from waterproof@sh.itjust.works to selfhosted@lemmy.world on 21 Jul 09:29
https://sh.itjust.works/post/42530655
Hello,
Some time ago, I started self-hosting applications, but only on my local network. So far, it’s working fine, but I can’t access them as soon as I go outside (which is completely normal).
For the past few days I’ve been looking for a relatively secure way of accessing my applications from outside.
I don’t need anyone but myself to have access to my applications, so from what I’ve understood, it’s not necessarily useful to set up a reverse-proxy in that case and it would be simpler to set up a VPN.
From what I’ve seen, Wireguard seems to be a good option. At first glance, I’d have to install it on the machine containing my applications, port-forward the Wireguard listening port and configure my other devices to access this machine through Wireguard
However, I don’t have enough hindsight to know whether this is a sufficient layer of security to at least prevent bots from accessing my data or compromising my machine.
I’ve also seen Wireguard-based solutions like Tailscale or Netbird that seem to make configuration easier, but I have a hard time knowing if it would really be useful in my case (and I don’t really get what else they are doing despite simplifying the setup).
Do you have any opinions on this? Are there any obvious security holes in what I’ve said? Is setting up a VPN really the solution in my case?
Thanks in advance for your answers!
threaded - newest
Mullvad
Mullvad
Mullvad.
How?
Secure tunneling.
I’m guessing you are talking about port forwarding with Mullvad but they no longer support it mullvad.net/…/removing-the-support-for-forwarded-…
No I am talking about creating a secure tunnel.
And why, pray tell, do you need Mullvad to do it? I want to know why you think that.
I didn’t say you need it. I strongly recommend the as a provider.
Please do enlighten me how you use Mullvad to access you self-hosted services in your home? Like OP asked for.
There is no need to pay for an external service for this and I don’t think Mullvad would work for this use case.
It does work for this use case.
You don’t need to, you can use wire guard.
Mullvad is the only VPN you can pay for with cash and actually remain untraced.
Can you explain how to make it work for this use case?
Also a beginner here, I use Tailscale, and it’s been a very easy setup!
Tailscale is very tempting, on one hand it should provide a pretty good layer of security without too much thinking and it is “free”, and on another hand, it’s a business solution, so it is probably not really free…
Thanks for the answer anyway confirming that Tailscale is pretty easy to setup !
The tailscale clients are, I believe, open source. It’s just the server that’s not, and you can run the unofficial but well supported “headscale” as a server if you want. But this requires you to run this somewhere publicly accessible, like a VPS, for coordination and NAT-punching purposes.
But! I’m pretty sure as the business operates right now, that tailscale doesn’t have access to the actual data connections or anything, it’s all encrypted, they’re basically just there for simplicity and coordination. And their business model is to offer simple things for free, like small numbers of devices, with the hope that you like the service and convince your business to pay for the fancy version for money. So I don’t think it’s quite as bad as the typical “free because I’m harvesting your data” models.
That all having been said, I run headscale 😛
Headscale is an open source implementation of the Tailscale control server.
github.com/juanfont/headscale
Not an endorsement as I haven’t used it (I do use Tailscale), but just thought I’d point it out.
I use headscale and it’s been working wonderfully for my nightly offsite backups and remote access.
You got two options which I’ve tried -
The variant version of number 2, which is more work to set up of course, is Pangolin on a VPS. Basically serves the same purpose but skips Cloudflare entirely.
I’m in the process of setting up Pangolin and Headscale on a VPS to expose a small handful of services and to replace my wg-easy setup. Currently chaining wg-easy through a gluetun container, so with a single VPN connection I get LAN access and protect my outbound traffic, but I can’t for the life of me get the same setup working on wg-easy v15, so I’m going to give tailscale/headscale a try with a gluetun exit node.
For the vps, will you go with a provider like digital ocean?
I went with a Racknerd debian 12 box, DigitalOcean is a bit overpriced for what you get. There’s a whole list of recommendations in Pangolin’s wiki iirc
Thank you, might give it a shot.
haven’t looked at Pangolin, but thanks for the info! I might explore it in the future if my current setup gives me any issues.
Getting it up and running was pretty easy but admittedly I’m starting to hit some snags with split DNS and Authentik. Totally doable but taking a lot of work for sure.
In the process I’m also moving my entire domain to a different name and got timed out by letsencrypt lmao so I guess I’ll try some more tomorrow.
I'm in camp #2. Only my Gmail address can access my apps from outside my home. It's a little bit of a pain to configure the rules, but once it's done it's done. I've been happy with it.
You do need to have a domain name though.
pretty cheap to get a domain name through Cloudflare too - nine bucks a year for a .com , I think? Just get something completely personal or completely random! :D They even have a way to get emails routed to your general inbox. It’s fugly, but it works!
Run WireGuard on some home machine. (Does not need to be the machine the app you want to access is hosted on.)
Run WireGuard on your road warrior system.
There is no step 3.
I’m doing this right now from halfway around the world from my house and it’s been great. Been using iPhone, iPad, and macOS clients connected to linuxserver/WireGuard docker container. Been doing this on many WiFi networks and 5G, no difference.
Is wire guard a service you pay for? Otherwise how does wire guard in your home machine not need your router to forward ports to it? And then the remote client need to be pointed at your home’s external IP?
WireGuard is free. Obviously my instructions didn’t go into detail about specifically how to set everything up. Port forwarding is required. Knowing your servers external IP address is required. You also need electricity, an ISP subscription, a home server (preferably running Linux), so on and so forth. This is /c/selfhosted after all.
Yeah that’s fine. The steps were so simple I figured they could work without router config changes if they made some kind of connection handshake in a third party service’s server.
But given all that, I wonder if it makes sense to look into if your router has its own vpn server (or flash the firmware with one that does.)
Some routers even run WireGuard natively :) like for instance Ubiquiti. Personally I’d rather run it on my own server though because ubiquiti doesn’t have easy IAC features.
Okay, so that’s pretty much the setup I had in mind. Good to know there is not much need for an extra step for security, thanks for the answer !
Well, I guess that would still be vulnerable to DDOS attacks, but that would just prevent me from accessing my cinnamon apple-pie recipe from my self hosted recipe manager for some time. A bit mean, but not catastrophic.
I wondered if there would be some other attacks that could compromise my machine with only a wireguard setup, but that’s a good sign if there is nothing obvious.
You wouldn’t be any more vulnerable to ddos attacks than without WG.
Apologies for the dumb noob question, but if your iOS device is VPNed to your home server, how does it access the open internet? Does it do this via the VPN to the home server?
Depends on the client configuration. If you route all the traffic through vpn (so, simplified, 0.0.0.0/0) then all their client device network traffic would go through their vpn server at home and is seen as coming from there; otherwise, if you only route specific addressess (like your home network private addressess only) then only those go to their home network and everything else works like it would without a vpn.
WireGuard routes certain traffic from the client (your iPhone) through the server (the computer at your house). If you route all traffic, then when your iPhone accesses the internet, it’s as if you were at home. Since that WireGuard server is sitting on your home LAN, it is able to route your phones traffic to anything else on that LAN, or out to the internet.
Wireguard clients have a setting called AllowedIPs that tells the client what IP subnets to route through the server. By default this is
0.0.0.0/0, ::/0, which means “all ipv4 and all ipv6 traffic”. But If all you want to access are services on your home LAN, then you change that to192.168.0.0/24or whatever your home subnet is, and only traffic heading to that network will be routed through the WireGuard server at your house, but all other traffic goes out of your phone’s normal network paths to the internet.Ahh. But what if you already used a VPN on the client for normal browsing etc - can you have two VPNs configured?
No, think of a VPN as a network cable. You can only send out of one or the other.
Now, if you are connected to a device that has another VPN to somewhere you want to go, then technically yes you would be using 2 VPN connections.
I don’t think iOS allows multiple VPNs to be enabled simultaneously. There appears to be only one VPN on/off toggle switch. From what I’ve seen you can have different vpn profiles but only enable one at a time. I could be wrong though.
Desktop operating systems like macOS, Linux (did I mention yet that I use arch Linux?), BSD, and um… that other one… oh yeah, Windows do allow this. I’m sure there are a variety of compatibility problems, but in general, multiple VPNs with the same or even different technologies can work together.
Doesn’t that need like a static IP address, port forwarding and dealing all kind of network annoyances?
Recommending wireguard to people feels like recommending Arch to first time Linux users.
You don’t need a static IP address, but you do need a public IP address. You can use dynamic DNS to avoid having to keep track of your IP address. FreeDNS will work fine for a basic setup.
Wireguard is one of the easiest VPN servers to use. If you’re not using your ISP’s router, it may even have Wireguard built in.
I use Wireguard via PiVPN and it’s pretty much foolproof. I don’t bother with Dynamic DNS but have in the past
I use the built-in Wireguard feature of my Fritzbox to connect to my home network.
Good point, I did not check if my router has already some built-in system that could let me connect to my home network with trusted devices from outside
github.com/wg-easy/wg-easy
WG-Easy to run Wireguard
I would recommend this too. This was the easiest to setup. I only had an issue with docker compose which made the pihole not being accessible while on wireguard. Once I put the pihole and wg-easy on the same docker network it started working.
Simple and fast solution is tailscale. tailscale is a business, but it works well
Personally i use opnsense and wireguard
Wireguard is the way to go. I like using wg-easy to use wireguard because its easy to set up in a docker container.
wg-easy
Agree, highly recommend this and/or Tailscale.
Double-pro. Running wireguard on docker assures that a native wireguard install won’t conflict with docker. Keep those iptables in the same place.
I thought I would be the only one to try this. Would you share more details on your setup? I am interested because to me Wireguard is in the kernel so how could it be in a container.
Oh yeah. hub.docker.com/r/linuxserver/wireguard
Basically, docker can and does create network devices. It’s as easy for it to create wg0’s as it is to create networks for your other docker containers. If you’re going to run wireguard and docker, you’re better off to let docker handle the network routing and just run one of the various containers out there to stop them from fighting. That particular container is more general. You can run it client or server. Wg-easy, I believe is server-only, or even hide it inside other containers like docker-qbittorrent-wireguard, where it just hangs out and connects to whatever .conf you give it.
I did the whole thing in my early days selfhosting where I installed wireguard, docker, some apps, rebooted, everything breaks.
Install a wireguard container, configure it as you would, your apps, reboot… it still works, because docker isn’t conflicting with native wg-quick. It’s either this, or untangle and make an iptables setup permanent so when you reboot, it doesn’t break again.
I’m in the same boat and currently run WireGuard to access my services. However the more I extend my stack of services, the more I have use-cases to expose certain services to friends and family. For that I’m currently looking into using Pangolin.
Managing Wireguard is just one of Tailscale’s features.
It uses some UDP black magic fuckery to get through NAT and firewalls without having to open ports on the edge. Very useful if you’re behind CGNAT and/or your ISP is a dickhead and locks down the firewall on your router (this is why I use it; eat a dick, Vodafone). If the UDP fuckery is not available, it reverts to simple relay servers. The client can also advertise subnets and route to hosts on it. You could install the Tailscale client on OPNSense/pfSense/OpenWRT and access your entire home network through that one device.
1 pangolin 2 whatever is already on your router 3 wireguard
Pangolin also does RP with traefik so it’s a win win
Tailscale is easier than Wireguard but if you’re running OPNsense or OpenWRT it’s not hard to do a wireguard infra of your own and avoid having to use an outside service. I ended up having to revert to wireguard anyway because Tailscale’s android app wasn’t reliable on my new phone, it would drop out every few hours which messed up my monitor/alert system.
But Tailscale is still the easier of the two solutions.
Zero tier. I went tailscale originally, and they’re good, but their mdns support doesn’t exist and several services rely on it. (For me, the showstopper was time machine backups)
huh. I knew there was a reason for me to go back to ZT. mdns, you say? Nice to know!
I like zerotier over wireguard because it’s one layer lower. So anything that uses Ethernet frames can be routed over it like it was a network switch plugged into your computer. This is probably why mdns works.
Do you test public WiFi with ZeroTier at all?
I ask because there’s a few public networks where WG won’t connect and I’m trying to find ways around it. I could always use cell data but this is more fun to me.
Yeah it’s worked everywhere I’ve tested. But that’s only really been airport WiFi, so I’m not sure it’s indicative of it working in general. It’s easy enough to setup for testing that it’s probably worth a shot
I rarely if ever see ZeroTier mentioned as a solution, but it’s a self-hostable encrypted virtual mesh network (with a small free tier for corp-hosted), super secure, and really easy to setup. I use ZTnet instead of the free-tier corp-hosted controller
My Asus router has a a few nice ones
This is a pointless comment. You don’t even tell us what model router you’re running…
Wireguard with WG Tunnel on my phone so it automatically connects when I leave my WiFi. Some Apps excluded to use it like Android Auto because it doesn’t work with an active vpn.
WireGuard is the fastest method, it’s free, there is no reason not to use it.
In that case, wireguard. I only occasionally need to access a service that’s not exposed to the internet, so I use
ssh -L, but that would be quite inconvenient for your own use case.I know tailscale exists but I’ve never used it, only tried wireguard on its own. Maybe there’s some huge benefit to using it but wireguard worked fine for me.
Not running anything myself but am part of a self hosting discord that swears by Netbird because its basically Tailscale but with a bunch more ease of use features apparently
There’s no magic bullet here. If you want good defense against bots you should use fail2ban and/or crowdsec. Geoblocking is also worth looking into. You will always have to open a port if you are selfhosting a VPN and will need to take aforementioned steps (or alternatives) to secure it. I believe Tailscale is a very good alternative for people who don’t have time to do this as it does not (to the best of my knowledge) require you to expose a port.
I use Netbird (open source networking software from a German company) as it integrates well with Authentik and allows me to use the same SSO for VPN and most of my other services. Setting it up with Authentik and Nginx is a bit complicated but very well documented in my opinion. I do not have a positive experience of the official Android client but Jetbird is a nice alternative. Setting up DNS servers and network routes through peers is quite easy. Enrollment is also a breeze due to the Authentik integration.
Netbird is very nice and easy to use. Only downside is that the iOS app drains battery like crazy :(
I used wireguard self hosted for a bit but my work network is pretty locked down and I couldn’t find a UDP port that wasn’t blocked. How are you guys setting up wireguard in your home network? Or is it better to host it on a cloud VM?
I’m using tailscale right now because it punches through every firewall but I don’t like using external providers and I’m worried it will eventually enshittify. I have a cloudflare domain but I can’t really use any UDP port for my VPN as it’s blocked.
I got a VPS because I’m behind CGNAT, and then configured WireGuard on the server and HAProxy to proxy requests to my devices.
It works well for me.
@Tinkerer @quokka1 This project might help? I haven’t tried it yet, but it's on my list!
https://github.com/RoliSoft/Obfuscation-Tunnel
Ah thanks for that info I’ll definitely take a look
Tailscale. You can make a free account and they have clients for most things. If you want to self host, Headscale.
If your traffic is pretty low, rent a VPS for $5/month or whatever and set up a Wireguard server on it, have your devices maintain a connection to it (search keepalive for Wireguard), and set up HAProxy to do SNI-based routing for your various subdomains to the appropriate device.
Benefits:
Downsides:
If you only need access on devices you control, something like Tailscale could work.
Benefits:
Downsides:
I did the first and it works well.
I would not recommend relying on Tailscale. They have been soliciting a lot of venture capital lately and are probably going to go for an IPO sooner or later. I would not put a lot of trust in that company. The investors are going to want their money.
Yeah, that’s the “you don’t control it” angle here. There are alternatives, but you’ll have to do a fair amount of work to switch vs something you do control (i.e. to switch to a different VPS, just copy configs and change the host config on each client, everything else is the same).
I use a mixture of tailscale and zerotier. Both are pretty powerful.
I self-host various applications and have been really happy with Wireguard. After watching just how hard my firewall gets hammered when I have any detectable open ports I finally shut down everything else. The WG protocol is designed to be as silent as possible and doesn’t respond to remote traffic unless it receives the correct key, and the open WG port is difficult to detect when the firewall is configured correctly.
Everything - SSH, HTTP, VNC and any other protocol it must first go through my WG tunnel and running it on an OpenWRT router instead of a server means if the router is working, WG is working. Using Tasker on Android automatically brings the tunnel up whenever I leave my house and makes everything in my home instantly accessible no matter what I’m doing.
Another thing to consider is there’s no corporation involved with WG use. So many companies have suddenly decided to start charging for “free for personal use” products and services, IMO it has made anything requiring an account worth avoiding.
If you use Tasker only as VPN switch you could have a look at WG Tunnel from zaneschepke on Github. It has a built in function to switch to the tunnel when your local WIFI is not connected.
github.com/zaneschepke/wgtunnel
Can I ask how you have this setup? Do you also have a reverse proxy setup or just WG on your router and everything gets routed via your router?
I have everything route through the tunnel and my router. Along with allowing instant access to everything I self-host and my home server through VNC, it allows me to use Adguard Home for phone DNS lookups no matter where I am. Theoretically my cell carrier should no longer be able to see any of my Internet traffic which I consider an added bonus. I’ve found no downside except some weirdness from Google if I’m out of the country for an extended period.
I use OpenVPN. It’s pretty easy. You set it up with docker, download the client.ovpn file, then turn off port 80 (only needed for downloading that file). Now you can take that file and use it all of your devices to connect.
Tailscale. You don’t need to open up ports + you can set up exit nodes, which are useful if you’re sailing the seven seas.
The only downside of Tailscale is a few years back they moved their data servers from Canada to the USA…so with the current administration this could become a privacy issue at some point
I do have both (VPN and Reverse Proxy) running. For VPN my router uses Wireguard and at work we use Wireguard as well. You can alter the config in such a way, that only internal traffic would get routed through your VPN. I love this, because for regular traffic, I’m not bound to the upload at my home network or with work, route my personal traffic through the company internet or lose access to my own network.
Reverse proxy isn’t bad either. I have a DNS running at home, that redirects my domain used for home stuff, directly to the reverse proxy. This way I can block certain stuff, I want a fancy domain but not be accessed from the outside, because its not needed or not set up properly.
With a VPN, you would be more secure, because its a single instance you need to keep safe. With regular updates and set up properly, this shouldn’t be an issue. But I would suggest reading tech news portals, that do cover security breaches of well known software.
With a reverse proxy setup I use, I must trust so many things. I must trust my reverse proxy with the firewall and then each server I run.
But keep one thing in mind. If you for example use stuff like Home Assistant, that you access in the background, it wouldn’t work if you connect via a VPN. With Wireguard I can be connected 24/7 to my VPN, even at home. With the previous VPN my router used (I guess it was OpenVPN), this wasn’t possible.
Tailscale is great in that config is super simple. Downsides tailscale ssh has to be called at launch if you want ssh access over that network… Could be a benefit for security…however its a tailscale specific ssh and not everything is available.
Data servers moved to the USA a few ears back.
Wireguard is more setup, but a better (self host option ). There is also Headscale if you want to selfhost a tailscale type server