Hi, I live in Germany and only have public IPv6. My address changes only very, very rarely and has never changed in the time I’ve been self-hosting.

I also have a very small, pretty cheap VPS with static IPv4/IPv6 – which would seem like a great fit for some sort of tunneling/proxy setup. Now comes the question: What/how should I use it? I would like to not have the additional latency for IPv6 enabled hosts, can I just setup a reverse proxy for IPv4? Would Tailscale work for my usecase, what are some resources you found useful when using it?

Currently, I’m just hosting everything IPv6-only and hoping my address never changes, but that does not work for everyone, as especially many new buildings with fiber optic connections still only have IPv4 (strangely).

  • hank_and_deans@lemmy.caEnglish
    1·
    4 days ago

    Or just use Nginx stream proxy, and all the encryption happens on the endpoints. No need for certs on the proxy at all.

    This is how I make https and mqtts available on ipv4.

    • dblsaiko@discuss.tchncs.de
      English
      1·
      3 days ago

      Oh interesting, I’ll have to look into that. Is this with that “proxy protocol” I’ve seen mentioned? If not, does this preserve it pass through the client socket address?

      • hank_and_deans@lemmy.caEnglish
        1·
        3 days ago

        It’s merely a tcp proxy. It doesn’t even have to be http since it has no idea. The trick with tls is that it can extract the requested host name via SNI.

        • dblsaiko@discuss.tchncs.de
          English
          1·
          3 days ago

          Hm, okay, that does sound like the real client IP will get lost and every connection will appear to come from the proxy then. It would be good if that were passed somehow. My current setup adds the X-Forwarded-For header for example.

          • hank_and_deans@lemmy.caEnglish
            1·
            3 days ago

            That is correct. There is a trick where you can set the source ip to the ipv6 mapped ipv4 ip it originally came from. I have implemented that in a transparent tcp proxy I worked on some years ago, but I am not sure if nginx supports that.

            I should look into that actually. It would be useful to me as well.

            Edit: actually that only works if you are in the routing path. However a nat64 solution would work as well, where you map a /64 back to the proxy.