Wow, I didn’t expect anyone to actually answer the questions, but it is very very appreciated. Thanks a lot for taking the time to do so.
Both. Access from the internet to your devices is protected from your Router. You should only ever open ports to things you want to access outside of your house.
Ok, good. So the firewall is already configured to block everything as far as I know, except for what I explicitly allow which for the time being is only my torrent client on two different machines (randomized ports).
In a homelab setting, I believe what I want to do is expose one port to a reverse proxy and redirect traffic to local services from there. But this is one of the things that I am uncertain about because I don’t entirely understand how this works. In my head: I open port 8080 where e.g. Nginx Proxy Manager listens. This is the only port anyone can gain access to anything inside my home network, and the proxy manager will say “Hey, this traffic should be redirected to port 8096 and this traffic should go to 4533”, but no direct connections to these ports can be made from outside my own network as they are not exposed. I am vulnerable only to the extent that there is an exploit in the proxy manager itself or the services. I intend to run all services in Docker containers, so they should not have access to anything else on the server, and the volumes that are mounted are ideally read-only (but that cannot always be the case). It sounds safe enough, but again, since I am not entirely certain that my understanding is correct, there might be a massive gaping hole somewhere I am unaware of.
Is it a private IP Address you use to access (IE 192.168.0.1 or is it some other thing?) If it’s a private IP address, that’s standard and is no problem. I’ve never heard of logging into something like a public website to open ports on your router.
No, it is wifi.myisp.tld. It seems to require being connected to the WiFi to work. If I’m connected to a VPN or through mobile, it will give me an error. With my previous ISP, it was a simple login with username and password with a SMS 2FA. I never attempted to login from elsewhere then, so it might’ve been likewise protected. In any case, they do it like this so that less tech-savvy people can have the support perform any necessary changes on their behalf instead of trying to guide them by phone through the local web interface. So it can be accessed without being connected to the WiFi, but I guess there are larger problems if the ISPs system has been compromised to allow this somehow.
Yes, if they support it. This is what I do and that’s exactly what’s it’s for. Sure but this would give them access to your Providers firewall, which you have your own firewall plugged into so it doesn’t matter. You will still be protected by your self provided firewall, some things will stop working (you’ll be double NATed so public services might not work) and it’ll be a clue someone changed something on your Providers firewall.
Yeah, they support bridge mode. So is this essentially enabling free flow of traffic through and completely trusting the secondary router I provide myself? And if someone then disabled bridge mode in the online interface (again assuming that this would be possible), I am not exposed as long as I have my own router following the provider’s router?
So, if you open port TCP 443 and have Nginx or a website answering requests, you now need to make sure this is as secure as possible. ANYONE ANYWHERE can talk to it.
What happens if I have a port open that nothing is listening to? Is that a security concern? For example, the ports to my torrent clients when I am not using the torrent client.
A side point is, if it’s just you that needs access to it, consider a VPN (wireguard) or overlay network (tailscale) so you only need to open one port and that will give you access to everything you need in your network.
As I mentioned above, I am considering a reverse proxy, which to my understanding also limits the number of ports open to 1. How does that compare securitywise in your opionin?