request with the domain, an authentication
> > key and optionally the IP address
>
> And then there are DNS providers which accept RFC1996 compliant NOTIFY
> transactions, rather than rolling their own ...

That's for relaying updates from master to slave DNS servers not
for announcing a change of dynamic IP to the master.

--
Steve O'Hara-Smith
Odds and Ends at http://www.sohara.org/
For forms of government let fools contest
Whate're is best administered is best - Alexander Pope

On 2024-02-10 02:41, 68g.1503 wrote:
>   And hmmmm ... when IS the last time anyone actually
>   DID look-over wget's source code ??? The best place
>   to hide evil is inside something deemed "old and
>   reliable" .....

Are you saying you are looking into EVERY package's source code you
download via apt BEFORE you install it?
Or are you saying that one should do it?

Sounds bit hysterical to me.

You do know that both wget and curl are provided by debian based (and
most other ) distribution via their repository tool ?

If you don't trust your distribution, you should switch, or roll your
own distribution.
But then - I guess you have lots of work ahead of you verifying/looking
over source code ...

--
/Björn

On 10/02/2024 10:47, Björn Lundin wrote:
> On 2024-02-10 02:41, 68g.1503 wrote:
>>    And hmmmm ... when IS the last time anyone actually
>>    DID look-over wget's source code ??? The best place
>>    to hide evil is inside something deemed "old and
>>    reliable" .....
>
> Are you saying you are looking into EVERY package's source code you
> download via apt BEFORE you install it?
> Or are you saying that one should do it?
>
> Sounds bit hysterical to me.
>
> You do know that both wget and curl are provided by debian based (and
> most other ) distribution via their repository tool ?
>
> If you don't trust your distribution, you should switch, or roll your
> own distribution.
> But then - I guess you have lots of work ahead of you verifying/looking
> over source code ...
>
Not hard to build a simple wget clone using libcurl

--
“It is hard to imagine a more stupid decision or more dangerous way of
making decisions than by putting those decisions in the hands of people
who pay no price for being wrong.”

Thomas Sowell

On Sat, 10 Feb 2024 10:56:05 +0000
The Natural Philosopher <tnp@invalid.invalid> wrote:

> Not hard to build a simple wget clone using libcurl

Well yes libcurl does all the work.

--
Steve O'Hara-Smith
Odds and Ends at http://www.sohara.org/
For forms of government let fools contest
Whate're is best administered is best - Alexander Pope

On 2024-02-10 11:56, The Natural Philosopher wrote:
> On 10/02/2024 10:47, Björn Lundin wrote:
>> On 2024-02-10 02:41, 68g.1503 wrote:
>>>    And hmmmm ... when IS the last time anyone actually
>>>    DID look-over wget's source code ??? The best place
>>>    to hide evil is inside something deemed "old and
>>>    reliable" .....
>>
>> Are you saying you are looking into EVERY package's source code you
>> download via apt BEFORE you install it?
>> Or are you saying that one should do it?
>>
>> Sounds bit hysterical to me.
>>
>> You do know that both wget and curl are provided by debian based (and
>> most other ) distribution via their repository tool ?
>>
>> If you don't trust your distribution, you should switch, or roll your
>> own distribution.
>> But then - I guess you have lots of work ahead of you
>> verifying/looking over source code ...
>>
> Not hard to build a simple wget clone using libcurl

Of course not - but I was referring to that if you don't trust the
binaries from your distribution, then you'd need to check ALL source code.
Not only wget/curl - but everything from kernel all the way to web browsers

Either you trust your distribution or not.

--
/Björn

On Sat, 10 Feb 2024 19:37:04 +0100
Björn Lundin <bnl@nowhere.com> wrote:

> Of course not - but I was referring to that if you don't trust the
> binaries from your distribution, then you'd need to check ALL source code.
> Not only wget/curl - but everything from kernel all the way to web
> browsers

Do all that and you are *still* open to Ken Thompson's attack via a
poisoned compiler.

--
Steve O'Hara-Smith
Odds and Ends at http://www.sohara.org/
For forms of government let fools contest
Whate're is best administered is best - Alexander Pope

On 2024-02-10 20:12, Ahem A Rivet's Shot wrote:
> On Sat, 10 Feb 2024 19:37:04 +0100
> Björn Lundin <bnl@nowhere.com> wrote:
>
>> Of course not - but I was referring to that if you don't trust the
>> binaries from your distribution, then you'd need to check ALL source code.
>> Not only wget/curl - but everything from kernel all the way to web
>> browsers
>
> Do all that and you are *still* open to Ken Thompson's attack via a
> poisoned compiler.
>

Well, verifying gcc sources could be included in the above - 'between
kernel and web browser'. At least if you are installing compilers

--
/Björn

On Sat, 10 Feb 2024 23:13:20 +0100
Björn Lundin <bnl@nowhere.com> wrote:

> On 2024-02-10 20:12, Ahem A Rivet's Shot wrote:
> > On Sat, 10 Feb 2024 19:37:04 +0100
> > Björn Lundin <bnl@nowhere.com> wrote:
> >
> >> Of course not - but I was referring to that if you don't trust the
> >> binaries from your distribution, then you'd need to check ALL source
> >> code. Not only wget/curl - but everything from kernel all the way to
> >> web browsers
> >
> > Do all that and you are *still* open to Ken Thompson's attack
> > via a poisoned compiler.
> >
>
> Well, verifying gcc sources could be included in the above - 'between
> kernel and web browser'. At least if you are installing compilers

The point of Ken Thomson's attack is that you have to compile those
gcc sources and that compiler can poison the binary you produce from the
clean gcc sources. So inspecting sources doesn't help you.

--
Steve O'Hara-Smith
Odds and Ends at http://www.sohara.org/
For forms of government let fools contest
Whate're is best administered is best - Alexander Pope

On 11/02/2024 05:17, Ahem A Rivet's Shot wrote:
> On Sat, 10 Feb 2024 23:13:20 +0100
> Björn Lundin <bnl@nowhere.com> wrote:
>
>> On 2024-02-10 20:12, Ahem A Rivet's Shot wrote:
>>> On Sat, 10 Feb 2024 19:37:04 +0100
>>> Björn Lundin <bnl@nowhere.com> wrote:
>>>
>>>> Of course not - but I was referring to that if you don't trust the
>>>> binaries from your distribution, then you'd need to check ALL source
>>>> code. Not only wget/curl - but everything from kernel all the way to
>>>> web browsers
>>>
>>> Do all that and you are *still* open to Ken Thompson's attack
>>> via a poisoned compiler.
>>>
>>
>> Well, verifying gcc sources could be included in the above - 'between
>> kernel and web browser'. At least if you are installing compilers
>
> The point of Ken Thomson's attack is that you have to compile those
> gcc sources and that compiler can poison the binary you produce from the
> clean gcc sources. So inspecting sources doesn't help you.
>
Obviously one must write one's own compiler!

A mere snap for any greybeard unix sysadmin...

--
“It is hard to imagine a more stupid decision or more dangerous way of
making decisions than by putting those decisions in the hands of people
who pay no price for being wrong.”

Thomas Sowell