GET https://kbin.spritesserver.nl/index.php/m/linux@lemmy.ml/t/27753/How-to-secure-podman-or-docker-containers-for-public-facing-hosting/comment/288779/votes/up

Response
200 OK
IP
216.73.216.21
Profiled on
Token
2c6111

Security

Token

There is no security token.

Firewall

main Name
Security enabled
Stateless

Configuration

Key Value
provider security.user.provider.concrete.app_user_provider
context main
entry_point App\Security\KbinAuthenticator
user_checker App\Security\UserChecker
access_denied_handler (none)
access_denied_url (none)
authenticators 
[
  "two_factor"
  "remember_me"
  "App\Security\KbinAuthenticator"
  "App\Security\FacebookAuthenticator"
  "App\Security\GoogleAuthenticator"
  "App\Security\GithubAuthenticator"
  "App\Security\KeycloakAuthenticator"
]

Listeners

Listener Duration Response 
Symfony\Component\Security\Http\Firewall\ChannelListener {#723
  -map: Symfony\Component\Security\Http\AccessMap {#722 …}
  -logger: Monolog\Logger {#783 …}
  -httpPort: 80
  -httpsPort: 443
}
 0.00 ms (none) 
Symfony\Component\Security\Http\Firewall\ContextListener {#706
  -tokenStorage: Symfony\Component\Security\Core\Authentication\Token\Storage\TokenStorage {#1017 …}
  -sessionKey: "_security_main"
  -logger: Monolog\Logger {#783 …}
  -userProviders: Symfony\Component\DependencyInjection\Argument\RewindableGenerator {#705 …}
  -dispatcher: Symfony\Component\EventDispatcher\Debug\TraceableEventDispatcher {#747 …}
  -registered: false
  -trustResolver: Scheb\TwoFactorBundle\Security\Authentication\AuthenticationTrustResolver {#780 …}
  -sessionTrackerEnabler: Symfony\Component\Security\Core\Authentication\Token\Storage\UsageTrackingTokenStorage::enableUsageTracking(): void {#703 …}
}
 0.93 ms (none) 
Symfony\Component\Security\Http\Firewall\AuthenticatorManagerListener {#584
  -authenticatorManager: Symfony\Component\Security\Http\Authentication\AuthenticatorManager {#595 …}
}
 0.00 ms (none) 
Scheb\TwoFactorBundle\Security\Http\Firewall\TwoFactorAccessListener {#582
  -twoFactorFirewallConfig: Scheb\TwoFactorBundle\Security\TwoFactor\TwoFactorFirewallConfig {#842 …}
  -tokenStorage: Symfony\Component\Security\Core\Authentication\Token\Storage\UsageTrackingTokenStorage {#1018 …}
  -twoFactorAccessDecider: Scheb\TwoFactorBundle\Security\Authorization\TwoFactorAccessDecider {#581 …}
}
 0.05 ms (none) 
Symfony\Component\Security\Http\Firewall\AccessListener {#579
  -tokenStorage: Symfony\Component\Security\Core\Authentication\Token\Storage\UsageTrackingTokenStorage {#1018 …}
  -accessDecisionManager: Symfony\Component\Security\Core\Authorization\TraceableAccessDecisionManager {#937 …}
  -map: Symfony\Component\Security\Http\AccessMap {#722 …}
}
 0.00 ms (none) 
Symfony\Component\Security\Http\Firewall\LogoutListener {#786
  -tokenStorage: Symfony\Component\Security\Core\Authentication\Token\Storage\UsageTrackingTokenStorage {#1018 …}
  -options: [
    "csrf_parameter" => "_csrf_token"
    "csrf_token_id" => "logout"
    "logout_path" => "app_logout"
  ]
  -httpUtils: Symfony\Component\Security\Http\HttpUtils {#841 …}
  -csrfTokenManager: Symfony\Component\Security\Csrf\CsrfTokenManager {#1015 …}
  -eventDispatcher: Symfony\Component\EventDispatcher\Debug\TraceableEventDispatcher {#747 …}
}
 0.00 ms (none)

Authenticators

No authenticators have been recorded. Check previous profiles on your authentication endpoint.

Access Decision

affirmative Strategy
# Voter class
1 
"Symfony\Component\Security\Core\Authorization\Voter\AuthenticatedVoter"
2 
"Scheb\TwoFactorBundle\Security\Authorization\Voter\TwoFactorInProgressVoter"
3 
"Symfony\Component\Security\Core\Authorization\Voter\RoleHierarchyVoter"
4 
"Symfony\Component\Security\Core\Authorization\Voter\ExpressionVoter"
5 
"App\Security\Voter\EntryCommentVoter"
6 
"App\Security\Voter\EntryVoter"
7 
"App\Security\Voter\MagazineVoter"
8 
"App\Security\Voter\MessageThreadVoter"
9 
"App\Security\Voter\MessageVoter"
10 
"App\Security\Voter\NotificationVoter"
11 
"App\Security\Voter\OAuth2UserConsentVoter"
12 
"App\Security\Voter\PostCommentVoter"
13 
"App\Security\Voter\PostVoter"
14 
"App\Security\Voter\UserVoter"

Access decision log

# Result Attributes Object
1 DENIED ROLE_USER 
null
 
"Scheb\TwoFactorBundle\Security\Authorization\Voter\TwoFactorInProgressVoter"
 ACCESS ABSTAIN 
"Symfony\Component\Security\Core\Authorization\Voter\RoleHierarchyVoter"
 ACCESS DENIED 
"App\Security\Voter\EntryCommentVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\EntryVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\MagazineVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\MessageThreadVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\MessageVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\NotificationVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\OAuth2UserConsentVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\PostCommentVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\PostVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\UserVoter"
 ACCESS ABSTAIN
Show voter details
2 DENIED moderate 
App\Entity\EntryComment {#1369
  +user: Proxies\__CG__\App\Entity\User {#1375 …}
  +entry: App\Entity\Entry {#1827 …}
  +magazine: App\Entity\Magazine {#310
    +icon: Proxies\__CG__\App\Entity\Image {#291 …}
    +name: "linux@lemmy.ml"
    +title: "linux"
    +description: """
      From Wikipedia, the free encyclopedia\n
      \n
      Linux is a family of open source Unix-like operating systems based on the Linux kernel, an operating system kernel first released on September 17, 1991 by Linus Torvalds. Linux is typically packaged in a Linux distribution (or distro for short).\n
      \n
      Distributions include the Linux kernel and supporting system software and libraries, many of which are provided by the GNU Project. Many Linux distributions use the word “Linux” in their name, but the Free Software Foundation uses the name GNU/Linux to emphasize the importance of GNU software, causing some controversy.\n
      \n
      ### Rules\n
      \n
      - Posts must be relevant to operating systems running the Linux kernel. GNU/Linux or otherwise.\n
      - No misinformation\n
      - No NSFW content\n
      - No hate speech, bigotry, etc\n
      \n
      ### Related Communities\n
      \n
      - [!opensource@lemmy.ml](https://lemmy.ml/c/opensource)\n
      - [!libre_culture@lemmy.ml](https://lemmy.ml/c/libre_culture)\n
      - [!technology@lemmy.ml](https://lemmy.ml/c/technology)\n
      - [!libre_hardware@lemmy.ml](https://lemmy.ml/c/libre_hardware)\n
      \n
      Community icon by [Alpár-Etele Méder](https://www.iconfinder.com/pocike), licensed under [CC BY 3.0](https://creativecommons.org/licenses/by/3.0/)
      """
    +rules: null
    +subscriptionsCount: 1
    +entryCount: 1406
    +entryCommentCount: 28632
    +postCount: 6
    +postCommentCount: 214
    +isAdult: false
    +customCss: null
    +lastActive: DateTime @1729583542 {#318
      date: 2024-10-22 09:52:22.0 +02:00
    }
    +markedForDeletionAt: null
    +tags: null
    +moderators: Doctrine\ORM\PersistentCollection {#282 …}
    +ownershipRequests: Doctrine\ORM\PersistentCollection {#278 …}
    +moderatorRequests: Doctrine\ORM\PersistentCollection {#267 …}
    +entries: Doctrine\ORM\PersistentCollection {#225 …}
    +posts: Doctrine\ORM\PersistentCollection {#183 …}
    +subscriptions: Doctrine\ORM\PersistentCollection {#245 …}
    +bans: Doctrine\ORM\PersistentCollection {#162 …}
    +reports: Doctrine\ORM\PersistentCollection {#148 …}
    +badges: Doctrine\ORM\PersistentCollection {#126 …}
    +logs: Doctrine\ORM\PersistentCollection {#116 …}
    +awards: Doctrine\ORM\PersistentCollection {#105 …}
    +categories: Doctrine\ORM\PersistentCollection {#92 …}
    -id: 73
    +apId: "linux@lemmy.ml"
    +apProfileId: "https://lemmy.ml/c/linux"
    +apPublicUrl: "https://lemmy.ml/c/linux"
    +apFollowersUrl: "https://lemmy.ml/c/linux/followers"
    +apInboxUrl: "https://lemmy.ml/inbox"
    +apDomain: "lemmy.ml"
    +apPreferredUsername: "linux"
    +apDiscoverable: true
    +apManuallyApprovesFollowers: null
    +privateKey: null
    +publicKey: null
    +apFetchedAt: DateTime @1729583596 {#319
      date: 2024-10-22 09:53:16.0 +02:00
    }
    +apDeletedAt: null
    +apTimeoutAt: null
    +visibility: "visible             "
    +createdAt: DateTimeImmutable @1698929468 {#313
      date: 2023-11-02 13:51:08.0 +01:00
    }
  }
  +image: null
  +parent: null
  +root: null
  +body: """
    **Quick check list for outward facing servers:**\n
    \n
    1. Isolate them from your main network. If possible have then on a different public IP either using a VLAN or better yet with an entire physical network just for that - avoids VLAN hopping attacks and DDoS attacks to the server that will also take your internet down;\n
    2. If you’re using VLANs then configure your switch properly. Decent switches allows you to restrict the WebUI to a certain VLAN / physical port - this will make sure if your server is hacked they won’t be able to access the Switch’s UI and reconfigure their own port to access the entire network. Note that cheap TP-Link switches usually don’t have a way to specify this;\n
    3. Only expose required services (nginx, game server, program x) to the Internet. Everything else such as SSH, configuration interfaces and whatnot can be moved to another private network and/or a WireGuard VPN you can connect to when you want to manage the server;\n
    4. Use custom ports with 5 digits for everything - something like 23901 (up to 65535) to make your service(s) harder to find;\n
    5. Disable IPv6? Might be easier than dealing with a dual stack firewall and/or other complexities;\n
    6. Use nftables / iptables / another firewall and set it to drop everything but those ports you need for services and management VPN access to work - [10 minute guide](https://wiki.nftables.org/wiki-nftables/index.php/Quick_reference-nftables_in_10_minutes);\n
    7. Use your firewall to restrict what countries are allowed to access your server. If you’re just doing it for a few friends only allow incoming connection from your country ([wiki.nftables.org/wiki-nftables/…/GeoIP_matching](https://wiki.nftables.org/wiki-nftables/index.php/GeoIP_matching))\n
    \n
    Realistically speaking if you’re doing this just for a few friends why not require them to access the server through WireGuard VPN? This will reduce the risk a LOT and won’t probably impact the performance. This is a decent setup guide [digitalocean.com/…/how-to-set-up-wireguard-on-deb…](https://www.digitalocean.com/community/tutorials/how-to-set-up-wireguard-on-debian-11) and you might use this GUI to add/remove clients easily [github.com/ngoduykhanh/wireguard-ui](https://github.com/ngoduykhanh/wireguard-ui)
    """
  +lang: "en"
  +isAdult: false
  +favouriteCount: 3
  +score: 0
  +lastActive: DateTime @1704639005 {#1603
    date: 2024-01-07 15:50:05.0 +01:00
  }
  +ip: null
  +tags: null
  +mentions: [
    "@cyclohexane@lemmy.ml"
  ]
  +children: Doctrine\ORM\PersistentCollection {#1379 …}
  +nested: Doctrine\ORM\PersistentCollection {#1367 …}
  +votes: Doctrine\ORM\PersistentCollection {#2444 …}
  +reports: Doctrine\ORM\PersistentCollection {#1956 …}
  +favourites: Doctrine\ORM\PersistentCollection {#1359 …}
  +notifications: Doctrine\ORM\PersistentCollection {#2485 …}
  -id: 288779
  -bodyTs: "'/community/tutorials/how-to-set-up-wireguard-on-debian-11)':326 '/geoip_matching':275 '/how-to-set-up-wireguard-on-deb':323 '/ngoduykhanh/wireguard-ui](https://github.com/ngoduykhanh/wireguard-ui)':339 '/wiki-nftables/':274 '/wiki-nftables/index.php/geoip_matching))':278 '/wiki-nftables/index.php/quick_reference-nftables_in_10_minutes);':240 '1':8 '10':235 '2':56 '23901':182 '3':127 '4':171 '5':176,194 '6':210 '65535':185 '7':241 'abl':94 'access':96,107,232,252,296 'add/remove':334 'allow':69,250,266 'also':51 'and/or':156,207 'anoth':153,214 'attack':42,45 'avoid':39 'better':29 'certain':77 'cheap':113 'check':2 'client':335 'complex':209 'configur':63,145 'connect':162,268 'countri':248,271 'custom':173 'ddos':44 'deal':201 'decent':67,319 'differ':21 'digit':177 'digitalocean.com':322 'disabl':195 'drop':220 'dual':204 'easier':199 'easili':336 'either':24 'els':141 'entir':33,109 'everyth':140,179,221 'expos':129 'face':6 'find':193 'firewal':206,215,244 'friend':264,290 'game':133 'github.com':338 'github.com/ngoduykhanh/wireguard-ui](https://github.com/ngoduykhanh/wireguard-ui)':337 'gui':332 'guid':237,321 'hack':89 'harder':191 'hop':41 'impact':313 'incom':267 'interfac':146 'internet':54,139 'ip':23 'iptabl':213 'ipv6':196 'isol':9 'like':181 'link':116 'list':3 'lot':308 'main':13 'make':83,187 'manag':168,230 'might':197,329 'minut':236 'move':151 'need':226 'network':14,35,110,155 'nftabl':212 'nginx':132 'note':111 'outward':5 'perform':315 'physic':34,79 'port':80,105,174,224 'possibl':16 'privat':154 'probabl':312 'program':135 'proper':66 'public':22 'quick':1 're':59,257,283 'realist':279 'reconfigur':102 'reduc':304 'requir':130,293 'restrict':72,246 'risk':306 'server':7,48,87,134,170,254,298 'servic':131,189,228 'set':217 'setup':320 'someth':180 'speak':280 'specifi':125 'ssh':144 'stack':205 'sure':84 'switch':65,68,98,117 'take':52 'tp':115 'tp-link':114 'ui':100 'use':25,60,172,211,242,330 'usual':118 'vlan':27,40,61,78 'vpn':159,231,301 'want':166 'way':123 'webui':74 'whatnot':148 'wiki.nftables.org':239,273,277 'wiki.nftables.org/wiki-nftables/':272 'wiki.nftables.org/wiki-nftables/index.php/geoip_matching))':276 'wiki.nftables.org/wiki-nftables/index.php/quick_reference-nftables_in_10_minutes);':238 'wireguard':158,300 'won':91,310 'work':234 'www.digitalocean.com':325 'www.digitalocean.com/community/tutorials/how-to-set-up-wireguard-on-debian-11)':324 'x':136 'yet':30"
  +ranking: 0
  +commentCount: 0
  +upVotes: 0
  +downVotes: 0
  +visibility: "visible             "
  +apId: "https://lemmy.world/comment/6476497"
  +editedAt: null
  +createdAt: DateTimeImmutable @1704639005 {#1942
    date: 2024-01-07 15:50:05.0 +01:00
  }
}
 
"Scheb\TwoFactorBundle\Security\Authorization\Voter\TwoFactorInProgressVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\EntryCommentVoter"
 ACCESS DENIED 
"App\Security\Voter\EntryVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\MagazineVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\MessageThreadVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\MessageVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\NotificationVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\OAuth2UserConsentVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\PostCommentVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\PostVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\UserVoter"
 ACCESS ABSTAIN
Show voter details
3 DENIED edit 
App\Entity\EntryComment {#1369
  +user: Proxies\__CG__\App\Entity\User {#1375 …}
  +entry: App\Entity\Entry {#1827 …}
  +magazine: App\Entity\Magazine {#310
    +icon: Proxies\__CG__\App\Entity\Image {#291 …}
    +name: "linux@lemmy.ml"
    +title: "linux"
    +description: """
      From Wikipedia, the free encyclopedia\n
      \n
      Linux is a family of open source Unix-like operating systems based on the Linux kernel, an operating system kernel first released on September 17, 1991 by Linus Torvalds. Linux is typically packaged in a Linux distribution (or distro for short).\n
      \n
      Distributions include the Linux kernel and supporting system software and libraries, many of which are provided by the GNU Project. Many Linux distributions use the word “Linux” in their name, but the Free Software Foundation uses the name GNU/Linux to emphasize the importance of GNU software, causing some controversy.\n
      \n
      ### Rules\n
      \n
      - Posts must be relevant to operating systems running the Linux kernel. GNU/Linux or otherwise.\n
      - No misinformation\n
      - No NSFW content\n
      - No hate speech, bigotry, etc\n
      \n
      ### Related Communities\n
      \n
      - [!opensource@lemmy.ml](https://lemmy.ml/c/opensource)\n
      - [!libre_culture@lemmy.ml](https://lemmy.ml/c/libre_culture)\n
      - [!technology@lemmy.ml](https://lemmy.ml/c/technology)\n
      - [!libre_hardware@lemmy.ml](https://lemmy.ml/c/libre_hardware)\n
      \n
      Community icon by [Alpár-Etele Méder](https://www.iconfinder.com/pocike), licensed under [CC BY 3.0](https://creativecommons.org/licenses/by/3.0/)
      """
    +rules: null
    +subscriptionsCount: 1
    +entryCount: 1406
    +entryCommentCount: 28632
    +postCount: 6
    +postCommentCount: 214
    +isAdult: false
    +customCss: null
    +lastActive: DateTime @1729583542 {#318
      date: 2024-10-22 09:52:22.0 +02:00
    }
    +markedForDeletionAt: null
    +tags: null
    +moderators: Doctrine\ORM\PersistentCollection {#282 …}
    +ownershipRequests: Doctrine\ORM\PersistentCollection {#278 …}
    +moderatorRequests: Doctrine\ORM\PersistentCollection {#267 …}
    +entries: Doctrine\ORM\PersistentCollection {#225 …}
    +posts: Doctrine\ORM\PersistentCollection {#183 …}
    +subscriptions: Doctrine\ORM\PersistentCollection {#245 …}
    +bans: Doctrine\ORM\PersistentCollection {#162 …}
    +reports: Doctrine\ORM\PersistentCollection {#148 …}
    +badges: Doctrine\ORM\PersistentCollection {#126 …}
    +logs: Doctrine\ORM\PersistentCollection {#116 …}
    +awards: Doctrine\ORM\PersistentCollection {#105 …}
    +categories: Doctrine\ORM\PersistentCollection {#92 …}
    -id: 73
    +apId: "linux@lemmy.ml"
    +apProfileId: "https://lemmy.ml/c/linux"
    +apPublicUrl: "https://lemmy.ml/c/linux"
    +apFollowersUrl: "https://lemmy.ml/c/linux/followers"
    +apInboxUrl: "https://lemmy.ml/inbox"
    +apDomain: "lemmy.ml"
    +apPreferredUsername: "linux"
    +apDiscoverable: true
    +apManuallyApprovesFollowers: null
    +privateKey: null
    +publicKey: null
    +apFetchedAt: DateTime @1729583596 {#319
      date: 2024-10-22 09:53:16.0 +02:00
    }
    +apDeletedAt: null
    +apTimeoutAt: null
    +visibility: "visible             "
    +createdAt: DateTimeImmutable @1698929468 {#313
      date: 2023-11-02 13:51:08.0 +01:00
    }
  }
  +image: null
  +parent: null
  +root: null
  +body: """
    **Quick check list for outward facing servers:**\n
    \n
    1. Isolate them from your main network. If possible have then on a different public IP either using a VLAN or better yet with an entire physical network just for that - avoids VLAN hopping attacks and DDoS attacks to the server that will also take your internet down;\n
    2. If you’re using VLANs then configure your switch properly. Decent switches allows you to restrict the WebUI to a certain VLAN / physical port - this will make sure if your server is hacked they won’t be able to access the Switch’s UI and reconfigure their own port to access the entire network. Note that cheap TP-Link switches usually don’t have a way to specify this;\n
    3. Only expose required services (nginx, game server, program x) to the Internet. Everything else such as SSH, configuration interfaces and whatnot can be moved to another private network and/or a WireGuard VPN you can connect to when you want to manage the server;\n
    4. Use custom ports with 5 digits for everything - something like 23901 (up to 65535) to make your service(s) harder to find;\n
    5. Disable IPv6? Might be easier than dealing with a dual stack firewall and/or other complexities;\n
    6. Use nftables / iptables / another firewall and set it to drop everything but those ports you need for services and management VPN access to work - [10 minute guide](https://wiki.nftables.org/wiki-nftables/index.php/Quick_reference-nftables_in_10_minutes);\n
    7. Use your firewall to restrict what countries are allowed to access your server. If you’re just doing it for a few friends only allow incoming connection from your country ([wiki.nftables.org/wiki-nftables/…/GeoIP_matching](https://wiki.nftables.org/wiki-nftables/index.php/GeoIP_matching))\n
    \n
    Realistically speaking if you’re doing this just for a few friends why not require them to access the server through WireGuard VPN? This will reduce the risk a LOT and won’t probably impact the performance. This is a decent setup guide [digitalocean.com/…/how-to-set-up-wireguard-on-deb…](https://www.digitalocean.com/community/tutorials/how-to-set-up-wireguard-on-debian-11) and you might use this GUI to add/remove clients easily [github.com/ngoduykhanh/wireguard-ui](https://github.com/ngoduykhanh/wireguard-ui)
    """
  +lang: "en"
  +isAdult: false
  +favouriteCount: 3
  +score: 0
  +lastActive: DateTime @1704639005 {#1603
    date: 2024-01-07 15:50:05.0 +01:00
  }
  +ip: null
  +tags: null
  +mentions: [
    "@cyclohexane@lemmy.ml"
  ]
  +children: Doctrine\ORM\PersistentCollection {#1379 …}
  +nested: Doctrine\ORM\PersistentCollection {#1367 …}
  +votes: Doctrine\ORM\PersistentCollection {#2444 …}
  +reports: Doctrine\ORM\PersistentCollection {#1956 …}
  +favourites: Doctrine\ORM\PersistentCollection {#1359 …}
  +notifications: Doctrine\ORM\PersistentCollection {#2485 …}
  -id: 288779
  -bodyTs: "'/community/tutorials/how-to-set-up-wireguard-on-debian-11)':326 '/geoip_matching':275 '/how-to-set-up-wireguard-on-deb':323 '/ngoduykhanh/wireguard-ui](https://github.com/ngoduykhanh/wireguard-ui)':339 '/wiki-nftables/':274 '/wiki-nftables/index.php/geoip_matching))':278 '/wiki-nftables/index.php/quick_reference-nftables_in_10_minutes);':240 '1':8 '10':235 '2':56 '23901':182 '3':127 '4':171 '5':176,194 '6':210 '65535':185 '7':241 'abl':94 'access':96,107,232,252,296 'add/remove':334 'allow':69,250,266 'also':51 'and/or':156,207 'anoth':153,214 'attack':42,45 'avoid':39 'better':29 'certain':77 'cheap':113 'check':2 'client':335 'complex':209 'configur':63,145 'connect':162,268 'countri':248,271 'custom':173 'ddos':44 'deal':201 'decent':67,319 'differ':21 'digit':177 'digitalocean.com':322 'disabl':195 'drop':220 'dual':204 'easier':199 'easili':336 'either':24 'els':141 'entir':33,109 'everyth':140,179,221 'expos':129 'face':6 'find':193 'firewal':206,215,244 'friend':264,290 'game':133 'github.com':338 'github.com/ngoduykhanh/wireguard-ui](https://github.com/ngoduykhanh/wireguard-ui)':337 'gui':332 'guid':237,321 'hack':89 'harder':191 'hop':41 'impact':313 'incom':267 'interfac':146 'internet':54,139 'ip':23 'iptabl':213 'ipv6':196 'isol':9 'like':181 'link':116 'list':3 'lot':308 'main':13 'make':83,187 'manag':168,230 'might':197,329 'minut':236 'move':151 'need':226 'network':14,35,110,155 'nftabl':212 'nginx':132 'note':111 'outward':5 'perform':315 'physic':34,79 'port':80,105,174,224 'possibl':16 'privat':154 'probabl':312 'program':135 'proper':66 'public':22 'quick':1 're':59,257,283 'realist':279 'reconfigur':102 'reduc':304 'requir':130,293 'restrict':72,246 'risk':306 'server':7,48,87,134,170,254,298 'servic':131,189,228 'set':217 'setup':320 'someth':180 'speak':280 'specifi':125 'ssh':144 'stack':205 'sure':84 'switch':65,68,98,117 'take':52 'tp':115 'tp-link':114 'ui':100 'use':25,60,172,211,242,330 'usual':118 'vlan':27,40,61,78 'vpn':159,231,301 'want':166 'way':123 'webui':74 'whatnot':148 'wiki.nftables.org':239,273,277 'wiki.nftables.org/wiki-nftables/':272 'wiki.nftables.org/wiki-nftables/index.php/geoip_matching))':276 'wiki.nftables.org/wiki-nftables/index.php/quick_reference-nftables_in_10_minutes);':238 'wireguard':158,300 'won':91,310 'work':234 'www.digitalocean.com':325 'www.digitalocean.com/community/tutorials/how-to-set-up-wireguard-on-debian-11)':324 'x':136 'yet':30"
  +ranking: 0
  +commentCount: 0
  +upVotes: 0
  +downVotes: 0
  +visibility: "visible             "
  +apId: "https://lemmy.world/comment/6476497"
  +editedAt: null
  +createdAt: DateTimeImmutable @1704639005 {#1942
    date: 2024-01-07 15:50:05.0 +01:00
  }
}
 
"Scheb\TwoFactorBundle\Security\Authorization\Voter\TwoFactorInProgressVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\EntryCommentVoter"
 ACCESS DENIED 
"App\Security\Voter\EntryVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\MagazineVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\MessageThreadVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\MessageVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\NotificationVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\OAuth2UserConsentVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\PostCommentVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\PostVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\UserVoter"
 ACCESS ABSTAIN
Show voter details
4 DENIED moderate 
App\Entity\EntryComment {#1369
  +user: Proxies\__CG__\App\Entity\User {#1375 …}
  +entry: App\Entity\Entry {#1827 …}
  +magazine: App\Entity\Magazine {#310
    +icon: Proxies\__CG__\App\Entity\Image {#291 …}
    +name: "linux@lemmy.ml"
    +title: "linux"
    +description: """
      From Wikipedia, the free encyclopedia\n
      \n
      Linux is a family of open source Unix-like operating systems based on the Linux kernel, an operating system kernel first released on September 17, 1991 by Linus Torvalds. Linux is typically packaged in a Linux distribution (or distro for short).\n
      \n
      Distributions include the Linux kernel and supporting system software and libraries, many of which are provided by the GNU Project. Many Linux distributions use the word “Linux” in their name, but the Free Software Foundation uses the name GNU/Linux to emphasize the importance of GNU software, causing some controversy.\n
      \n
      ### Rules\n
      \n
      - Posts must be relevant to operating systems running the Linux kernel. GNU/Linux or otherwise.\n
      - No misinformation\n
      - No NSFW content\n
      - No hate speech, bigotry, etc\n
      \n
      ### Related Communities\n
      \n
      - [!opensource@lemmy.ml](https://lemmy.ml/c/opensource)\n
      - [!libre_culture@lemmy.ml](https://lemmy.ml/c/libre_culture)\n
      - [!technology@lemmy.ml](https://lemmy.ml/c/technology)\n
      - [!libre_hardware@lemmy.ml](https://lemmy.ml/c/libre_hardware)\n
      \n
      Community icon by [Alpár-Etele Méder](https://www.iconfinder.com/pocike), licensed under [CC BY 3.0](https://creativecommons.org/licenses/by/3.0/)
      """
    +rules: null
    +subscriptionsCount: 1
    +entryCount: 1406
    +entryCommentCount: 28632
    +postCount: 6
    +postCommentCount: 214
    +isAdult: false
    +customCss: null
    +lastActive: DateTime @1729583542 {#318
      date: 2024-10-22 09:52:22.0 +02:00
    }
    +markedForDeletionAt: null
    +tags: null
    +moderators: Doctrine\ORM\PersistentCollection {#282 …}
    +ownershipRequests: Doctrine\ORM\PersistentCollection {#278 …}
    +moderatorRequests: Doctrine\ORM\PersistentCollection {#267 …}
    +entries: Doctrine\ORM\PersistentCollection {#225 …}
    +posts: Doctrine\ORM\PersistentCollection {#183 …}
    +subscriptions: Doctrine\ORM\PersistentCollection {#245 …}
    +bans: Doctrine\ORM\PersistentCollection {#162 …}
    +reports: Doctrine\ORM\PersistentCollection {#148 …}
    +badges: Doctrine\ORM\PersistentCollection {#126 …}
    +logs: Doctrine\ORM\PersistentCollection {#116 …}
    +awards: Doctrine\ORM\PersistentCollection {#105 …}
    +categories: Doctrine\ORM\PersistentCollection {#92 …}
    -id: 73
    +apId: "linux@lemmy.ml"
    +apProfileId: "https://lemmy.ml/c/linux"
    +apPublicUrl: "https://lemmy.ml/c/linux"
    +apFollowersUrl: "https://lemmy.ml/c/linux/followers"
    +apInboxUrl: "https://lemmy.ml/inbox"
    +apDomain: "lemmy.ml"
    +apPreferredUsername: "linux"
    +apDiscoverable: true
    +apManuallyApprovesFollowers: null
    +privateKey: null
    +publicKey: null
    +apFetchedAt: DateTime @1729583596 {#319
      date: 2024-10-22 09:53:16.0 +02:00
    }
    +apDeletedAt: null
    +apTimeoutAt: null
    +visibility: "visible             "
    +createdAt: DateTimeImmutable @1698929468 {#313
      date: 2023-11-02 13:51:08.0 +01:00
    }
  }
  +image: null
  +parent: null
  +root: null
  +body: """
    **Quick check list for outward facing servers:**\n
    \n
    1. Isolate them from your main network. If possible have then on a different public IP either using a VLAN or better yet with an entire physical network just for that - avoids VLAN hopping attacks and DDoS attacks to the server that will also take your internet down;\n
    2. If you’re using VLANs then configure your switch properly. Decent switches allows you to restrict the WebUI to a certain VLAN / physical port - this will make sure if your server is hacked they won’t be able to access the Switch’s UI and reconfigure their own port to access the entire network. Note that cheap TP-Link switches usually don’t have a way to specify this;\n
    3. Only expose required services (nginx, game server, program x) to the Internet. Everything else such as SSH, configuration interfaces and whatnot can be moved to another private network and/or a WireGuard VPN you can connect to when you want to manage the server;\n
    4. Use custom ports with 5 digits for everything - something like 23901 (up to 65535) to make your service(s) harder to find;\n
    5. Disable IPv6? Might be easier than dealing with a dual stack firewall and/or other complexities;\n
    6. Use nftables / iptables / another firewall and set it to drop everything but those ports you need for services and management VPN access to work - [10 minute guide](https://wiki.nftables.org/wiki-nftables/index.php/Quick_reference-nftables_in_10_minutes);\n
    7. Use your firewall to restrict what countries are allowed to access your server. If you’re just doing it for a few friends only allow incoming connection from your country ([wiki.nftables.org/wiki-nftables/…/GeoIP_matching](https://wiki.nftables.org/wiki-nftables/index.php/GeoIP_matching))\n
    \n
    Realistically speaking if you’re doing this just for a few friends why not require them to access the server through WireGuard VPN? This will reduce the risk a LOT and won’t probably impact the performance. This is a decent setup guide [digitalocean.com/…/how-to-set-up-wireguard-on-deb…](https://www.digitalocean.com/community/tutorials/how-to-set-up-wireguard-on-debian-11) and you might use this GUI to add/remove clients easily [github.com/ngoduykhanh/wireguard-ui](https://github.com/ngoduykhanh/wireguard-ui)
    """
  +lang: "en"
  +isAdult: false
  +favouriteCount: 3
  +score: 0
  +lastActive: DateTime @1704639005 {#1603
    date: 2024-01-07 15:50:05.0 +01:00
  }
  +ip: null
  +tags: null
  +mentions: [
    "@cyclohexane@lemmy.ml"
  ]
  +children: Doctrine\ORM\PersistentCollection {#1379 …}
  +nested: Doctrine\ORM\PersistentCollection {#1367 …}
  +votes: Doctrine\ORM\PersistentCollection {#2444 …}
  +reports: Doctrine\ORM\PersistentCollection {#1956 …}
  +favourites: Doctrine\ORM\PersistentCollection {#1359 …}
  +notifications: Doctrine\ORM\PersistentCollection {#2485 …}
  -id: 288779
  -bodyTs: "'/community/tutorials/how-to-set-up-wireguard-on-debian-11)':326 '/geoip_matching':275 '/how-to-set-up-wireguard-on-deb':323 '/ngoduykhanh/wireguard-ui](https://github.com/ngoduykhanh/wireguard-ui)':339 '/wiki-nftables/':274 '/wiki-nftables/index.php/geoip_matching))':278 '/wiki-nftables/index.php/quick_reference-nftables_in_10_minutes);':240 '1':8 '10':235 '2':56 '23901':182 '3':127 '4':171 '5':176,194 '6':210 '65535':185 '7':241 'abl':94 'access':96,107,232,252,296 'add/remove':334 'allow':69,250,266 'also':51 'and/or':156,207 'anoth':153,214 'attack':42,45 'avoid':39 'better':29 'certain':77 'cheap':113 'check':2 'client':335 'complex':209 'configur':63,145 'connect':162,268 'countri':248,271 'custom':173 'ddos':44 'deal':201 'decent':67,319 'differ':21 'digit':177 'digitalocean.com':322 'disabl':195 'drop':220 'dual':204 'easier':199 'easili':336 'either':24 'els':141 'entir':33,109 'everyth':140,179,221 'expos':129 'face':6 'find':193 'firewal':206,215,244 'friend':264,290 'game':133 'github.com':338 'github.com/ngoduykhanh/wireguard-ui](https://github.com/ngoduykhanh/wireguard-ui)':337 'gui':332 'guid':237,321 'hack':89 'harder':191 'hop':41 'impact':313 'incom':267 'interfac':146 'internet':54,139 'ip':23 'iptabl':213 'ipv6':196 'isol':9 'like':181 'link':116 'list':3 'lot':308 'main':13 'make':83,187 'manag':168,230 'might':197,329 'minut':236 'move':151 'need':226 'network':14,35,110,155 'nftabl':212 'nginx':132 'note':111 'outward':5 'perform':315 'physic':34,79 'port':80,105,174,224 'possibl':16 'privat':154 'probabl':312 'program':135 'proper':66 'public':22 'quick':1 're':59,257,283 'realist':279 'reconfigur':102 'reduc':304 'requir':130,293 'restrict':72,246 'risk':306 'server':7,48,87,134,170,254,298 'servic':131,189,228 'set':217 'setup':320 'someth':180 'speak':280 'specifi':125 'ssh':144 'stack':205 'sure':84 'switch':65,68,98,117 'take':52 'tp':115 'tp-link':114 'ui':100 'use':25,60,172,211,242,330 'usual':118 'vlan':27,40,61,78 'vpn':159,231,301 'want':166 'way':123 'webui':74 'whatnot':148 'wiki.nftables.org':239,273,277 'wiki.nftables.org/wiki-nftables/':272 'wiki.nftables.org/wiki-nftables/index.php/geoip_matching))':276 'wiki.nftables.org/wiki-nftables/index.php/quick_reference-nftables_in_10_minutes);':238 'wireguard':158,300 'won':91,310 'work':234 'www.digitalocean.com':325 'www.digitalocean.com/community/tutorials/how-to-set-up-wireguard-on-debian-11)':324 'x':136 'yet':30"
  +ranking: 0
  +commentCount: 0
  +upVotes: 0
  +downVotes: 0
  +visibility: "visible             "
  +apId: "https://lemmy.world/comment/6476497"
  +editedAt: null
  +createdAt: DateTimeImmutable @1704639005 {#1942
    date: 2024-01-07 15:50:05.0 +01:00
  }
}
 
"Scheb\TwoFactorBundle\Security\Authorization\Voter\TwoFactorInProgressVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\EntryCommentVoter"
 ACCESS DENIED 
"App\Security\Voter\EntryVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\MagazineVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\MessageThreadVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\MessageVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\NotificationVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\OAuth2UserConsentVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\PostCommentVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\PostVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\UserVoter"
 ACCESS ABSTAIN
Show voter details
5 DENIED edit 
App\Entity\Magazine {#310
  +icon: Proxies\__CG__\App\Entity\Image {#291 …}
  +name: "linux@lemmy.ml"
  +title: "linux"
  +description: """
    From Wikipedia, the free encyclopedia\n
    \n
    Linux is a family of open source Unix-like operating systems based on the Linux kernel, an operating system kernel first released on September 17, 1991 by Linus Torvalds. Linux is typically packaged in a Linux distribution (or distro for short).\n
    \n
    Distributions include the Linux kernel and supporting system software and libraries, many of which are provided by the GNU Project. Many Linux distributions use the word “Linux” in their name, but the Free Software Foundation uses the name GNU/Linux to emphasize the importance of GNU software, causing some controversy.\n
    \n
    ### Rules\n
    \n
    - Posts must be relevant to operating systems running the Linux kernel. GNU/Linux or otherwise.\n
    - No misinformation\n
    - No NSFW content\n
    - No hate speech, bigotry, etc\n
    \n
    ### Related Communities\n
    \n
    - [!opensource@lemmy.ml](https://lemmy.ml/c/opensource)\n
    - [!libre_culture@lemmy.ml](https://lemmy.ml/c/libre_culture)\n
    - [!technology@lemmy.ml](https://lemmy.ml/c/technology)\n
    - [!libre_hardware@lemmy.ml](https://lemmy.ml/c/libre_hardware)\n
    \n
    Community icon by [Alpár-Etele Méder](https://www.iconfinder.com/pocike), licensed under [CC BY 3.0](https://creativecommons.org/licenses/by/3.0/)
    """
  +rules: null
  +subscriptionsCount: 1
  +entryCount: 1406
  +entryCommentCount: 28632
  +postCount: 6
  +postCommentCount: 214
  +isAdult: false
  +customCss: null
  +lastActive: DateTime @1729583542 {#318
    date: 2024-10-22 09:52:22.0 +02:00
  }
  +markedForDeletionAt: null
  +tags: null
  +moderators: Doctrine\ORM\PersistentCollection {#282 …}
  +ownershipRequests: Doctrine\ORM\PersistentCollection {#278 …}
  +moderatorRequests: Doctrine\ORM\PersistentCollection {#267 …}
  +entries: Doctrine\ORM\PersistentCollection {#225 …}
  +posts: Doctrine\ORM\PersistentCollection {#183 …}
  +subscriptions: Doctrine\ORM\PersistentCollection {#245 …}
  +bans: Doctrine\ORM\PersistentCollection {#162 …}
  +reports: Doctrine\ORM\PersistentCollection {#148 …}
  +badges: Doctrine\ORM\PersistentCollection {#126 …}
  +logs: Doctrine\ORM\PersistentCollection {#116 …}
  +awards: Doctrine\ORM\PersistentCollection {#105 …}
  +categories: Doctrine\ORM\PersistentCollection {#92 …}
  -id: 73
  +apId: "linux@lemmy.ml"
  +apProfileId: "https://lemmy.ml/c/linux"
  +apPublicUrl: "https://lemmy.ml/c/linux"
  +apFollowersUrl: "https://lemmy.ml/c/linux/followers"
  +apInboxUrl: "https://lemmy.ml/inbox"
  +apDomain: "lemmy.ml"
  +apPreferredUsername: "linux"
  +apDiscoverable: true
  +apManuallyApprovesFollowers: null
  +privateKey: null
  +publicKey: null
  +apFetchedAt: DateTime @1729583596 {#319
    date: 2024-10-22 09:53:16.0 +02:00
  }
  +apDeletedAt: null
  +apTimeoutAt: null
  +visibility: "visible             "
  +createdAt: DateTimeImmutable @1698929468 {#313
    date: 2023-11-02 13:51:08.0 +01:00
  }
}
 
"Scheb\TwoFactorBundle\Security\Authorization\Voter\TwoFactorInProgressVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\EntryCommentVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\EntryVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\MagazineVoter"
 ACCESS DENIED 
"App\Security\Voter\MessageThreadVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\MessageVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\NotificationVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\OAuth2UserConsentVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\PostCommentVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\PostVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\UserVoter"
 ACCESS ABSTAIN
Show voter details