如何在路由器上进行端口转发

It is important to note that SSH uses port 22, and that port is specifically reserved for that use. Other applications (like Minecraft) have staked out such a strong claim they have functionally reserved their ports, though there isn’t anything officially requiring it. You may occasionally find that you have multiple things trying to use the same port. Remember, there are literally tens of thousands of different ports freely available to use, so just pick another one and use that instead.

But before you go opening up all sorts of ports, hosting every single service you can imagine, take some time to review your security practices. Most are fairly simple to get started with, and they can save you a huge headache later.

Security Precautions for Port Forwarding

If you’re port forwarding, you obviously intend for something to be accessible from the Internet. Any time you open up a port you increase your “attack surface.” It is always best to take some preventative measures to mitigate your risk. This isn’t an exhaustive list of things you can do to protect yourself — for that we’d need to write multiple novels — but it is a place to start.

Don’t Run Servers As Admin or Root

It doesn’t matter if you’re hosting a server on Windows, Linux, or any other operating system. Do not use the administrator or root account to host things that are exposed to the Internet. The administrative or root accounts have few (if any) restrictions placed on them. They can perform any operation on your system.

If there is some problem with the service you’re running — like a misconfiguration, bug, or an exploit — administrative or root access dramatically increases the amount of damage that can be done by a malicious attacker. It may even allow someone to compromise other devices attached to your network.

If you use a regular account you’re much less vulnerable — any attacker that gains access to your system will probably also need some kind of privilege escalation exploit to really cause harm.

Disable Root Login Over SSH

If you’re hosting on Linux, you should completely disable root login over SSH. The root user has unlimited access to everything on the system, which makes it a tempting target for would-be evildoers.

Additionally, there is really nothing to be gained by using it, since sudo allows users to execute commands as if they were the root user. Sudo permissions can even be modified on a user-by-user basis, so if you wanted to create a more restricted sudo account to perform basic server administration you could.

You Can Change Your Ports, But Don’t Rely On It

You’ll sometimes encounter the suggestion that you shouldn’t use the default ports for anything you’re hosting. The idea behind this is simple: If someone is scanning IP blocks for specific open ports they want to target, changing the port might reduce the chances that someone will attempt to access your server.

For example, you could change the SSH port from 22 to something like 7281.

Is that effective? Only sorta — it’ll certainly reduce the number of automated hits you take from script kiddies (amateur would-be hackers that use prebuilt software or scripts), and there will subsequently be fewer things in your logs to review. However, it won’t do anything to deter a serious targeted attack by someone knowledgeable.

Security through obscurity isn’t a guarantee, and you should never rely on it to keep your system safe.

Install Fail2Ban on Linux Servers

Fail2Ban is software designed to help secure your server against brute-force attacks. Fail2Ban can be configured to automatically reject connection attempts from any IP address that has tried and failed to log in to your server a certain number of times. Attackers can’t attempt to guess passwords more than a few times without being banned.

Fail2Ban can be set up with more complex behaviors too, so it is well worth learning if you plan on hosting on Linux.

Use Security Keys For SSH Whenever Possible

You should always pick a strong password for your administrative or root account, and any other account that you’ll log in to remotely. Fail2Ban and any other security measures you might enact will try to stop brute-force attacks, but they could fail. Use the strongest password possible.

If you’re using SSH, consider using SSH keys instead of a password. SSH keys are an example of public key cryptography — keys are generated in pairs, one public, and one private. The public key is placed on the computer that you’ll be remotely connecting to. You keep the other member of the pair, the private key, on your computer. When you try to connect, your private key is checked against the key on the server to provide authorization.

Windows, Linux, and MacOS all support SSH keys, so there isn’t much reason not to use them. SSH keys are more secure, and — once setup — every bit as convenient as a password.

Only Allow Connections from Whitelisted Addresses

You can also improve your security by limiting the connections that are allowed to your server. There are two basic ways to do this: a whitelist and a blacklist. A blacklist prohibits connections from specific people or applications. For example, if you know a hacker was attacking your Minecraft server, you might add their IP to a blacklist so it is always rejected. Alternatively, you can use a whitelist, which works the opposite way. Whitelists only allow pre-approved connections, and they can often be restricted to only allow access to a specific application or a specific port.

On Linux, use Universal Firewall (UFW) or FirewallD to create an OS-level whitelist. You can use whichever you prefer, though Debian distros (like Ubuntu) typically come with UFW, and RHEL distros (like Fedora) typically come with FirewallD. On Windows, open Windows Firewall and go to the “Inbound Traffic” tab to create a whitelist.

Individual applications you might host also often come with built-in whitelist functionality, as well. For example, you can add an IP to a Minecraft Server’s whitelist by modifying whitelist.json in the main server directory. The process varies significantly between applications though, and you’ll need to check your application’s documentation for the details.

RELATED: The Best Linux Distributions for Beginners

Consider Separating Your Local Area Network With a VLANs

Your home local area network (LAN) is typically a bit of a free-for-all. There is much less security between devices on a LAN than between a device on the Internet and a device on the LAN. The general assumption is that devices attached to your LAN are trusted devices, and that they don’t pose much of a security risk.

If you’re hosting an internet-facing service, however, that is not a safe assumption. If there is a fault in the service you’re hosting, or your other security practices, it is possible that an attacker can compromise your server and through it gain access to other devices on your local area network. It is potentially a huge security breach.

One solution is a Virtual LAN, or VLAN. A VLAN is a separate virtual local area network that is isolated — through software — from the “real” LAN that all of your other devices are on. You can limit exactly what kind of traffic is allowed to pass between the VLAN containing your internet-facing server and the VLAN that all of your normal devices are on. This creates a pretty effective barrier between your server and your other devices should a malicious attacker compromise your server. Setting up a VLAN can be a bit complicated, and the details will vary depending on your hardware. Not all consumer routers support VLANs either, so if you don’t see it, it probably isn’t there.
If your router doesn’t support VLANs, you have a few options. You can buy a new router that does support them, or you can add a managed network switch. Managed network switches start at about $30, so they’re probably the least expensive way to set up a VLAN at home if your current hardware doesn’t support it.

It’s a wee bit of a hassle to set up port forwarding, but as long as you assign a static IP address to the target device and set up a dynamic DNS server for your home IP address, it’s a task you only need to visit once to enjoy hassle free access to your network in the future.

The Best Wi-Fi Routers of 2023