Selfhosted

A fixed IP does make things easier at first, but I fail to see the value on that for personal use. Nothing a reverse proxy and DDNS can't replace.

I purchased a domain, use dynamic DNS for it, and point my sub domains to an NGINX proxy server that handles where each points to.

Nothing has access to anything in my network from the internet (all ports are closed on my PFSense), other than Wireguard, and I just VPN into my network when I'm not home.

It was scary when I started, but figured it out in a couple of days. Take into consideration that I'm not even mildly smart, so it should be fairly easy for anyone.

Get into forums, ask around, watch tutorials, you'll be up and running in no time.

Good luck.

Really only if you're running your own email server. Otherwise as far as I know dynamic DNS fills the need.
You aren't in any more risk either way.

Sounds like maybe you want to look into pfsense to do traffic filtering. Highly recommend.

As long as whatever firewall rules you’re using is capable of resolving FQDNs then I don’t see an advantage of doing this. Maybe in the off chance that your IP changes, someone else gets the old IP and exploits it before the DDNS setup has a chance to update. I think that’s really unlikely.

Edit: just to add to this, I do think static IPs are preferable to DDNS, just because it’s easier, but they also typically cost money.

VPN providers usually do not offer port forwarding, so the dedicated IP doesn't help you. I discussed that in length with a support guy from nordvpn. The dedicated IP is only meant for outgoing connections, so your IP doesn't jump to crazy, which would cause problems,e.g., with bank logins.

Safer in terms of what?

If you can't justify it, then no, save your money.

First I’d ask if you need to open ports at all - if this is only for your family’s use then Tailscale or one of its alternatives can accomplish the same goal without opening ports in your firewall or worrying about security flaws in your hosted services.

If it’s for public use, maybe consider cloudflare tunnel?

You can do that or you can use a reverse proxy to expose your services without opening ports for every service. With a reverse proxy you would point port 80 and 443 to the reverse proxy once traffic hits your router/firewall. In the reverse proxy you would configure hostnames that point to the local service IP/ports. Reverse proxy servers like nginx proxy manager then allow you to setup https certificates for every service you expose. They also allow you to disable access to them through a single interface.

I do this and have setup some blocklists on the opnsense firewall. Specifically you could setup the spamhaus blocklists to drop any traffic that originates from those ips. You can also use the Emerging Threats Blocklist. It has spamhaus and a few more integrated from dshield ect. These can be made into simple firewall rules.

If you want to block entire country ips you can setup the GeoIP blocklist in opnsense. This requires a maxmind account but allows you to pick and choose countries.

You can also setup the suricatta ips in opnsense to block detected traffic from daily updates lists. It's a bit more resource intensive from regular firewall rules but also far more advanced at detecting threats.

I use both firewall lists and ips scanning both the wan and lan in promiscuous mode. This heavily defends your network in ways that most modern networks can't even take advantage.

You want even more security you can setup unbound with DNS over TLS. You could even setup openvpn and route all your internal traffic through that to a VPN provider. Personally I prefer having individual systems connect to a VPN service.

Anyway all this to say no you don't need a VPN static IP. You may prefer instead a domain name you can point to your systems. If you're worried about security here identify providers that allow crypto and don't care about identity. This is true for VPN providers as well.

Acronyms, initialisms, abbreviations, contractions, and other phrases which expand to something larger, that I've seen in this thread:

[Thread #737 for this sub, first seen 5th May 2024, 05:35] [FAQ] [Full list] [Contact] [Source code]