What are your VPN recommendations for accessing self-hosted applications from the outside?
-
Hello,
Some time ago, I started self-hosting applications, but only on my local network. So far, it's working fine, but I can't access them as soon as I go outside (which is completely normal).
For the past few days I've been looking for a relatively secure way of accessing my applications from outside.
I don't need anyone but myself to have access to my applications, so from what I've understood, it's not necessarily useful to set up a reverse-proxy in that case and it would be simpler to set up a VPN.
From what I've seen, Wireguard seems to be a good option. At first glance, I'd have to install it on the machine containing my applications, port-forward the Wireguard listening port and configure my other devices to access this machine through Wireguard
However, I don't have enough hindsight to know whether this is a sufficient layer of security to at least prevent bots from accessing my data or compromising my machine.
I've also seen Wireguard-based solutions like Tailscale or Netbird that seem to make configuration easier, but I have a hard time knowing if it would really be useful in my case (and I don't really get what else they are doing despite simplifying the setup).
Do you have any opinions on this? Are there any obvious security holes in what I've said? Is setting up a VPN really the solution in my case?
Thanks in advance for your answers!
Wireguard with WG Tunnel on my phone so it automatically connects when I leave my WiFi. Some Apps excluded to use it like Android Auto because it doesn't work with an active vpn.
-
For the vps, will you go with a provider like digital ocean?
I went with a Racknerd debian 12 box, DigitalOcean is a bit overpriced for what you get. There's a whole list of recommendations in Pangolin's wiki iirc
-
haven't looked at Pangolin, but thanks for the info! I might explore it in the future if my current setup gives me any issues.
Getting it up and running was pretty easy but admittedly I'm starting to hit some snags with split DNS and Authentik. Totally doable but taking a lot of work for sure.
In the process I'm also moving my entire domain to a different name and got timed out by letsencrypt lmao so I guess I'll try some more tomorrow.
-
Hello,
Some time ago, I started self-hosting applications, but only on my local network. So far, it's working fine, but I can't access them as soon as I go outside (which is completely normal).
For the past few days I've been looking for a relatively secure way of accessing my applications from outside.
I don't need anyone but myself to have access to my applications, so from what I've understood, it's not necessarily useful to set up a reverse-proxy in that case and it would be simpler to set up a VPN.
From what I've seen, Wireguard seems to be a good option. At first glance, I'd have to install it on the machine containing my applications, port-forward the Wireguard listening port and configure my other devices to access this machine through Wireguard
However, I don't have enough hindsight to know whether this is a sufficient layer of security to at least prevent bots from accessing my data or compromising my machine.
I've also seen Wireguard-based solutions like Tailscale or Netbird that seem to make configuration easier, but I have a hard time knowing if it would really be useful in my case (and I don't really get what else they are doing despite simplifying the setup).
Do you have any opinions on this? Are there any obvious security holes in what I've said? Is setting up a VPN really the solution in my case?
Thanks in advance for your answers!
WireGuard is the fastest method, it’s free, there is no reason not to use it.
-
My Asus router has a a few nice ones
- pretty much any modern asus routers with a mesh setup and if you run merlin it has more security features.
-
Hello,
Some time ago, I started self-hosting applications, but only on my local network. So far, it's working fine, but I can't access them as soon as I go outside (which is completely normal).
For the past few days I've been looking for a relatively secure way of accessing my applications from outside.
I don't need anyone but myself to have access to my applications, so from what I've understood, it's not necessarily useful to set up a reverse-proxy in that case and it would be simpler to set up a VPN.
From what I've seen, Wireguard seems to be a good option. At first glance, I'd have to install it on the machine containing my applications, port-forward the Wireguard listening port and configure my other devices to access this machine through Wireguard
However, I don't have enough hindsight to know whether this is a sufficient layer of security to at least prevent bots from accessing my data or compromising my machine.
I've also seen Wireguard-based solutions like Tailscale or Netbird that seem to make configuration easier, but I have a hard time knowing if it would really be useful in my case (and I don't really get what else they are doing despite simplifying the setup).
Do you have any opinions on this? Are there any obvious security holes in what I've said? Is setting up a VPN really the solution in my case?
Thanks in advance for your answers!
In that case, wireguard. I only occasionally need to access a service that's not exposed to the internet, so I use
ssh -L, but that would be quite inconvenient for your own use case.I know tailscale exists but I've never used it, only tried wireguard on its own. Maybe there's some huge benefit to using it but wireguard worked fine for me.
-
Hello,
Some time ago, I started self-hosting applications, but only on my local network. So far, it's working fine, but I can't access them as soon as I go outside (which is completely normal).
For the past few days I've been looking for a relatively secure way of accessing my applications from outside.
I don't need anyone but myself to have access to my applications, so from what I've understood, it's not necessarily useful to set up a reverse-proxy in that case and it would be simpler to set up a VPN.
From what I've seen, Wireguard seems to be a good option. At first glance, I'd have to install it on the machine containing my applications, port-forward the Wireguard listening port and configure my other devices to access this machine through Wireguard
However, I don't have enough hindsight to know whether this is a sufficient layer of security to at least prevent bots from accessing my data or compromising my machine.
I've also seen Wireguard-based solutions like Tailscale or Netbird that seem to make configuration easier, but I have a hard time knowing if it would really be useful in my case (and I don't really get what else they are doing despite simplifying the setup).
Do you have any opinions on this? Are there any obvious security holes in what I've said? Is setting up a VPN really the solution in my case?
Thanks in advance for your answers!
Not running anything myself but am part of a self hosting discord that swears by Netbird because its basically Tailscale but with a bunch more ease of use features apparently
-
Hello,
Some time ago, I started self-hosting applications, but only on my local network. So far, it's working fine, but I can't access them as soon as I go outside (which is completely normal).
For the past few days I've been looking for a relatively secure way of accessing my applications from outside.
I don't need anyone but myself to have access to my applications, so from what I've understood, it's not necessarily useful to set up a reverse-proxy in that case and it would be simpler to set up a VPN.
From what I've seen, Wireguard seems to be a good option. At first glance, I'd have to install it on the machine containing my applications, port-forward the Wireguard listening port and configure my other devices to access this machine through Wireguard
However, I don't have enough hindsight to know whether this is a sufficient layer of security to at least prevent bots from accessing my data or compromising my machine.
I've also seen Wireguard-based solutions like Tailscale or Netbird that seem to make configuration easier, but I have a hard time knowing if it would really be useful in my case (and I don't really get what else they are doing despite simplifying the setup).
Do you have any opinions on this? Are there any obvious security holes in what I've said? Is setting up a VPN really the solution in my case?
Thanks in advance for your answers!
There's no magic bullet here. If you want good defense against bots you should use fail2ban and/or crowdsec. Geoblocking is also worth looking into. You will always have to open a port if you are selfhosting a VPN and will need to take aforementioned steps (or alternatives) to secure it. I believe Tailscale is a very good alternative for people who don't have time to do this as it does not (to the best of my knowledge) require you to expose a port.
I use Netbird (open source networking software from a German company) as it integrates well with Authentik and allows me to use the same SSO for VPN and most of my other services. Setting it up with Authentik and Nginx is a bit complicated but very well documented in my opinion. I do not have a positive experience of the official Android client but Jetbird is a nice alternative. Setting up DNS servers and network routes through peers is quite easy. Enrollment is also a breeze due to the Authentik integration.
-
I like zerotier over wireguard because it's one layer lower. So anything that uses Ethernet frames can be routed over it like it was a network switch plugged into your computer. This is probably why mdns works.
wrote last edited by [email protected]Do you test public WiFi with ZeroTier at all?
I ask because there's a few public networks where WG won't connect and I'm trying to find ways around it. I could always use cell data but this is more fun to me.
-
Hello,
Some time ago, I started self-hosting applications, but only on my local network. So far, it's working fine, but I can't access them as soon as I go outside (which is completely normal).
For the past few days I've been looking for a relatively secure way of accessing my applications from outside.
I don't need anyone but myself to have access to my applications, so from what I've understood, it's not necessarily useful to set up a reverse-proxy in that case and it would be simpler to set up a VPN.
From what I've seen, Wireguard seems to be a good option. At first glance, I'd have to install it on the machine containing my applications, port-forward the Wireguard listening port and configure my other devices to access this machine through Wireguard
However, I don't have enough hindsight to know whether this is a sufficient layer of security to at least prevent bots from accessing my data or compromising my machine.
I've also seen Wireguard-based solutions like Tailscale or Netbird that seem to make configuration easier, but I have a hard time knowing if it would really be useful in my case (and I don't really get what else they are doing despite simplifying the setup).
Do you have any opinions on this? Are there any obvious security holes in what I've said? Is setting up a VPN really the solution in my case?
Thanks in advance for your answers!
I used wireguard self hosted for a bit but my work network is pretty locked down and I couldn't find a UDP port that wasn't blocked. How are you guys setting up wireguard in your home network? Or is it better to host it on a cloud VM?
I'm using tailscale right now because it punches through every firewall but I don't like using external providers and I'm worried it will eventually enshittify. I have a cloudflare domain but I can't really use any UDP port for my VPN as it's blocked.
-
I used wireguard self hosted for a bit but my work network is pretty locked down and I couldn't find a UDP port that wasn't blocked. How are you guys setting up wireguard in your home network? Or is it better to host it on a cloud VM?
I'm using tailscale right now because it punches through every firewall but I don't like using external providers and I'm worried it will eventually enshittify. I have a cloudflare domain but I can't really use any UDP port for my VPN as it's blocked.
-
I thought I would be the only one to try this. Would you share more details on your setup? I am interested because to me Wireguard is in the kernel so how could it be in a container.
wrote last edited by [email protected]Oh yeah.
https://hub.docker.com/r/linuxserver/wireguardBasically, docker can and does create network devices. It's as easy for it to create wg0's as it is to create networks for your other docker containers. If you're going to run wireguard and docker, you're better off to let docker handle the network routing and just run one of the various containers out there to stop them from fighting. That particular container is more general. You can run it client or server. Wg-easy, I believe is server-only, or even hide it inside other containers like docker-qbittorrent-wireguard, where it just hangs out and connects to whatever .conf you give it.
I did the whole thing in my early days selfhosting where I installed wireguard, docker, some apps, rebooted, everything breaks.
Install a wireguard container, configure it as you would, your apps, reboot... it still works, because docker isn't conflicting with native wg-quick. It's either this, or untangle and make an iptables setup permanent so when you reboot, it doesn't break again.
-
Hello,
Some time ago, I started self-hosting applications, but only on my local network. So far, it's working fine, but I can't access them as soon as I go outside (which is completely normal).
For the past few days I've been looking for a relatively secure way of accessing my applications from outside.
I don't need anyone but myself to have access to my applications, so from what I've understood, it's not necessarily useful to set up a reverse-proxy in that case and it would be simpler to set up a VPN.
From what I've seen, Wireguard seems to be a good option. At first glance, I'd have to install it on the machine containing my applications, port-forward the Wireguard listening port and configure my other devices to access this machine through Wireguard
However, I don't have enough hindsight to know whether this is a sufficient layer of security to at least prevent bots from accessing my data or compromising my machine.
I've also seen Wireguard-based solutions like Tailscale or Netbird that seem to make configuration easier, but I have a hard time knowing if it would really be useful in my case (and I don't really get what else they are doing despite simplifying the setup).
Do you have any opinions on this? Are there any obvious security holes in what I've said? Is setting up a VPN really the solution in my case?
Thanks in advance for your answers!
If your traffic is pretty low, rent a VPS for $5/month or whatever and set up a Wireguard server on it, have your devices maintain a connection to it (search keepalive for Wireguard), and set up HAProxy to do SNI-based routing for your various subdomains to the appropriate device.
Benefits:
- you control everything, so switching to a new provider is as simple as copying configs instead of reconfiguring everything
- most VPN companies only route traffic going out, not in; you can probably find one that does, but it probably costs more than the DIY option
- easy to share with others, just give a URL
Downsides:
- more complicated to configure
- bandwidth limitations
If you only need access on devices you control, something like Tailscale could work.
Benefits:
- very simple setup - Tailscale supports a ton of things
- potentially free, depending on your needs
Downsides:
- no public access, so you'd need to configure every device that wants to access it
- you don't control it, so if Tailscale goes evil, you'd need to change everything
I did the first and it works well.
-
Hello,
Some time ago, I started self-hosting applications, but only on my local network. So far, it's working fine, but I can't access them as soon as I go outside (which is completely normal).
For the past few days I've been looking for a relatively secure way of accessing my applications from outside.
I don't need anyone but myself to have access to my applications, so from what I've understood, it's not necessarily useful to set up a reverse-proxy in that case and it would be simpler to set up a VPN.
From what I've seen, Wireguard seems to be a good option. At first glance, I'd have to install it on the machine containing my applications, port-forward the Wireguard listening port and configure my other devices to access this machine through Wireguard
However, I don't have enough hindsight to know whether this is a sufficient layer of security to at least prevent bots from accessing my data or compromising my machine.
I've also seen Wireguard-based solutions like Tailscale or Netbird that seem to make configuration easier, but I have a hard time knowing if it would really be useful in my case (and I don't really get what else they are doing despite simplifying the setup).
Do you have any opinions on this? Are there any obvious security holes in what I've said? Is setting up a VPN really the solution in my case?
Thanks in advance for your answers!
Tailscale. You can make a free account and they have clients for most things. If you want to self host, Headscale.
-
Run WireGuard on some home machine. (Does not need to be the machine the app you want to access is hosted on.)
Run WireGuard on your road warrior system.
There is no step 3.
I'm doing this right now from halfway around the world from my house and it's been great. Been using iPhone, iPad, and macOS clients connected to linuxserver/WireGuard docker container. Been doing this on many WiFi networks and 5G, no difference.
Doesn't that need like a static IP address, port forwarding and dealing all kind of network annoyances?
Recommending wireguard to people feels like recommending Arch to first time Linux users.
-
I used wireguard self hosted for a bit but my work network is pretty locked down and I couldn't find a UDP port that wasn't blocked. How are you guys setting up wireguard in your home network? Or is it better to host it on a cloud VM?
I'm using tailscale right now because it punches through every firewall but I don't like using external providers and I'm worried it will eventually enshittify. I have a cloudflare domain but I can't really use any UDP port for my VPN as it's blocked.
I got a VPS because I'm behind CGNAT, and then configured WireGuard on the server and HAProxy to proxy requests to my devices.
It works well for me.
-
Doesn't that need like a static IP address, port forwarding and dealing all kind of network annoyances?
Recommending wireguard to people feels like recommending Arch to first time Linux users.
You don't need a static IP address, but you do need a public IP address. You can use dynamic DNS to avoid having to keep track of your IP address. FreeDNS will work fine for a basic setup.
Wireguard is one of the easiest VPN servers to use. If you're not using your ISP's router, it may even have Wireguard built in.
-
I went with a Racknerd debian 12 box, DigitalOcean is a bit overpriced for what you get. There's a whole list of recommendations in Pangolin's wiki iirc
Thank you, might give it a shot.
-
Do you test public WiFi with ZeroTier at all?
I ask because there's a few public networks where WG won't connect and I'm trying to find ways around it. I could always use cell data but this is more fun to me.
Yeah it's worked everywhere I've tested. But that's only really been airport WiFi, so I'm not sure it's indicative of it working in general. It's easy enough to setup for testing that it's probably worth a shot
-
If your traffic is pretty low, rent a VPS for $5/month or whatever and set up a Wireguard server on it, have your devices maintain a connection to it (search keepalive for Wireguard), and set up HAProxy to do SNI-based routing for your various subdomains to the appropriate device.
Benefits:
- you control everything, so switching to a new provider is as simple as copying configs instead of reconfiguring everything
- most VPN companies only route traffic going out, not in; you can probably find one that does, but it probably costs more than the DIY option
- easy to share with others, just give a URL
Downsides:
- more complicated to configure
- bandwidth limitations
If you only need access on devices you control, something like Tailscale could work.
Benefits:
- very simple setup - Tailscale supports a ton of things
- potentially free, depending on your needs
Downsides:
- no public access, so you'd need to configure every device that wants to access it
- you don't control it, so if Tailscale goes evil, you'd need to change everything
I did the first and it works well.
I would not recommend relying on Tailscale. They have been soliciting a lot of venture capital lately and are probably going to go for an IPO sooner or later. I would not put a lot of trust in that company. The investors are going to want their money.
