Self-Hosting Security Guide for your HomeLab

Подписаться 225 тыс.

Просмотров 326 тыс.

50% 1

When most people think about self-hosting services in their HomeLab, they often think of the last mile. By last mile I mean the very last hop before a user accesses your services. This last hop, whether that’s using certificates or a reverse proxy, is incredibly important, but it’s also important to know that security starts at the foundation of your HomeLab. Today, we'll work our way up from hardware security, to OS, to networking, to containers, to firewalls, IDS/IPS, reverse proxies, auth proxies for authentication and authorization, and even lean in to an external provider like Cloudflare.
Video Notes: technotim.live/posts/self-hos...
Support me on Patreon: / technotim
Sponsor me on GitHub: github.com/sponsors/timothyst...
Subscribe on Twitch: / technotim
Become a RU-vid member: / @technotim
Merch Shop 🛍️: l.technotim.live/shop
Gear Recommendations: l.technotim.live/gear
Get Help in Our Discord Community: l.technotim.live/discord
2nd channel: / @technotimtalks
A HUGE thanks to Micro Center for sponsoring this video!
New Customers Exclusive - Get a Free 240gb SSD at Micro Center: micro.center/0ef37a (paid)
(Affiliate links may be included in this description. I may receive a small commission at no cost to you.)
00:00 - Intro
01:10 - Advertisement
02:06 - Don't Self-Host
02:27 - Disclaimer
02:33 - Self-Hosted VPN
02:57 - Public Cloud
03:24 - The Last Mile
03:50 - Hardware
04:28 - Virtual vs. Bare Metal
04:56 - Operating System
05:47 - Container Security
06:58 - Container Tags
08:07 - Network Segmentation
09:32 - Firewall & Port Forwarding
10:11 - Cloudflare (Reverse Proxy)
11:26 - Cloudflare Settings & Stats
11:58 - Cloudflare + Conditional Port Forwarding
13:24 - Cloudflare Firewall Rules
13:46 - IDS and IPS
15:03 - Internal Reverse Proxy
15:53 - Auth Proxy (Authentication and Authorization)
16:42 - Security Overview
17:07 - Are you going to Self-Host?
17:41 - Stream Highlight "I'm big in the Netherlands (not)"
#SelfHosted #HomeLab #Security
"Overzealous Punch" is from Harris Heller's album Sunset.
l.technotim.live/sb-music-lic...
Icons in this video have been created by Freepik from flaticon www.flaticon.com/authors/freepik

Наука

Опубликовано:

2 июн 2024

Ссылка:

Скачать:

Готовим ссылку...

Добавить в:

Мой плейлист

Посмотреть позже

Комментарии : 373

@TechnoTim 2 года назад

New Customers Exclusive - Get a Free 240gb SSD at Micro Center: micro.center/0ef37a (paid)

@SpookyLurker 2 года назад

American only. 🤦‍♂️

@TheoParis 2 года назад

i dont have a microcenter near me :(

@SB-qm5wg 2 года назад

This set up is far more secure than any company I've worked for.

@TechnoTim 2 года назад

And we can do this at home!

@TheOneAndOnlyOuuo 3 месяца назад

I still occasionally run into companies with passwords in the form of "CompanyName1234" so I'm not sure any kind of setup would really save them...

@MisterGlassy 2 года назад

I'm a sysadmin specializing in security and I block countries at work. It saved us a ton from exploit scans and from attempted exploits that we've previously patched. Our firewall can detect and block exploits and there is tons coming from a handful of countries. Also, it may have also saved us from being exploited on one occasion when an exploit attempt came from Russia going to an unpatched Pulse VPN appliance. There is a possibility that other measures would have caught it as well, but it was an excellent first layer of security in this instance. I highly recommend blocking Countries. I highly recommend blocking Russia, China, Ukraine, Crimea, and North Korea. You are correct that most attacks that I see originate from the US, so a layered security model is important but this one rules kills about 60% of all exploit and exploit scanning activity.

@TechnoTim 2 года назад

Thank you for your valuable insight!

@idkau Год назад

Blocking countries can be a terrible idea in some instances so it would be case by case. Where I work, we can’t. You end up blocking edge locations and CDNs. Not to mention our clients customers. Usually I can only block middle eastern countries.

@CraftBasti Год назад

I'm not in the US and you can bet I'll be blocking the entire continent

@PoetofHateSpeech 10 месяцев назад

I'd be blocking the US as well lol

@Xjaje 9 месяцев назад

Also Iran or Nigeria to be blocked I say.

@jimmyscott5144 2 года назад

You should make a video of home lab hosting from square 0 if you were to start from nothing (or start over) and how to set it up. Episode one: bare necessary hardware and how to set up Vlans. Episode two set up server (old pc), setup docker, and setup backups. Etc

@ts47920535 2 года назад

Ditto. Getting some pointers to absolute beginners are a great idea, because there's too much to learn and no clear, easy way of achieving it.

@lopar4ever Год назад

I don’t think you need VLANs on your homelab. You have L3 switches and huge variety of internal networks, so, you can just use port isolation. It’s good for learning, but if your case is not learning or you want just to make it done with less configuring, you can skip VLANs and lose nothing.

@solverz4078 8 месяцев назад

That'd be pretty dope

@l0gic23 2 года назад

Would actually appreciate if Linode would sponsor a series on your channel with topics of your choosing that compare and contrast and shows how to run services remotely for distributed friends and family

@bitterrotten 2 года назад

I would so much rather listen to Linode tutorials from Tim rather than the guy they seem to have buddied with currently who spends a 20 minute video giving you the first 3 sentences of a man page.

@ericesev 2 года назад

Security professional here. Thanks for making this video! I'll be recommending folks view this video. You've described everything I suggest folks with home-labs do. The only minor disagreement I have is with setting up the proxy authentication after everything else is working. Set it up from the start and apply it to all services behind the proxy. You're in a much better spot if everything on your home-lab requires authentication on the proxy. Even if it means logging-in twice (to the proxy and the back-end service). This drastically lowers the attack surface. You can later exclude any services you'd like to remain public. Also, use some type of split DNS; where you serve the internal IP of the proxy to all internal clients. That way you can skip the hop to Cloudflare internally. And you can still access all your home-lab services if your internet connection goes out.

@TechnoTim 2 года назад

Good call! Thank you for your expertise! It should be in place prior to! Also, I have a guide on split DNS with PiHole, should have mentioned it!

@enterchannelname7568 2 года назад

Good idea with internal DNS, it fixed my problem with all my selfhosted apps being routed through my slow 10mbps upload speed via cloudflare. I even get SSL still when using local dns for routing my domain to my server's local IP

@tifflabs 5 месяцев назад

@@TechnoTimcan we get a video on split DNS?

@RaidOwl 2 года назад

*looks over at Self Hosting video I just posted with disappointment* Wooooo Microcenter sponsorship! Let’s Go!!! I’m digging the style of this vid.

@TechnoTim 2 года назад

I saw yours a few days ago! It was great! This just compliments it!

@mahmoodfathy5975 2 года назад

Are we not gonna talk about the awesome illustration using those stickers or cardboard!, this video is amazing end to end, awesome visuals, clear, cuts to the chase. I really like this and have enjoyed every bit. Would be awesome if you can showcase the process of setting some of these stuff you mentioned in separate videos. Would love to see that and again awesome job 🙏

@TechnoTim 2 года назад

Thank you!

@Got99Cookies 2 года назад

Great video, thanks! The production value is also really nice, it's obvious you're making great progress and you are by far my favorite homelab/tech youtuber. It's easy to recommand such a great channel. Thank you for everything you're doing and I hope to see many more of your content.

@TechnoTim 2 года назад

Thank you!

@yankluf 7 месяцев назад

This is sooo good!! Many years wondering what I would need to do to self-host stuff without putting myself at risk and you just told me everything in less than 20 minutes. Thanks a lot!!!

@gianlazzarini 2 года назад

Your video quality just keeps on improving. I really enjoy your work and you do a great job representing the self hosting community with a lot of polish and enthusiasm.

@TechnoTim 2 года назад

Thank you!

@nohay4549 2 года назад

Hi Tim! I love your tutorials and homelab. Would be great to see a dedicated Pfsense video with VLAN setups including a managed router.

@TechnoTim 2 года назад

Thank you! Noted!

@nohay4549 2 года назад

@@TechnoTim Thanks for the reply. I am so excited for the next video. All the best to you.

@vaddimka 2 года назад

That can probably be extended to include interesting features, for example if we put all IoT devices in a separate network, they should still be able to access Internet and be available from our trusted devices (phones), but should not have access (initiate connections) to our trusted devices.

@zadekeys2194 2 года назад

@@vaddimka use rules / patterns like this. This is quite easy with Mikrotik routers. If source = IoT vlan & destination = phone vlan, then drop connection. Swop it around like this: If source = phone vlan & destination = IoT vlan, then allow.

@JanDemore 10 месяцев назад

This would be great, Vlan in Pfsense for starters

@theundertaker5963 2 года назад

Great video as always! Your concise, easy to follow and straight to the point videos are at this point kind of therapeutic to me! Like a few others have already suggested, I would also like to suggest making this video the start of a series of other videos, each of which goes into the actual set up of the main steps mentioned in this video. It would ultimately make for a very nice play list on home-labbing best security practices, and how tos!

@Moukrea 2 года назад

Cool video! Using pictograms makes it so easy to visualize :) For containers, running them with the least privileges possible (preventing privilege escalation), using specialized socket proxies for the services needing it (ie Traefik, Watchtower, Portainer...) and segmenting their networks to the lowest possible level is also a good idea

@SyberPrepper 2 года назад

This was such a great video. You covered so much with simple explanations. Thanks!

@jeremykramer8138 2 года назад

This video was amazing! Having the big picture (the visuals were perfect!) helps pull all these concepts together. I've watched a lot of videos of the self hosted pieces but without understanding how they fit together and the why, I felt lost.

@TechnoTim 2 года назад

Glad it was helpful!

@currydude7 2 года назад

Dude I'm learning so much from your videos! I got wireguard up and running recently and have only been hiding behind that, but this video is an awesome roadmap for me to up my selfhosting game. Def earned my sub, looking forward to learning more from you

@TechnoTim 2 года назад

Glad to hear it! Thank you!

@itskagiso 2 года назад

You have no idea how much knowledge I gained from this video/tutorial. I have watched a few of your videos including the "Put SSL on everything" but this was by far my favorite. Appreciate the effort that went into this. Subbed

@TechnoTim 2 года назад

Thank you so much for the kind words and recognizing how much work went into this!

@LarsBerntropBos 2 года назад

Love it Tim! Although you say it is for a home lab, your excellent account, and all the great comments elaborating on it, will be an inspiration to improve the setup at my workplace. Thank you from a Dutchman!!

@TechnoTim 2 года назад

Thank you!

@limhimontoya 4 месяца назад

Thanks for this detailed and wonderfully illustrated explanation. Before coming across your video, I had read and watched many guides on self hosting that were not very clear on security steps (if they mentioned security at all). Your video is a gem of a resource!

@alice20001 6 месяцев назад

Great video! First one I've seen so far to talk about the most basic, firmware updates.

@gio6923 2 года назад

Your videos are getting better every time, you're doing a great job. Not easy to explain and put all this together. Thanks

@TechnoTim 2 года назад

I appreciate that!

@SaifBinAdhed 2 года назад

YESSSSSSS. I'm researching this subject recently! THANK YOU

@Weirlive 2 года назад

Happy to see you doing a security video, I just got my domain setup with cloud flare.. really cool to see that I can host public services without exposing my public IP.

@TechnoTim 2 года назад

Thanks man! Took a risk on this one!

@TechMeOut5 2 года назад

WOW, This is by far one of the best self hosting videos on RU-vid! Excellent stuff Tim!

@TechnoTim 2 года назад

Wow, thanks!

@realMattGavin Год назад

Great to see cloudflare getting recognition. There are only a handful of videos that I've seen that stick to using cloudflare for firewall. They may sell data, and had an outage recently but for a inexpensive firewall, dns record management, and more, I recommend them. Been using them for almost two years now.

@aleg_911 2 года назад

This videos are just getting better every day, keep it up.

@YugimanTeam 2 года назад

Bro Thank you so much for the Conditional Port Fowarding Advice, it makes so much sense!

@DevinSlick 11 месяцев назад

Great overview. To summarize home lab architecture this thoroughly in 18 minutes is downright impressive! I would just suggest adding a quick comment or addendum to the guide somewhere that Cloudflare proxies alone can't be depended on for blocking external attacks, even with IP allow lists. You'll also need to setup MTLS, otherwise another Cloudflare account could proxy malicious traffic to your account through to your servers.

@member5003 2 года назад

Really helpful in terms of networking, however I missed a bit of endpoint hardening, configuring the OS firewall, hardening docker, kernel hardening, file permissions, etc. Although its kind of a rabbit hole to get into that lol

@TechnoTim 2 года назад

🐰🕳 it never ends!

@abelkilo7242 2 года назад

i just wanted to search more about this topic! and the you come whit this video!

@77Blackwolf77 2 года назад

Another really informative and clearly presented video! Thank you for the time and effort you put into the channel.

@nicedev8189 Год назад

I love how you make so easy to understand thank you Tim.

@rossimac 3 месяца назад

Didn't realise that I should do conditional port forwarding. Just got Cloudflare's IP ranges added to my router. Excellent. Now to learn about VLANs as that's really the only other thing I don't have configured. Cheers Techno Tim!

@christophermoss4295 2 года назад

The visuals here made the content easy to understand, along with your expert explaination. Thanks!

@TechnoTim 2 года назад

Glad it was helpful! Thank you!

@christophermoss4295 2 года назад

@@TechnoTim it would be amazing to see a similar video for securing a cloud vps for self hosted applications. A lot more people now are leveraging the likes of Linode or DigitalOcean, but wish to retain privacy and security.

@JDubzy 2 года назад

Great job on the video. I'm glad I found your channel. Keep up the good work!

@BalinderWalia Год назад

Love Techno Tim insanely helpful videos about sorting our digital life.

@abdulhadies 2 года назад

I am windows system engineer and I have been thinking about self hosted services for sometime now (around 2 years) somehow your video motivated me to start I have just started with the hardware and I am using your videos as a guide and inspiration and ideas to achieve what I want. Keep up the good work and the nice ideas

@TechnoTim 2 года назад

Thank you! You got this!

@DJSolitone 2 года назад

Once more a great video and another excellent source of inspiration. Totally love the little paper icons. You are good dude! I have to say that your channel has become my favorite one when it comes to IT related content. I am surprise that you haven't got more than 1 million subscribers considering the quality of your videos. It will be soon I am sure. This video comes just when I was considering rehosting some customers websites, perfect timing.

@TechnoTim 2 года назад

Awesome, thank you! This is all new to me, so just figuring it all out!

@DJSolitone 2 года назад

@@TechnoTim Hello Tim. Thank you for your kind message. In case you are reading this, I believe you would be the perfect person to do a tutorial on how to setup IPV6 with Docker. I have been struggling for the last week with this on my infrastructure. Proxmox in bridge mode with a /24 subnet from my ISP, Docker swarm on KVMs and PFSense on bare metal. I am trying to implement a vanilla IPV6 config with DHCPv6 on PFSense. Totally insane that I could not find a proper recipe to do this. The docker gateway behavior makes the whole access to containers particularly weird. In case you have some knowledge on this type of setup, it would be a great material to add to your collection. Take care !

@liquicitizendirk2147 2 года назад

This is such a good video, keep it up bro, I can already feel the 100k subs

@SelfSufficient08 2 года назад

Incredible job ! Thanks for sharing !

@cheebadigga4092 2 года назад

Thanks for the tip of NATing only Cloudfflare IPs. That's one thing I've been missing and it really helps a lot with my conscience! :D

@late.student 11 месяцев назад

Mannn, I'm such a visual learner and these little dynamic icons/symbols you're using give me a good basis to follow along with.

@KevinMarchese 2 года назад

dude, I love the graphics! great Job.

@richardkulling1432 10 месяцев назад

Such a great use of pictograms! Awesome video, much appreciated. Cheers from the Netherlands :)

@sofascialistadankulamegado1781 2 года назад

Noooo.. The purple ambient lighting is gone! 😄 Thanks for your awesome videos. They are amazing and I learn so easily with you explaining it all.

@pringl3s Год назад

Another fan here from the Netherlands! I'm learning so much from your videos!

@TechnoTim Год назад

Thank you!

@herpderp728 3 месяца назад

commenting just to say that microcenter is the best, and every machine I've ever built has come from them

@uruemuesiridjebah8628 2 года назад

Thanks, Tim. The weekend project.

@WHAT-GRINDS-MY-GEARS 7 дней назад

super good and I think you should update these every few years. I know not much may have changed. But it will be worth what has.

@manofskill12321 2 года назад

Excellent video Tim, you covered quite a bit. One thing i might add (which would fall into permissions) is to make sure UNC (known as backdooring) is turned off. This makes it harder for an attacker to easily spread ransomware/malware throughout your network.

@TechnoTim 2 года назад

Great tip!

@jkarimkhani Год назад

I love the props explanations in this video. Good job

@TechnoTim Год назад

Thank you!

@papabear1714 9 месяцев назад

Textbook quality educational content in the form of a video, one of the finest creations I've ever come across, in any category.

@TechnoTim 9 месяцев назад

Thank yoiu so much!

@libertycornwell3144 2 года назад

So much to think about now. A lot to work on now that I'm changing my network stack around.

@suikast420 Год назад

Amazing presentation bro. Awesome.

@CristianHeredia0 2 года назад

Fantastic. Very much appreciate the visuals.

@Krushx0 2 года назад

Great video. Can you make a series following up this video how to setup all your advice?

@rraygen 2 года назад

These are really great advices that you learn even in CCNA, so, good stuff. But the aspect of the host itself, about containers, os, virtualization, and updates it's something you don't see teached around often. Probably because is a market that's always changing, but it would be great to have an in-depth video about this part!

@TechnoTim 2 года назад

Thank you!

@ElvisRandomVideos 2 года назад

Excellent video. Thanks for sharing!

@NycX360 2 года назад

This is Excellent, this is exactly how it should be done, Professionál! Very good video

@Mythlium 2 года назад

Great video! Your public speaking skills are impeccable! Learned heaps!

@TechnoTim 2 года назад

Thank you so much! It takes practice! I think I still have much to work on!

@amosgiture 2 года назад

Thanks for the tip about the cloudflare IP ranges

@camerontgore 2 года назад

I really wish that there was a "latest-stable" tag like how there are LTS versions of operating systems. This way you could have a patching cycle that just checks for and applies the latest stable patch.

@TechnoTim 2 года назад

There is with nginx, it really depends on the container maintainer and how they manage their releases!

@camerontgore 2 года назад

@@TechnoTim Thanks!

@Dimich1993 2 года назад

These illustrations are really cool. I'm creeped out the most about my personal machine being compromised, because of the local cluster.

@patrickFREE. 5 месяцев назад

Your hoodie is insane, regards from Germany

@johncosta1932 2 года назад

Awesome video Tim! What do you think about of doing a video setting up a job scheduler like cronicle for example on your home lab? I really enjoy the home lab videos, would be awesome to see that

@matthiashavrez 2 года назад

Thank you for making this video, it is VERY useful :)

@HermanIdzerda 2 года назад

Thanks for another great video.m!! Your first advice is great: just don’t open up your home. As a non-professional have learned this the hard way a couple of years ago. Thanks for not forgetting to put in that advice!

@TechnoTim 2 года назад

Thank you!

@alexitanguay 9 месяцев назад

What happened?

@HermanIdzerda 5 месяцев назад

@@alexitanguay Putting a server online while having forgotten having set up a test account called test with password test - it is one of those things that gets your ISP connection suspended until you explained your error after finding it in the first place. If you're not a professional in the field you are bound to do silly things like that.

@nixxblikka 2 года назад

Great video - if I was to host at home, I would add a second router behind my first router/firewall - so I have somehting like a DMZ - or go the VLAN path...

@machinainc5812 2 года назад

wow, loving the background

@JasonsLabVideos 2 года назад

THIS is a epic good video ! NICE WORK TIM !!!

@TechnoTim 2 года назад

Thank you!

@jmonger 2 года назад

This is excellent content. Thanks!

@junglistfpv8553 2 года назад

I have to say I am loving the paper items and the shuffling off them - very cool. Dutch crew reporting in

@TechnoTim 2 года назад

Thank you!

@stevefrost831 2 года назад

I recognize that "thank you" sign, that's awesome

@TechnoTim 2 года назад

Thank you! 😀

@GotchaPine007 2 года назад

I would add to this that you can make use of Qualys (self hosted) in order to scan for vulnerabilities in your Home lab. They have a free version for up to 16 devices !

@Alan.livingston Год назад

Good work covering supply chain attack from dodgy containers.

@SimonBetty 2 года назад

Brilliant video! How you’ve not got more subscribers is mental!!

@TechnoTim 2 года назад

Thank you!

@libertycornwell3144 2 года назад

I'm gunna have to now take another look through your videos to look for setup guides for these different steps in the security chain. 😁

@TechnoTim 2 года назад

Please do! 😀

@RolandoGarza 2 года назад

Thanks for this great video. It makes it easy to break it down into smaller tasks that are easier to tackle, because self-hosting is an abstract and large project to do properly. One question, though: how do you decide on server hardware selection? Is there a way to find out what piece of hardware will continue to receive patches or that it uses open drivers? And, finally, what are your thoughts on memory safety like DDR3 vs DDR4/DDR5 that, if I remember correctly, are more vulnerable to rowhammer attacks?

@walideshtiwi6303 2 года назад

Thank you very much you are very helpful, and I learned a lot from your videos thank you again

@MattiasMagnusson 2 года назад

This really comes down to the use case, some times integrating 3rd party services by them self could actually cause more damage than setting up everything local only.

@Franchyze923 2 года назад

Awesome video! Thanks for sharing

@TechnoTim 2 года назад

Thanks for watching!

@Justdigit2 2 года назад

Thanks Tim.... As always very clear.... Maybe you can make a step by step how to series to achieve this?

@gileneusz Год назад

this is great guideline for start self hosting security. If you need some kind of inspiration for the video, you might split this one into few yt videos and describe each section in details, giving some basic explanation for newbies on each topic, maybe using more examples and advices, or even setting this kind of server hosting from scratch giving examples on options within each layer of security. I've got this idea watching this section: 9:32, so it may be good starting point

@KathouQC Год назад

Awesome video, I learn some tricks I absolutely need 😆😅

@direnm100 Год назад

Great video! Are you going to have a series on setting each component up?

@rubenb.molina6968 2 года назад

Very nicely elocuted the concept. 👏👏👏.

@TechnoTim 2 года назад

Thank you 🙂

@BigFourHead 2 года назад

thanks for this, some great new things I need to setup. FYI not from Netherlands.

@scottmillerusn1 2 года назад

Great tutorial!

@mistakek 2 года назад

Great video. The presentation was great. I've done all of this except Authelia, then I decided, it's just me who accesses my services, so I just go in via VPN.

@kellytruong5404 2 года назад

I really like your content please keep it up!

@TechnoTim 2 года назад

Thank you so much! Will do!

@TK_Raz 2 года назад

An additional method of protection I use when it comes to Cloudflare is ASN blocking. I've spent a lot of time collecting a lot of webhost and VPN providers network ASNs to effectively block a lot of potential bad traffic. I find this blocks A LOT of "bad actors" especially when attackers often rent multiple IPs from the same host. Simply blocking the hosts ASN will effectively block every possible IP that hosting provider owns, without necessarily having to block IP ranges themselves.

@travisaugustine7264 2 года назад

Any chance of a tour of how your network is laid out? From the modem to your servers? Maybe a how to of how you have your stuff setup? Perhaps a video series/playlist? I would like to redo my home lab to do a better job of segmenting things out.

@kscrib1 8 месяцев назад

Or a guide on network layout strategies and techniques? Suggestion on traffic segmentation, pros/cons and ways to accomplish.

@samuelgodfreyhendrix 2 года назад

Love the cutouts!

@TechnoTim 2 года назад

Thank you!

@okoeroo 5 месяцев назад

Kudos from the Netherlands too

@addei93 2 года назад

I think that for some odd reason SSH Bastion Hosts are strangely overlooked idea on the self-hosted environments. Servers on DMZ (behind the firewall on their own logical network, isolated from rest of the end devices) + Securely hardened Bastion host for server management access limits the attack surface to minimal as possible. Same goes to any intermediary device management portals etc...

@TechnoTim 2 года назад

Great call!

@cryptout 2 года назад

Good video, I would add testing. Spin up a free vm on any cloud service and scan your IP after every firewall change

@vitaliwilhelm7654 6 месяцев назад

really good Video!

@TechnoTim 6 месяцев назад

Glad you enjoyed it

@Punchmememe Год назад

My man you are our hero 🇳🇱❤️

@therandomx6 2 года назад

Great video, thought it should be pointed out that it is possible to allow a group of ingress IP's within UniFi by creating a firewall rule and apply it before predefined rules. The action should accept, then create an IP and port group for the source (this will be the cloudflare IPs that you created a rule per IP block for) and the destination should then be the machine to forward to. This does require 1 (ONE) port forward rule setup the way that you have setup, and then exclude the ingress IP used in the port forward from the cloudflare group. It's a bit of a hacky solution but it works.

@TechnoTim 2 года назад

Interesting. I tried for hours to do something similar but ended up just using the clunky ui for port forwards without aliases. Thank you!