The attack you're inviting
You forwarded port 3389 (RDP) or 22 (SSH) from your router to an internal machine so you can work from home. Within hours, you're in Shodan's index. Within days, you're getting 10,000+ brute-force attempts per day. One weak password away from ransomware.
This isn't theoretical. Internet-wide scanners hit every IPv4 address every few minutes.
Don't expose admin ports to the internet
Rule one: never port-forward SSH, RDP, VNC, SMB, or database ports directly. Not on non-standard ports (scanners find those too), not with a strong password, not "just temporarily".
The right way: a VPN hub
Set up WireGuard on the router or a small VM. Client configs on your laptop and phone. Now you have one encrypted tunnel into your home network, and RDP/SSH ride inside that tunnel on the private LAN.
A WireGuard config is ~10 lines. OpenWrt, pfSense, OPNsense, and MikroTik all support it out of the box. Even a ₹3000 Raspberry Pi handles it.
If you absolutely must expose a port
For a web service (port 80/443) that the public genuinely needs:
- Put it behind a reverse proxy (Caddy, nginx, Cloudflare Tunnel). Not the app directly.
- TLS with Let's Encrypt, mandatory, redirect HTTP to HTTPS.
- Rate limiting — fail2ban or the proxy's built-in module.
- Geographic filtering if your users are all in one country.
- Log and alert on any 4xx/5xx surge.
Cloudflare Tunnel: the modern answer
If you don't want to run your own VPN, Cloudflare Tunnel is free and better than opening ports. Your server connects outbound to Cloudflare; no inbound holes in your firewall. Cloudflare does the TLS and DDoS protection for you.
cloudflared tunnel create pixelz-home
cloudflared tunnel route dns pixelz-home lab.example.com
cloudflared tunnel run pixelz-home
That's it. Your internal service is reachable at lab.example.com with TLS, and there is literally no open inbound port on your router.
Takeaway
Port forwarding was an acceptable pattern in 2005. Today it's a liability. WireGuard for admin access, Cloudflare Tunnel for public services, zero direct port exposure for RDP or SSH.