Remote access - securely

[Ricknextpvr]

I have V5 setup on a PC in my house, and am thinking about accessing it remotely from a PC elsewhere.  I know that I can port forward 8866 and setup a PIN.  However, I am not comfortable with this.  

I have a remote access application currently - a sprinkler system - and I'm using NOIP to provide a domain that links to my dynamic IP address.  I also use a certificate on both ends and that makes me feel better.

Has anyone done this, or something similar, with NextPVR?

[snagglewest]

As you're aware, NextPVR has no built in security to speak of. If you want anything close to real security then you need to put it behind a real proxy server (Apache/Nigex) with proper security set up. With that said, I occasionally expose mine to the world when I'm traveling for a few days at a time and Sub has just added some simple logging for failed login attempts that you can use with fail2ban. I'm ok with the limited risk for short periods, but if you're going to expose it full time I'd highly suggest the proxy server route and lots of reading on web security.

[sub]

As you're aware, NextPVR has no built in security to speak of. 

That's a bit rough

Security wise it's fairly decent with v5, but the main focus has definitely been local network use, rather than hardening for public internet use.

To use the web app over the internet, I'd recommend nginx as your public server, and configure it to reverse proxy to nextpvr. This will allow you to access the web app over https.

[snagglewest]

Sorry, Sub, didn't mean it to come across that way. But as you said, it's more designed with LAN in mind rather than the wild, wild web and protecting from all the nasties and bad actors out there.

[mvallevand]

I side with snagglewest, anything with an extensive remote API is going to be easier to break then just a web server. I am not sure that an IoT sprinkler system will be more secure. The credentials are really meaningless against exploits, the good hackers won't try to use a password.

It boils down to what you are protecting. Until 2020 I wouldn't worry about it, now with many people using VPN's to a corporate office I think the extra step of using nginx could be worth it.

Martin

[sub]

I guess another option is don't expose this stuff to the internet, and just use a VPN into your home network when you need to.

[pkscout]

I have a Windows PC that I basically don't use that has Splashtop installed on it. If I need to do something remotely, I use that to remote into the Windows machine securely and then do whatever i need to via that machine. I think you can even do sound (I don't, so you'd need to check), so it might be possible to use that in combination with the web viewer or NPVR client to actually watch shows (bandwidth permitting).

[Ranbato]

Setting up a VPN is the way to go as you only have 1 thing to secure and 1 port to expose to the internet.

Everything else goes through the VPN tunnel.