Host binding

Configuration
1

I run HA on HAOS, but I cannot find an option for hostbinding.
I use portforwarding on a non default port.
still I see some portscanners passing by in the log

I would like to restrict the listening hosts to my domain name and the internal ip address,
not the external ip address.

this is way better for security,

is this possible at all?

2

And you haven’t considered closing that port again ???, until you’ve read up upon “Opening ports in your router”, and in common in regards to “opening ports”

PS: You will never be able to “Stop” port-scanners, but you can use i.e “digital machine certificates” to only allow specific Devices to access through an i.e ipsec-firewall

3

I am considering my options here.
-VPN
-NC cloud
-fix the binding.
-Reverse proxy

My connection is secure via a duckdns let’s encrypt certificate.

So my desire is port forwarding but with binding limitations.
using SNI it should be possible to limit host binding so a scan simply on IP:port would fail,
one needs to know the address.

4

Im not sure what you mean, SNI is basically “limiting” the ports you have to have open ,by combining services under 1 port
Still wont prevent port-scanners, and if it finds an “open port” it will “traverse” services" ( well depends upon which “port-scanner” we are talking about … thinking AI :wink:

NC Cloud == No open ports
So using this And 2 factor authentication is “almost” bulletproof

VPN to a dedicated firewall, and 2 factor authentication same, depends entirely upon where and how ( and from which Devices) you want to access your Network/HA

5

you are correct that that the port scanner still will see an open port.
however it will not show the HA login page.

VPN will work, except one scenario. I use this for some, but not everywhere.

Reverse proxy would give me the same as the correct host binding I guess.

So maybe I should go for NC cloud, I already use it for the backup.

Still it would like to fix this binding.

6

Yes it’s basically what you could do with i.e nginx , and even if someone crack you VPN credentials you could have an additional step involved

what nginx do is just closing and blocking a “scanner” which just changes it’s IP and banging you again … until it “get right sni” … well, in nginx you should then prevent ip-scanning by only using/accepting domain-name …

Anyhow, port-scanners will always find IP’s And Domain-names, so best might be never opening any ports :laughing:

7

binding ? , to homeassistant.local(some optional port) or a domain-name(some optional port)

8

Default you have * or something like that.
But
Homeassistant.local
Homeassistant
Mydomain.com
192.168.10.10
All with schema and pot
An especially not 88.88.88.88
Of whatever my external ip is

9

So you have your own domain already? If so, (only you would know but) Cloudflared app/addon might be another option to look into.

10

I enabled reverse proxy,
apparently there is an add-on saving me much time