Putting an offshore origin behind a reverse proxy

This is the single most useful architecture on an offshore host, and it is not complicated. The origin — your database, your files, the thing that would hurt to lose — sits in the strongest jurisdiction you can tolerate. A disposable proxy sits close to your users and takes the public traffic. Complaints, scanning and attacks reach the layer you can rebuild in five minutes.

The shape

1. 01Deploy the originA VPS in Chișinău or the Seychelles. It serves only over its private interface and to the proxy address. Nothing else reaches it.
2. 02Deploy the proxyA small instance in Frankfurt, Amsterdam or Singapore. Nginx or Caddy, terminating TLS and forwarding upstream.
3. 03Lock the origin firewallDefault-deny inbound. Allow the proxy address on 443 and your own management address on SSH. That is the entire ruleset.
4. 04Point DNS at the proxyOnly the proxy address is ever public. The origin has no DNS record at all.

The four leaks

• Historical DNS. If the domain ever pointed at the origin, passive-DNS archives remember it permanently. Use an address that was never published, not one you are moving away from.
• Outbound connections from the origin. Anything it fetches — an avatar, a webhook, an update check — reveals its address to whoever receives it. Route outbound through the proxy or a separate address.
• Mail. A message sent directly by the origin carries its address in the headers. Relay it, always.
• Error pages and headers. A default nginx page, a stack trace or a Server header exposing a different stack from the proxy tells anyone looking that there are two machines and roughly where.

Getting the real client address through

Once traffic arrives via a proxy, your application sees the proxy address for every visitor, which breaks rate limiting, abuse handling and analytics. Have the proxy set an X-Forwarded-For header and configure the origin to trust it from the proxy address only. Trusting it from anywhere lets anyone spoof any address they like, which is worse than not having it.

What this does and does not buy

It buys you a public surface you can replace without touching your data, and it puts real distance between a complaint and the machine holding everything. It does not make the origin unfindable by a determined adversary with subpoena power, and it does not change what is criminal. It is an operational improvement, not a magic trick — but it is the one that pays for itself most often.

Published by NoDMCAVPS, an offshore host that files automated DMCA notices instead of forwarding them. What we still remove is listed in the acceptable use policy.