Hello,
Some time ago, I started self-hosting applications, but only on my local network. So far, it’s working fine, but I can’t access them as soon as I go outside (which is completely normal).
For the past few days I’ve been looking for a relatively secure way of accessing my applications from outside.
I don’t need anyone but myself to have access to my applications, so from what I’ve understood, it’s not necessarily useful to set up a reverse-proxy in that case and it would be simpler to set up a VPN.
From what I’ve seen, Wireguard seems to be a good option. At first glance, I’d have to install it on the machine containing my applications, port-forward the Wireguard listening port and configure my other devices to access this machine through Wireguard
However, I don’t have enough hindsight to know whether this is a sufficient layer of security to at least prevent bots from accessing my data or compromising my machine.
I’ve also seen Wireguard-based solutions like Tailscale or Netbird that seem to make configuration easier, but I have a hard time knowing if it would really be useful in my case (and I don’t really get what else they are doing despite simplifying the setup).
Do you have any opinions on this? Are there any obvious security holes in what I’ve said? Is setting up a VPN really the solution in my case?
Thanks in advance for your answers!
Also a beginner here, I use Tailscale, and it’s been a very easy setup!
Tailscale is very tempting, on one hand it should provide a pretty good layer of security without too much thinking and it is “free”, and on another hand, it’s a business solution, so it is probably not really free…
Thanks for the answer anyway confirming that Tailscale is pretty easy to setup !
Headscale is an open source implementation of the Tailscale control server.
https://github.com/juanfont/headscale
Not an endorsement as I haven’t used it (I do use Tailscale), but just thought I’d point it out.
I use headscale and it’s been working wonderfully for my nightly offsite backups and remote access.
The tailscale clients are, I believe, open source. It’s just the server that’s not, and you can run the unofficial but well supported “headscale” as a server if you want. But this requires you to run this somewhere publicly accessible, like a VPS, for coordination and NAT-punching purposes.
But! I’m pretty sure as the business operates right now, that tailscale doesn’t have access to the actual data connections or anything, it’s all encrypted, they’re basically just there for simplicity and coordination. And their business model is to offer simple things for free, like small numbers of devices, with the hope that you like the service and convince your business to pay for the fancy version for money. So I don’t think it’s quite as bad as the typical “free because I’m harvesting your data” models.
That all having been said, I run headscale 😛
I run pfsense as my router on a small form factor PC with two Ethernet cards. I run Wireguard which is pretty easy to setup in pfsense. I have the client installed on my PC at work and my mobile devices. I’m never more than a click from being connected to my home network.
In the past I used ssh tunnels with port forwards to the services I wanted to access remotely.
There’s no magic bullet here. If you want good defense against bots you should use fail2ban and/or crowdsec. Geoblocking is also worth looking into. You will always have to open a port if you are selfhosting a VPN and will need to take aforementioned steps (or alternatives) to secure it. I believe Tailscale is a very good alternative for people who don’t have time to do this as it does not (to the best of my knowledge) require you to expose a port.
I use Netbird (open source networking software from a German company) as it integrates well with Authentik and allows me to use the same SSO for VPN and most of my other services. Setting it up with Authentik and Nginx is a bit complicated but very well documented in my opinion. I do not have a positive experience of the official Android client but Jetbird is a nice alternative. Setting up DNS servers and network routes through peers is quite easy. Enrollment is also a breeze due to the Authentik integration.
Netbird is very nice and easy to use. Only downside is that the iOS app drains battery like crazy :(
I’m in the same boat and currently run WireGuard to access my services. However the more I extend my stack of services, the more I have use-cases to expose certain services to friends and family. For that I’m currently looking into using Pangolin.
If your traffic is pretty low, rent a VPS for $5/month or whatever and set up a Wireguard server on it, have your devices maintain a connection to it (search keepalive for Wireguard), and set up HAProxy to do SNI-based routing for your various subdomains to the appropriate device.
Benefits:
- you control everything, so switching to a new provider is as simple as copying configs instead of reconfiguring everything
- most VPN companies only route traffic going out, not in; you can probably find one that does, but it probably costs more than the DIY option
- easy to share with others, just give a URL
Downsides:
- more complicated to configure
- bandwidth limitations
If you only need access on devices you control, something like Tailscale could work.
Benefits:
- very simple setup - Tailscale supports a ton of things
- potentially free, depending on your needs
Downsides:
- no public access, so you’d need to configure every device that wants to access it
- you don’t control it, so if Tailscale goes evil, you’d need to change everything
I did the first and it works well.
I would not recommend relying on Tailscale. They have been soliciting a lot of venture capital lately and are probably going to go for an IPO sooner or later. I would not put a lot of trust in that company. The investors are going to want their money.
Yeah, that’s the “you don’t control it” angle here. There are alternatives, but you’ll have to do a fair amount of work to switch vs something you do control (i.e. to switch to a different VPS, just copy configs and change the host config on each client, everything else is the same).
Tailscale. You can make a free account and they have clients for most things. If you want to self host, Headscale.
I used wireguard self hosted for a bit but my work network is pretty locked down and I couldn’t find a UDP port that wasn’t blocked. How are you guys setting up wireguard in your home network? Or is it better to host it on a cloud VM?
I’m using tailscale right now because it punches through every firewall but I don’t like using external providers and I’m worried it will eventually enshittify. I have a cloudflare domain but I can’t really use any UDP port for my VPN as it’s blocked.
I got a VPS because I’m behind CGNAT, and then configured WireGuard on the server and HAProxy to proxy requests to my devices.
It works well for me.
1 pangolin 2 whatever is already on your router 3 wireguard
Pangolin also does RP with traefik so it’s a win win
Tailscale is easier than Wireguard but if you’re running OPNsense or OpenWRT it’s not hard to do a wireguard infra of your own and avoid having to use an outside service. I ended up having to revert to wireguard anyway because Tailscale’s android app wasn’t reliable on my new phone, it would drop out every few hours which messed up my monitor/alert system.
But Tailscale is still the easier of the two solutions.
Zero tier. I went tailscale originally, and they’re good, but their mdns support doesn’t exist and several services rely on it. (For me, the showstopper was time machine backups)
I like zerotier over wireguard because it’s one layer lower. So anything that uses Ethernet frames can be routed over it like it was a network switch plugged into your computer. This is probably why mdns works.
Do you test public WiFi with ZeroTier at all?
I ask because there’s a few public networks where WG won’t connect and I’m trying to find ways around it. I could always use cell data but this is more fun to me.
Yeah it’s worked everywhere I’ve tested. But that’s only really been airport WiFi, so I’m not sure it’s indicative of it working in general. It’s easy enough to setup for testing that it’s probably worth a shot
I rarely if ever see ZeroTier mentioned as a solution, but it’s a self-hostable encrypted virtual mesh network (with a small free tier for corp-hosted), super secure, and really easy to setup. I use ZTnet instead of the free-tier corp-hosted controller
Ha, I use both wg and zt, for different situations. ZT for multi-player for old games with friends via ‘LAN’ across the WAN, wg for ‘actual’ VPN through my vps.
Though with zt I’m grandfathered on the old free tier, and they try pretty hard to get me to switch. Last time I logged in they had a full-page ‘you should upgrade to our new plans and features’. But I’m happy on the free level, just gaming.
Not running anything myself but am part of a self hosting discord that swears by Netbird because its basically Tailscale but with a bunch more ease of use features apparently
WireGuard is the fastest method, it’s free, there is no reason not to use it.
My Asus router has a a few nice ones
- pretty much any modern asus routers with a mesh setup and if you run merlin it has more security features.
This is a pointless comment. You don’t even tell us what model router you’re running…
Wireguard with WG Tunnel on my phone so it automatically connects when I leave my WiFi. Some Apps excluded to use it like Android Auto because it doesn’t work with an active vpn.
