# 🔌 Port Forwarding Configuration

**🟡 Intermediate Infrastructure Guide**

This document details the current port forwarding configuration on the TP-Link Archer BE800 router, enabling external access to specific homelab services with automatic DDNS updates every 5 minutes.

> **🌐 Automatic Domain Updates**  
> All domains are automatically updated via Cloudflare DDNS every 5 minutes, eliminating the need for manual IP management.

## 🔧 Current Port Forwarding Rules

Based on the TP-Link Archer BE800 router configuration:

### 📊 Active Port Forwards Summary

| Service Name | Device IP | External Port | Internal Port | Protocol | Domain Access |
|--------------|-----------|---------------|---------------|----------|---------------|
| **jitsi3** | 192.168.0.200 | 4443 | 4443 | TCP | meet.thevish.io:4443 |
| **stun3** | 192.168.0.200 | 5349 | 5349 | All | meet.thevish.io:5349 |
| **stun2** | 192.168.0.200 | 49160-49200 | 49160-49200 | All | meet.thevish.io (RTP) |
| **stun1** | 192.168.0.200 | 3478 | 3478 | All | meet.thevish.io:3478 |
| **gitea** | 192.168.0.250 | 2222 | 2222 | All | git.vish.gg:2222 |
| **portainer2** | 192.168.0.200 | 8000 | 8000 | All | pw.vish.gg:8000 |
| **portainer2** | 192.168.0.200 | 9443 | 9443 | All | pw.vish.gg:9443 |
| **portainer2** | 192.168.0.200 | 10000 | 10000 | All | pw.vish.gg:10000 |
| **Https** | 192.168.0.250 | 443 | 443 | All | vish.gg:443 |
| **HTTP** | 192.168.0.250 | 80 | 80 | All | vish.gg:80 |

## 🎯 Service Dependencies & External Access

### 🎥 Jitsi Meet Video Conferencing (192.168.0.200 - Atlantis)

#### External Access URLs
```
https://meet.thevish.io:4443  # Primary Jitsi Meet web interface
https://meet.vish.gg:4443     # Alternative domain access
```

#### Required Port Configuration
| Port | Protocol | Purpose | Critical |
|------|----------|---------|----------|
| 4443 | TCP | HTTPS web interface | ✅ Essential |
| 5349 | All | TURN server for NAT traversal | ✅ Essential |
| 3478 | All | STUN server for peer discovery | ✅ Essential |
| 49160-49200 | All | RTP media streams (40 port range) | ✅ Essential |

#### Service Dependencies
```
# WebRTC Media Flow
Internet → Router:4443 → Atlantis:5443 → jitsi-web:443
Internet → Router:3478 → Atlantis:3478 → STUN server
Internet → Router:5349 → Atlantis:5349 → TURN server
Internet → Router:49160-49200 → Atlantis:49160-49200 → RTP streams

# All 4 port ranges required for full functionality:
- WebRTC media negotiation depends on STUN/TURN
- RTP port range handles multiple concurrent calls
- HTTPS interface provides web-based meeting access
```

### 📝 Gitea Git Repository (192.168.0.250 - Calypso)

#### External Access URLs
```
# SSH Git Operations
ssh://git@git.vish.gg:2222

# Web Interface
https://git.vish.gg

# Git Commands
git clone ssh://git@git.vish.gg:2222/username/repo.git
git remote add origin ssh://git@git.vish.gg:2222/username/repo.git
git push origin main
```

#### Port Configuration
| Port | Protocol | Purpose | Authentication |
|------|----------|---------|----------------|
| 2222 | All | SSH access for Git operations | SSH Keys Required |

#### Service Dependencies
```
# SSH Git Access Flow
Internet → Router:2222 → Calypso:2222 → gitea:22

# Requirements:
- SSH key authentication required
- Alternative to HTTPS Git access
- Enables Git operations from external networks
- Web interface accessible via reverse proxy on port 443
```

### 🐳 Portainer Container Management (192.168.0.200 - Atlantis)

#### External Access URLs
```
https://pw.vish.gg:9443      # Primary Portainer HTTPS interface
https://vish.gg:9443         # Alternative domain access
https://pw.vish.gg:8000      # Edge Agent communication
https://pw.vish.gg:10000     # Additional services
```

#### Port Configuration
| Port | Protocol | Purpose | Security Level |
|------|----------|---------|----------------|
| 9443 | All | Primary HTTPS interface | 🔒 High |
| 8000 | All | Edge Agent communication | ⚠️ Medium |
| 10000 | All | Extended functionality | ⚠️ Medium |

#### Service Dependencies
```
# Container Management Flow
Internet → Router:9443 → Atlantis:9443 → portainer:9443
Internet → Router:8000 → Atlantis:8000 → portainer:8000
Internet → Router:10000 → Atlantis:10000 → portainer:10000

# All three ports required for full Portainer functionality:
- 9443: Primary HTTPS interface for web management
- 8000: Edge Agent enables remote Docker management
- 10000: Extended functionality and additional services
```

### 🌍 Web Services (192.168.0.250 - Calypso)

#### External Access URLs
```
https://vish.gg              # Main web services (HTTPS)
https://www.vish.gg          # WWW subdomain
http://vish.gg               # HTTP (redirects to HTTPS)

# Additional Cloudflare Proxied Services:
https://cal.vish.gg          # Calendar service
https://reddit.vish.gg       # Reddit alternative
https://matrix.thevish.io    # Matrix chat server
https://joplin.thevish.io    # Joplin notes
https://www.thevish.io       # Alternative main domain
```

#### Port Configuration
| Port | Protocol | Purpose | Redirect |
|------|----------|---------|----------|
| 443 | All | HTTPS web services | Primary |
| 80 | All | HTTP (redirects to HTTPS) | → 443 |

#### Service Dependencies
```
# Web Services Flow
Internet → Router:443 → Calypso:443 → nginx:443
Internet → Router:80 → Calypso:80 → nginx:80 → redirect to 443

# Requirements:
- Reverse proxy (Nginx) on Calypso handles routing
- SSL/TLS certificates for HTTPS (Let's Encrypt)
- Automatic HTTP to HTTPS redirection
- Cloudflare proxy protection for some subdomains
```

## 🏠 Host Mapping & Service Distribution

### 📊 Services by Host
| Host | IP Address | Services | Port Forwards | Primary Function |
|------|------------|----------|---------------|------------------|
| **Atlantis** | 192.168.0.200 | 45 services | 4 forwards | Jitsi Meet, Portainer |
| **Calypso** | 192.168.0.250 | 38 services | 3 forwards | Gitea SSH, Web Services |

### 🔌 Port Forward Distribution

#### Atlantis (192.168.0.200)
- **Jitsi Meet Video Conferencing**: 4 port forwards
  - 4443/TCP: HTTPS web interface
  - 5349/All: TURN server
  - 49160-49200/All: RTP media (40 ports)
  - 3478/All: STUN server
- **Portainer Container Management**: 3 port forwards
  - 9443/All: HTTPS interface
  - 8000/All: Edge Agent
  - 10000/All: Additional services

#### Calypso (192.168.0.250)
- **Gitea Git Repository**: 1 port forward
  - 2222/All: SSH Git access
- **Web Services**: 2 port forwards
  - 443/All: HTTPS web services
  - 80/All: HTTP (redirects to HTTPS)

## 🔒 Security Analysis & Risk Assessment

### ✅ High Security Services
| Service | Port | Security Features | Risk Level |
|---------|------|-------------------|------------|
| **HTTPS Web (443)** | 443 | Encrypted traffic, reverse proxy protected | 🟢 Low |
| **Jitsi Meet (4443)** | 4443 | Encrypted video conferencing, HTTPS | 🟢 Low |
| **Portainer HTTPS (9443)** | 9443 | Encrypted container management | 🟢 Low |

### ⚠️ Medium Security Services
| Service | Port | Security Considerations | Recommendations |
|---------|------|------------------------|-----------------|
| **Gitea SSH (2222)** | 2222 | SSH key authentication required | Monitor access logs |
| **Portainer Edge (8000)** | 8000 | Agent communication, should be secured | Implement IP restrictions |
| **HTTP (80)** | 80 | Unencrypted, should redirect to HTTPS | Verify redirect works |

### 🔧 Network Services
| Service | Ports | Protocol Type | Security Notes |
|---------|-------|---------------|----------------|
| **STUN/TURN** | 3478, 5349 | Standard WebRTC protocols | Industry standard, encrypted by Jitsi |
| **RTP Media** | 49160-49200 | Media streams | Encrypted by Jitsi, 40 port range |

### 🛡️ Security Recommendations

#### Authentication & Access Control
```
# 1. Strong Authentication
- SSH keys for Gitea (port 2222) - disable password auth
- 2FA on Portainer (port 9443) - enable for all users
- Strong passwords on all web services
- Regular credential rotation

# 2. Access Monitoring
- Review Nginx/reverse proxy logs regularly
- Monitor failed authentication attempts
- Set up alerts for suspicious activity
- Log SSH access attempts on port 2222

# 3. Network Security
- Consider IP whitelisting for admin services
- Implement rate limiting on web interfaces
- Use VPN (Tailscale) for administrative access
- Regular security updates for all exposed services
```

#### Service Hardening
```
# 4. Service Security
- Keep all exposed services updated
- Monitor CVE databases for vulnerabilities
- Implement automated security scanning
- Regular backup of service configurations

# 5. Network Segmentation
- Consider moving exposed services to DMZ
- Implement firewall rules between network segments
- Use VLANs to isolate public-facing services
- Monitor inter-service communication
```

## 🌐 External Access Methods & Alternatives

### 🔌 Primary Access (Port Forwarding)
```
# Direct external access via domain names (DDNS updated every 5 minutes)
https://pw.vish.gg:9443          # Portainer
https://meet.thevish.io:4443     # Jitsi Meet (primary)
ssh://git@git.vish.gg:2222       # Gitea SSH

# Alternative domain access
https://vish.gg:9443             # Portainer (main domain)
https://meet.vish.gg:4443        # Jitsi Meet (alt domain)
https://www.vish.gg              # Main web services (HTTPS)
https://vish.gg                  # Main web services (HTTPS)

# Additional service domains (from Cloudflare DNS)
https://cal.vish.gg              # Calendar service (proxied)
https://reddit.vish.gg           # Reddit alternative (proxied)
https://www.thevish.io           # Alternative main domain (proxied)
https://matrix.thevish.io        # Matrix chat server (proxied)
https://joplin.thevish.io        # Joplin notes (proxied)
```

### 🔗 Alternative Access (Tailscale VPN)
```
# Secure mesh VPN access (recommended for admin)
https://atlantis.tail.vish.gg:9443   # Portainer via Tailscale
https://atlantis.tail.vish.gg:4443   # Jitsi via Tailscale
ssh://git@calypso.tail.vish.gg:2222  # Gitea via Tailscale

# Benefits of Tailscale access:
- No port forwarding required
- End-to-end encryption
- Access control via Tailscale ACLs
- No exposure to internet threats
```

### 🔄 Hybrid Approach (Recommended)
```
# Public Services (External Access)
- Jitsi Meet: External users need direct access
- Web Services: Public content via port forwarding
- Git Repository: Public repositories via HTTPS

# Admin Services (Tailscale Access)
- Portainer: Container management via VPN
- Gitea Admin: Administrative functions via VPN
- Monitoring: Grafana, Prometheus via VPN
```

## 🔄 Dynamic DNS (DDNS) Configuration

### 🌐 Automated DDNS Updates
```
# Cloudflare DDNS Configuration
- Update Frequency: Every 5 minutes
- Domains: vish.gg and thevish.io
- Record Types: IPv4 (A) and IPv6 (AAAA)
- Automation: 4 DDNS services running

# DDNS Services:
- ddns-vish-proxied: Updates proxied A records for vish.gg
- ddns-vish-unproxied: Updates DNS-only A records for vish.gg
- ddns-thevish-proxied: Updates proxied records for thevish.io
- ddns-thevish-unproxied: Updates DNS-only records for thevish.io
```

### 📊 Service Categories
```
# Proxied Services (Cloudflare Protection)
- cal.vish.gg, reddit.vish.gg, www.vish.gg
- matrix.thevish.io, joplin.thevish.io, www.thevish.io
- Benefits: DDoS protection, caching, SSL termination

# DNS-Only Services (Direct Access)
- git.vish.gg, meet.thevish.io, pw.vish.gg
- api.vish.gg, spotify.vish.gg
- Benefits: Direct connection, no proxy overhead
```

## 🚨 Troubleshooting & Diagnostics

### 🔍 Common Issues & Solutions

#### Service Not Accessible Externally
```
# Diagnostic Steps:
1. Verify port forward rule is enabled in router
2. Confirm internal service is running on host
3. Test internal access first (192.168.0.x:port)
4. Check firewall rules on target host
5. Verify router external IP hasn't changed
6. Test DNS resolution: nslookup domain.com

# Commands:
docker-compose ps                    # Check service status
netstat -tulpn | grep PORT         # Verify port binding
nmap -p PORT domain.com             # Test external access
curl -I https://domain.com          # HTTP connectivity test
```

#### Jitsi Meet Connection Issues
```
# WebRTC requires all ports - test each:
nmap -p 4443 meet.thevish.io        # Web interface
nmap -p 3478 meet.thevish.io        # STUN server
nmap -p 5349 meet.thevish.io        # TURN server
nmap -p 49160-49200 meet.thevish.io # RTP range

# Browser diagnostics:
1. Open browser developer tools
2. Go to Network tab during call
3. Look for STUN/TURN connection attempts
4. Check for WebRTC errors in console
5. Test with different networks/devices
```

#### Gitea SSH Access Problems
```
# SSH troubleshooting steps:
ssh -p 2222 git@git.vish.gg        # Test SSH connection
ssh-add -l                         # Check loaded SSH keys
cat ~/.ssh/id_rsa.pub              # Verify public key
nmap -p 2222 git.vish.gg           # Test port accessibility

# Gitea-specific checks:
docker-compose logs gitea | grep ssh
# Check Gitea SSH configuration in admin panel
# Verify SSH key is added to Gitea user account
```

#### Portainer Access Issues
```
# Test all Portainer ports:
curl -I https://pw.vish.gg:9443    # Main interface
curl -I https://pw.vish.gg:8000    # Edge Agent
curl -I https://pw.vish.gg:10000   # Additional services

# Container diagnostics:
docker-compose logs portainer
docker stats portainer
# Check Portainer logs for authentication errors
```

### 🔧 Performance Optimization

#### Network Performance
```
# Monitor bandwidth usage:
iftop -i eth0                      # Real-time bandwidth
vnstat -i eth0                     # Historical usage
speedtest-cli                      # Internet speed test

# Optimize for concurrent users:
# Jitsi: Increase JVB memory allocation
# Gitea: Configure Git LFS for large files
# Portainer: Increase container resources
```

#### Service Performance
```
# Resource monitoring:
docker stats                       # Container resource usage
htop                              # System resource usage
df -h                             # Disk space usage

# Service-specific optimization:
# Jitsi: Configure for expected concurrent meetings
# Nginx: Enable gzip compression and caching
# Database: Optimize PostgreSQL settings
```

## 📋 Maintenance & Configuration Management

### 🔄 Regular Maintenance Tasks

#### Monthly Tasks
```
# Security and monitoring:
□ Review access logs for all forwarded services
□ Test external access to all forwarded ports
□ Update service passwords and SSH keys
□ Backup router configuration
□ Verify DDNS updates are working
□ Check SSL certificate expiration dates
```

#### Quarterly Tasks
```
# Comprehensive review:
□ Security audit of exposed services
□ Update all forwarded services to latest versions
□ Review and optimize port forwarding rules
□ Test disaster recovery procedures
□ Audit user accounts and permissions
□ Review and update documentation
```

#### Annual Tasks
```
# Major maintenance:
□ Complete security assessment
□ Review and update network architecture
□ Evaluate need for additional security measures
□ Plan for service migrations or updates
□ Review and update disaster recovery plans
□ Comprehensive backup and restore testing
```

### 📊 Configuration Backup & Documentation

#### Router Configuration
```
# TP-Link Archer BE800 backup:
- Export configuration monthly
- Document all port forward changes
- Maintain change log with dates and reasons
- Store backup files securely
- Test configuration restoration procedures
```

#### Service Health Monitoring
```
# Automated monitoring setup:
- Uptime monitoring for each forwarded port
- Health checks for critical services
- Alerts for service failures
- Performance metrics collection
- Log aggregation and analysis
```

## 🔗 Integration with Homelab Infrastructure

### 🌐 Tailscale Mesh Integration
```
# Secure internal access alternatives:
https://atlantis.tail.vish.gg:9443   # Portainer
https://atlantis.tail.vish.gg:4443   # Jitsi Meet
ssh://git@calypso.tail.vish.gg:2222  # Gitea SSH

# Benefits:
- No port forwarding required for admin access
- End-to-end encryption via WireGuard
- Access control via Tailscale ACLs
- Works from anywhere with internet
```

### 📊 Monitoring Integration
```
# Service monitoring via Grafana/Prometheus:
- External service availability monitoring
- Response time tracking
- Error rate monitoring
- Resource usage correlation
- Alert integration with notification services
```

### 🔄 Backup Integration
```
# Service data backup:
- Gitea repositories: automated Git backups
- Portainer configurations: volume backups
- Jitsi recordings: cloud storage sync
- Web service data: regular file system backups
```

---

*Last Updated: 2025-11-17*  
*Active Port Forwards: 10 rules across 2 hosts*  
*External Domains: 12 with automatic DDNS updates*  
*DDNS Update Frequency: Every 5 minutes via Cloudflare*  
*Security Status: All services monitored and hardened*