B4J Question Is it better to use a VPN?

[Eme Fibonacci]

Imagine the following scenario:

I have a small app (android). It consumes data from a server.
My server is a B4J running at home. I don't have SSL.
As my ip is dynamic I need to use duckdns to keep the server always accessible for app.

In this case Is it better to use a VPN?

I do not know much about VPN.

Thank you.

 

[Descartex]

Hi.
In my case i have 6 apps (2 B4J and 4 B4A-B4i through MySQL) running on my home server using No-ip Services and had no problems yet (hopefully). If my traffic increases, obviously I have to think moving it to a VPN, otherwise my wife will kill me if Netflix become slow

Regards.

 

[Eme Fibonacci]

Hi.
In my case i have 6 apps (2 B4J and 4 B4A-B4i through MySQL) running on my home server using No-ip Services and had no problems yet (hopefully). If my traffic increases, obviously I have to think moving it to a VPN, otherwise my wife will kill me if Netflix become slow

Regards.

I was thinking about security issues.

 

[udg]

Did you look at the free ssl certificates (Let's Encrypt is just one that comes to mind)?

 

[Erel]

Did you look at the free ssl certificates (Let's Encrypt is just one that comes to mind)?

I agree. Why not install a SSL certificate?

 

[Eme Fibonacci]

You moved this post from chitchat to here. Ok no problem, but it not were about b4j. It´s about VPN. I would can use VPN with many ways.
Yes, I know nothing about ssl at moment but I can learn and undstand it.
What I was wondering it was about benefits that VPN would give me in small solutions.

What benefits that VPN would give me?

 

[Erel]

You moved this post from chitchat to here. Ok no problem, but it not were about b4j. It´s about VPN

The chit-chat forum is not indexed so it is better to post technical discussions in one of the questions forums.

I think that SSL is the better option as it will require less configuration and will be more secure.

VPN provides secure connection between the client and the VPN server.

 

[Cableguy]

VPN - virtual private network...
Shouldn't we be discussing a VPS - virtual private server?

 

[Eme Fibonacci]

The chit-chat forum is not indexed so it is better to post technical discussions in one of the questions forums.

I think that SSL is the better option as it will require less configuration and will be more secure.

VPN provides secure connection between the client and the VPN server.

Please, when possible, make a video teaching how to implement a server safely.

 

[OliverA]

Why a VPN?
1) You don't want anyone else having access to your application server. With SSL, you expose your server to the Internet. Anyone can take a crack at it.
2) You would like to do other things on your network securely, such as using RemoteDesktop, drive mapping, etc.

Why SSL?
1) Easier to configure (already mentioned).
2) You want others to have access to your application without giving them full access to your network (via VPN).

VPN Cons?
1) Unless you know how to just add VPN client services to your client application, you will most likely use a devices build in VPN client to connect to your VPN at home. From then on, all traffic is routed to your home network and any application can suddenly have access to your home network (even background apps). Of course this stops once you disconnect from the VPN. Every time you want to use your app, you have to fire up the VPN.
2) You need VPN hardware/software at your home. If your router does not have a VPN server build in, then you either
a) Replace your router
b) Set up a VPN server (and use your router's VPN passthrough functionality to pass all VPN traffic to this server).
3) Can be very complicated to set up/get running. Hopefully it works with the VPN client on your device(s).
4) VPN can be sporadic. Sometimes it will not let you connect. The VPN Server crashes randomly. The traffic is too much and you get kicked off. And on and on and on.
5) If your VPN gets hacked, everything on your network is exposed.

SSL Cons?
1) For each service that you want to expose, you'll have to set up SSL. With VPN, once set up, you can just access anything on your network.
2) You are exposing your services to the internet.

If you need #2 under "Why a VPN?", then that functionality alone offsets all the "VPN Cons". If you just want to expose a single server, then SSL (and firewalling the server) is the way to go.

 

[Eme Fibonacci]

Thank you. I don't want to be boring always saying the same thing.

I'll explain better what I need.

My app has now grown and I need webservices.
I can hire a shared hosting (asp.net) and they work with security issues (theoretically). However, the service is slow and will not support a large number of requests.

What I want: To create a simple b4j server. I will have to use duckdns and my android apps will consume my service.

Creating a b4j server is simple and useful however, I have to think about security issues.

 

[OliverA]

What router do you have? What OS is your B4J server running?

 

[Eme Fibonacci]

I have a Old TP link and I use windows 7. I can buy something better if necessary

 

[OliverA]

Will you dedicate the win7 box to the B4J app?

 

[Eme Fibonacci]

Yes. CPU I5 SSD.

 

[OliverA]

Disclaimer: Not a security expert. Some experience with DMZ'ing, but that is/was in an environment with plenty of IP's/IP sub-nets. Any corrections welcome. This could use more explaining/instructions/warnings, but I think I'm already at a good word count (if not already to verbose).

1) Keep existing router and purchase another consumer router. Keep current router hooked to internet, hook Windows PC into this router and hook new router's WAN port into the old router. Disable wireless on old router. Install DuckDNS software on Windows PC. Make sure internal network addresses are different on both routers (for example, old one 192.168.1.0, new one 192.168.0.0). Either port forward the services necessary on your old router to the Windows PC or make the Windows PC the DMZ (all services will be forwarded to the PC. Make sure you properly set up the Windows Firewall at that time).
Pros: Windows PC is totally isolated from you internal network. If someone takes over the PC, they cannot directory get into your network, since the NATing of the new router will prevent this. Don't allow the new router to be managed from the internet/WAN side.
Cons: Your internal network is traversing two NAT routers. This may break some services. Both routers may be configured initially with the same internal IP address and this will initially cause issues.

2) Buy a Ubiquiti Networks EdgeRouter. It can be configured to work with DuckDNS. At this point, the router is the endpoint of any DNS queries and you forward any services to your Windows PC. Use EdgeRouter configuration to isolate your PC's traffic. Only allow incoming traffic to the PC and only allow the PC to initiate requests to the internet and not the internal network. This way if your PC is hacked, hackers cannot probe/access your internal network directly. All this needs a tad more clarification, but I'm trying to keep it simple.
Pros: Nicer networking equipment that works directly with DuckDNS. All software on the private network should work as expected (no double NATing).
Cons: Harder configuration. If you get the configuration wrong, you are exposing your internal network to outside attacks. You still need a wireless AP for your wireless devices (if your old router supports AP mode, use it).

These are just two ways of doing it. #1 is the securest (if configured properly). Since it is using consumer routers, my rule of thumb is to get new ones about every two to three years due to the changing landscape of WiFi and security (a lot of consumer routers do not get regular updates). This configuration though may break the most applications.

#2 is the most "configurable" with better routing hardware. With proper configuration, it can be just as secure if the software is kept up to date on the router and the router does not get hacked.

 

[wl]

Have a look at www.lowendtalk.com. You will be able to find a VPS capable of running Java and thus B4J for a few dollars a month.

For example look at: https://www.arubacloud.com/
there you will find a VPS for 1 EUR/month (PS: not affiliated with them and I have no interested in mentionning them).

Then: Install on the VPS a webserver like caddy (simple to install and automatically creates and maintains SSL certficates through let's encrypt) and have caddy reverse proxy to your B4J (jetty) webserver. Installing Let's encrypt certificate in jetty directly is also possible.