<h1>Hosting my websites at home but I only have a public IPv6 subnet</h1>
<pstyle="text-align: right; font-style: italic;">This post was published on 29 Oct 2024</p>
<p>I wanted to write a small series of blog posts detailing how I made it so that my websites that are hosted at the server in my apartment (which only has a public IPv6 address) can be accessed from the Internet even if you’re in an IPv4-only network and I wanted to start by writing a post about how I delegated an IPv6 prefix to my OPNsense installation from my FRITZ!Box. (Un)fortunately, just as I finished writing it, I found out that the official (I think) <ahref="https://docs.opnsense.org/manual/how-tos/ipv6_fb.html">OPNsense documentation</a> has the <em>exact</em> thing I wrote about documented already, so there’s really no point in my posting my own version that is almost literally the same thing.</p>
<p>Therefore, I’ll just be skipping that portion of my blog post. If you’re in Germany and a customer of Vodafone’s, then you should have been assigned a /59 IPv6 subnet and you can quite simply follow the instructions on the official documentation that I linked above.</p>
<p>Before I start this off, it is important to note that this will <em>only</em> work if you’re using Cloudflare’s proxy. I have not found any other DNS provider that allows you to do this, unfortunately. I know there are some who have quite strong (and often negative) opinions about Cloudflare, so if you’re one of those, then you will probably not be able to do this. If you’re not sure what I’m talking about, you should probably read up on Cloudflare and how their proxy functions first and try to form your own opinion on this matter. If you know of another (free!) way to do this <em>without</em> using Cloudflare, then I’d be <ahref="/contact">happy to hear about it</a>.</p>
<p><em>Also</em>, I’m not claiming that anything I’m about to explain is necessarily the best way of going about this; it’s simply what I found works quite well for me. If I wrote something that’s terrible advice or if you found something that I could improve, you are more than welcome to <ahref="/contact">contact me about that</a>, too!</p>
<p>And lastly, please note that a lot of ISPs do not technically allow the hosting of webservers if you only have a consumer contract and you might have to pay for a (usually more expensive) business contract instead. Or they might just straight up block certain ports from working in the first place on consumer contracts. Therefore, before you do anything, I urge you to check your ISP’s terms of service.</p>
<p>With that out of the way, let’s get started!</p>
<h2id="setup-overview">Setup overview</h2>
<p>Before we start, a quick rundown of my setup. I have a FRITZ!Box 6660 Cable (my main router) to which my server running Proxmox is connected. The FRITZ!Box gets a /59 IPv6 prefix but no public IPv4 (CGNAT). Running on the Proxmox host as a VM is an OPNsense installation. Its WAN network is connected to the <em>LAN</em> network of my FRITZ!Box (it, therefore, gets an IPv4 address in my FRITZ!Box’ LAN, <codeclass="language-plaintext highlighter-rouge">192.168.178.0/24</code>) and the OPNsense’s LAN network is a virtual network that all other VMs running on my Proxmox installation are connected to. Additionally, I have assigned a /64 IPv6 prefix to the LAN network of my OPNsense (see OPNsense documentation above) and all VMs get both a private IPv4 address (in the OPNsense’s <codeclass="language-plaintext highlighter-rouge">10.10.10.0/24</code> network) via DHCP and an IPv6 address either via SLAAC or DHCPv6.</p>
<p>For my webserver in particular I made a separate and really small (/30) IPv4 subnet with a virtual IP in OPNsense, mostly so this public-facing LXC is in a different network from the VMs and LXCs that are <em>not</em> open to the public. I’ll probably switch that over to a VLAN instead of a virtual IP soon. I feel like this is a bit overkill (and probably doesn’t add that much security anyway), but I wanted to do it anyway. However, this means that my webserver has a static IPv4 in a different network, namely <codeclass="language-plaintext highlighter-rouge">10.11.10.2/30</code> with <codeclass="language-plaintext highlighter-rouge">10.11.10.1/30</code> being the virtual IP I assigned to the OPNsense installation and it cannot talk to any other VM or LXC.</p>
<p>I don’t want to share the exact IPv6 prefix I get from my ISP, but let’s just pretend it’s <codeclass="language-plaintext highlighter-rouge">2001:db8:0:e280::/59</code> where <codeclass="language-plaintext highlighter-rouge">2001:db8:0:e280::/64</code> is used by the FRITZ!Box itself and where <codeclass="language-plaintext highlighter-rouge">2001:db8:0:e291::/64</code> has been delegated to the OPNsense’s LAN interface. I have assigned a static IPv6 to the LXC which is running my webservers, namely <codeclass="language-plaintext highlighter-rouge">2001:db8:0:e291::1000:1/128</code>.</p>
<p>My webserver is running Caddy and I’m using a module for Caddy called <codeclass="language-plaintext highlighter-rouge">dns.providers.cloudflare</code> so that Caddy can create an SSL certificate even when it’s behind Cloudflare’s proxy.</p>
<p>Okay, that was probably quite a bit of information. The best tl;dr I can think of is: the public IPv6 my webserver gets is <codeclass="language-plaintext highlighter-rouge">2001:db8:0:e280::1000:1/128</code> (the prefix is not my actual prefix, this is just as an example).</p>
<h2id="setting-up-cloudflare">Setting up Cloudflare</h2>
<p>I’ll assume that you already are somewhat familiar with Cloudflare and how it works, especially after what I mentioned earlier in the blog post and I’ll also assume that you have already added your domain to Cloudflare. If you have not yet done so, please refer to <ahref="https://developers.cloudflare.com/fundamentals/setup/manage-domains/add-site/">Cloudflare’s own documentation</a> on how to do this.</p>
<p>What you have to do is go into your domain’s DNS settings and create <strong>only a single AAAA record with the proxy enabled</strong>. Do not add another <codeclass="language-plaintext highlighter-rouge">AAAA</code> record or even an <codeclass="language-plaintext highlighter-rouge">A</code> record; simply add a <codeclass="language-plaintext highlighter-rouge">AAAA</code> pointing to the IPv6 address of your server. This should look as follows:</p>
<p><imgsrc="/assets/images/blog_posts/hosting_at_home/bateleur_org.png"alt="A screenshot from Cloudflare’s website showing a single AAAA record set for the domain bateleur.org"/></p>
<p>This is probably the most important aspect of this entire thing if you want your website to be reachable even in networks that do not support IPv6. If you only set a <codeclass="language-plaintext highlighter-rouge">AAAA</code> record and no <codeclass="language-plaintext highlighter-rouge">A</code> record, Cloudflare will automatically translate requests from IPv4 networks so that your website can be reached even from those networks.</p>
<p>You may also have to change the SSL settings of your domain. By default, the SSL setting is set to <q>flexible</q> which ended up not working for me and I had to set it to <q>full</q> instead:</p>
<p><imgsrc="/assets/images/blog_posts/hosting_at_home/cloudflare_ssl.png"alt="A screenshot of Cloudflare’s SSL settings"width="30%"/></p>
<p>While you’re here, you might as well also create an API key either for your entire account or only for a particular zone / domain. For more information about what permissions need to be set, you can look at the <ahref="https://github.com/caddy-dns/cloudflare">GitHub page for Caddy’s Cloudflare module</a>.</p>
<h2id="firewall-rules">Firewall rules</h2>
<p>The first thing you’d have to properly set up are the firewall rules, especially the WAN rules. Since the only thing running on my LXC that needs to be accessed from the Internet is a webserver, it only really needs to have ports <codeclass="language-plaintext highlighter-rouge">443</code> and maybe also port <codeclass="language-plaintext highlighter-rouge">80</code> open to the public. I created an <ahref="https://docs.opnsense.org/manual/aliases.html">alias</a> that includes both ports so that I don’t have to create <em>two</em> rules and I simply named it <codeclass="language-plaintext highlighter-rouge">allowed_ports_default</code>.</p>
<p>However, we can refine this rule a bit further: since <em>all the traffic</em> going to our webserver should come from Cloudflare (as we’re using their proxy), you change the rule so that only traffic from Cloudflare’s network is accepted.</p>
<p>To do this, you can simply create yet another alias that includes all the networks that Cloudflare uses. Luckily, Cloudflare publishes the list of their IPv6 subnets which you can find it here: <ahref="https://www.cloudflare.com/ips-v6/#">https://www.cloudflare.com/ips-v6/#</a>. So all we need to do is create an alias that includes all seven (at the time of writing) subnets and put that alias into the <q>Source</q> field of our created WAN rules. The alias should end up looking as follows:</p>
<p><imgsrc="/assets/images/blog_posts/hosting_at_home/cloudflare_ips.png"alt="A screenshot showing a firewall alias containing all of Cloudflare’s IPv6 subnets"/></p>
<p>And the rule should end up looking as follows:</p>
<p><imgsrc="/assets/images/blog_posts/hosting_at_home/wan_rule.png"alt="A screenshot of an OPNsense rule"/></p>
<p>Additionally, you also have to set up the rules on the LAN interface. I created two LAN rules, one for the IPv6 and one for the IPv4 address of my webserver and I allowed only ports <codeclass="language-plaintext highlighter-rouge">443, 80, 123, 53</code> for both IPv4 TCP/UDP and IPv6 TCP/UDP. I also set up a LAN rule that blocks access from my webservers LAN network to all of my other LANs.</p>
<p>I’m assuming you know how to get a website up and running with Caddy. If not, I highly recommend looking at their <ahref="https://caddyserver.com/docs/">documentation</a>, it’s really quite simple!</p>
<p>However, getting Caddy to work with the Cloudflare DNS was a little bit annoying at first, because the Debian 12 LXC that I’m running did not have the newest version of Caddy in its repositories, apparently, and the version that was available did not have the <codeclass="language-plaintext highlighter-rouge">add-package</code> command which is needed to install the Cloudflare DNS module. So I simply downloaded the newest <codeclass="language-plaintext highlighter-rouge">.deb</code> file from Caddy’s GitHub, installed that and installed the Cloudflare DNS module using the command <codeclass="language-plaintext highlighter-rouge">sudo caddy add-package github.com/caddy-dns/cloudflare</code>. Afterwards, simply follow the instructions on their GitHub page on how to add the API key to your configuration.</p>
<p>If you then restart Caddy after adding your configuration (or simply starting it for the first time), it should automatically generate an SSL certificate for you and your website should become reachable from <em>both</em> IPv6- and IPv4-only networks.</p>
<h2id="conclusion">Conclusion</h2>
<p>Your website should now be accessible from the Internet! I hope you enjoyed reading this and I hope it will end up helping someone in the future. If you have any further questions, critique or whatever, <ahref="/contact">feel free to reach out to me</a>. This is the first blog post I have written in a <em>long</em> time, so if there’s anything you think could be improved in the next one, I would love to hear about it.</p>
