What are your VPN recommendations for accessing self-hosted applications from the outside?
-
Tailscale is very tempting, on one hand it should provide a pretty good layer of security without too much thinking and it is "free", and on another hand, it's a business solution, so it is probably not really free...
Thanks for the answer anyway confirming that Tailscale is pretty easy to setup !
Headscale is an open source implementation of the Tailscale control server.
https://github.com/juanfont/headscale
Not an endorsement as I haven't used it (I do use Tailscale), but just thought I'd point it out.
-
Hello,
Some time ago, I started self-hosting applications, but only on my local network. So far, it's working fine, but I can't access them as soon as I go outside (which is completely normal).
For the past few days I've been looking for a relatively secure way of accessing my applications from outside.
I don't need anyone but myself to have access to my applications, so from what I've understood, it's not necessarily useful to set up a reverse-proxy in that case and it would be simpler to set up a VPN.
From what I've seen, Wireguard seems to be a good option. At first glance, I'd have to install it on the machine containing my applications, port-forward the Wireguard listening port and configure my other devices to access this machine through Wireguard
However, I don't have enough hindsight to know whether this is a sufficient layer of security to at least prevent bots from accessing my data or compromising my machine.
I've also seen Wireguard-based solutions like Tailscale or Netbird that seem to make configuration easier, but I have a hard time knowing if it would really be useful in my case (and I don't really get what else they are doing despite simplifying the setup).
Do you have any opinions on this? Are there any obvious security holes in what I've said? Is setting up a VPN really the solution in my case?
Thanks in advance for your answers!
Tailscale is easier than Wireguard but if you're running OPNsense or OpenWRT it's not hard to do a wireguard infra of your own and avoid having to use an outside service. I ended up having to revert to wireguard anyway because Tailscale's android app wasn't reliable on my new phone, it would drop out every few hours which messed up my monitor/alert system.
But Tailscale is still the easier of the two solutions.
-
Ahh. But what if you already used a VPN on the client for normal browsing etc - can you have two VPNs configured?
I don't think iOS allows multiple VPNs to be enabled simultaneously. There appears to be only one VPN on/off toggle switch. From what I've seen you can have different vpn profiles but only enable one at a time. I could be wrong though.
Desktop operating systems like macOS, Linux (did I mention yet that I use arch Linux?), BSD, and um.. that other one... oh yeah, Windows do allow this. I'm sure there are a variety of compatibility problems, but in general, multiple VPNs with the same or even different technologies can work together.
-
Hello,
Some time ago, I started self-hosting applications, but only on my local network. So far, it's working fine, but I can't access them as soon as I go outside (which is completely normal).
For the past few days I've been looking for a relatively secure way of accessing my applications from outside.
I don't need anyone but myself to have access to my applications, so from what I've understood, it's not necessarily useful to set up a reverse-proxy in that case and it would be simpler to set up a VPN.
From what I've seen, Wireguard seems to be a good option. At first glance, I'd have to install it on the machine containing my applications, port-forward the Wireguard listening port and configure my other devices to access this machine through Wireguard
However, I don't have enough hindsight to know whether this is a sufficient layer of security to at least prevent bots from accessing my data or compromising my machine.
I've also seen Wireguard-based solutions like Tailscale or Netbird that seem to make configuration easier, but I have a hard time knowing if it would really be useful in my case (and I don't really get what else they are doing despite simplifying the setup).
Do you have any opinions on this? Are there any obvious security holes in what I've said? Is setting up a VPN really the solution in my case?
Thanks in advance for your answers!
Zero tier. I went tailscale originally, and they're good, but their mdns support doesn't exist and several services rely on it. (For me, the showstopper was time machine backups)
-
Wireguard is the way to go. I like using wg-easy to use wireguard because its easy to set up in a docker container.
Agree, highly recommend this and/or Tailscale.
-
Hello,
Some time ago, I started self-hosting applications, but only on my local network. So far, it's working fine, but I can't access them as soon as I go outside (which is completely normal).
For the past few days I've been looking for a relatively secure way of accessing my applications from outside.
I don't need anyone but myself to have access to my applications, so from what I've understood, it's not necessarily useful to set up a reverse-proxy in that case and it would be simpler to set up a VPN.
From what I've seen, Wireguard seems to be a good option. At first glance, I'd have to install it on the machine containing my applications, port-forward the Wireguard listening port and configure my other devices to access this machine through Wireguard
However, I don't have enough hindsight to know whether this is a sufficient layer of security to at least prevent bots from accessing my data or compromising my machine.
I've also seen Wireguard-based solutions like Tailscale or Netbird that seem to make configuration easier, but I have a hard time knowing if it would really be useful in my case (and I don't really get what else they are doing despite simplifying the setup).
Do you have any opinions on this? Are there any obvious security holes in what I've said? Is setting up a VPN really the solution in my case?
Thanks in advance for your answers!
wrote last edited by [email protected]I rarely if ever see ZeroTier mentioned as a solution, but it's a self-hostable encrypted virtual mesh network (with a small free tier for corp-hosted), super secure, and really easy to setup. I use ZTnet instead of the free-tier corp-hosted controller
-
I didn't say you need it. I strongly recommend the as a provider.
Please do enlighten me how you use Mullvad to access you self-hosted services in your home? Like OP asked for.
-
Hello,
Some time ago, I started self-hosting applications, but only on my local network. So far, it's working fine, but I can't access them as soon as I go outside (which is completely normal).
For the past few days I've been looking for a relatively secure way of accessing my applications from outside.
I don't need anyone but myself to have access to my applications, so from what I've understood, it's not necessarily useful to set up a reverse-proxy in that case and it would be simpler to set up a VPN.
From what I've seen, Wireguard seems to be a good option. At first glance, I'd have to install it on the machine containing my applications, port-forward the Wireguard listening port and configure my other devices to access this machine through Wireguard
However, I don't have enough hindsight to know whether this is a sufficient layer of security to at least prevent bots from accessing my data or compromising my machine.
I've also seen Wireguard-based solutions like Tailscale or Netbird that seem to make configuration easier, but I have a hard time knowing if it would really be useful in my case (and I don't really get what else they are doing despite simplifying the setup).
Do you have any opinions on this? Are there any obvious security holes in what I've said? Is setting up a VPN really the solution in my case?
Thanks in advance for your answers!
My Asus router has a a few nice ones
-
My Asus router has a a few nice ones
This is a pointless comment. You don't even tell us what model router you're running...
-
Zero tier. I went tailscale originally, and they're good, but their mdns support doesn't exist and several services rely on it. (For me, the showstopper was time machine backups)
huh. I knew there was a reason for me to go back to ZT. mdns, you say? Nice to know!
-
I'm in camp #2. Only my Gmail address can access my apps from outside my home. It's a little bit of a pain to configure the rules, but once it's done it's done. I've been happy with it.
You do need to have a domain name though.
pretty cheap to get a domain name through Cloudflare too - nine bucks a year for a .com , I think? Just get something completely personal or completely random!
They even have a way to get emails routed to your general inbox. It's fugly, but it works! -
The variant version of number 2, which is more work to set up of course, is Pangolin on a VPS. Basically serves the same purpose but skips Cloudflare entirely.
I'm in the process of setting up Pangolin and Headscale on a VPS to expose a small handful of services and to replace my wg-easy setup. Currently chaining wg-easy through a gluetun container, so with a single VPN connection I get LAN access and protect my outbound traffic, but I can't for the life of me get the same setup working on wg-easy v15, so I'm going to give tailscale/headscale a try with a gluetun exit node.
haven't looked at Pangolin, but thanks for the info! I might explore it in the future if my current setup gives me any issues.
-
Agree, highly recommend this and/or Tailscale.
wrote last edited by [email protected]Double-pro. Running wireguard on docker assures that a native wireguard install won't conflict with docker. Keep those iptables in the same place.
-
Zero tier. I went tailscale originally, and they're good, but their mdns support doesn't exist and several services rely on it. (For me, the showstopper was time machine backups)
wrote last edited by [email protected]I like zerotier over wireguard because it's one layer lower. So anything that uses Ethernet frames can be routed over it like it was a network switch plugged into your computer. This is probably why mdns works.
-
Double-pro. Running wireguard on docker assures that a native wireguard install won't conflict with docker. Keep those iptables in the same place.
I thought I would be the only one to try this. Would you share more details on your setup? I am interested because to me Wireguard is in the kernel so how could it be in a container.
-
Headscale is an open source implementation of the Tailscale control server.
https://github.com/juanfont/headscale
Not an endorsement as I haven't used it (I do use Tailscale), but just thought I'd point it out.
I use headscale and it's been working wonderfully for my nightly offsite backups and remote access.
-
Hello,
Some time ago, I started self-hosting applications, but only on my local network. So far, it's working fine, but I can't access them as soon as I go outside (which is completely normal).
For the past few days I've been looking for a relatively secure way of accessing my applications from outside.
I don't need anyone but myself to have access to my applications, so from what I've understood, it's not necessarily useful to set up a reverse-proxy in that case and it would be simpler to set up a VPN.
From what I've seen, Wireguard seems to be a good option. At first glance, I'd have to install it on the machine containing my applications, port-forward the Wireguard listening port and configure my other devices to access this machine through Wireguard
However, I don't have enough hindsight to know whether this is a sufficient layer of security to at least prevent bots from accessing my data or compromising my machine.
I've also seen Wireguard-based solutions like Tailscale or Netbird that seem to make configuration easier, but I have a hard time knowing if it would really be useful in my case (and I don't really get what else they are doing despite simplifying the setup).
Do you have any opinions on this? Are there any obvious security holes in what I've said? Is setting up a VPN really the solution in my case?
Thanks in advance for your answers!
Wireguard with WG Tunnel on my phone so it automatically connects when I leave my WiFi. Some Apps excluded to use it like Android Auto because it doesn't work with an active vpn.
-
For the vps, will you go with a provider like digital ocean?
I went with a Racknerd debian 12 box, DigitalOcean is a bit overpriced for what you get. There's a whole list of recommendations in Pangolin's wiki iirc
-
haven't looked at Pangolin, but thanks for the info! I might explore it in the future if my current setup gives me any issues.
Getting it up and running was pretty easy but admittedly I'm starting to hit some snags with split DNS and Authentik. Totally doable but taking a lot of work for sure.
In the process I'm also moving my entire domain to a different name and got timed out by letsencrypt lmao so I guess I'll try some more tomorrow.
-
Hello,
Some time ago, I started self-hosting applications, but only on my local network. So far, it's working fine, but I can't access them as soon as I go outside (which is completely normal).
For the past few days I've been looking for a relatively secure way of accessing my applications from outside.
I don't need anyone but myself to have access to my applications, so from what I've understood, it's not necessarily useful to set up a reverse-proxy in that case and it would be simpler to set up a VPN.
From what I've seen, Wireguard seems to be a good option. At first glance, I'd have to install it on the machine containing my applications, port-forward the Wireguard listening port and configure my other devices to access this machine through Wireguard
However, I don't have enough hindsight to know whether this is a sufficient layer of security to at least prevent bots from accessing my data or compromising my machine.
I've also seen Wireguard-based solutions like Tailscale or Netbird that seem to make configuration easier, but I have a hard time knowing if it would really be useful in my case (and I don't really get what else they are doing despite simplifying the setup).
Do you have any opinions on this? Are there any obvious security holes in what I've said? Is setting up a VPN really the solution in my case?
Thanks in advance for your answers!
WireGuard is the fastest method, it’s free, there is no reason not to use it.
