Access home server from anywhere

Submitted ⁨⁨1⁩ ⁨year⁩ ago⁩ by ⁨jaykay@lemmy.zip⁩ to ⁨selfhosted@lemmy.world⁩

Hi, I know this topic has been talked about 70 thousand times but I’m still not sure.

I have home server on an intel NUC behind the ISP router. On it I have the standard arr apps, jellyfin, pi-hole etc etc. I would like to access them through a domain rather than an IP. So I set them up in docker, behind traefik, behind authelia and behind cloudflare. I am the only one that uses it.

Now, I’m worried about the security of it all. I’ve been searching here and there and I’ve read about cf tunnels, wireguard server, vps, vlan, OPNsense etc etc. I still don’t know what would be the most secure. Should I just stay with what I have?

source

Comments

Sort:hotnew top

bless@lemmy.world ⁨1⁩ ⁨year⁩ ago
I would go with wireguard VPN or something like cloudflare tunnels or tailscale. With wireguard you’ll need to open up an external port and forward to your VPN host, but wireguard uses UDP so no one can probe it for responses. CF tunnels and tailscale you don’t have to open up holes in your firewall which is nice.

You also have the option of using a proxy and opening up 443 publicly on your firewall, but unless you know what you’re doing I’d leave that closed until you learn more.

source
- NaibofTabr@infosec.pub ⁨1⁩ ⁨year⁩ ago
  Nah, that sounds complicated. Just open port 22 and forward it your server.
  
  source
  - idunnololz@lemmy.world ⁨1⁩ ⁨year⁩ ago
    Trueeeeeee. Then post your ip here so you’ll remember it later.
    
    source
    -> View More Comments
  - jaykay@lemmy.zip ⁨1⁩ ⁨year⁩ ago
    Thanks, doing that now ;) /s
    
    source
- jaykay@lemmy.zip ⁨1⁩ ⁨year⁩ ago
  Mmmmmm, tunnels sound boring haha I might try figuring out wireguard. Do you have any trusted guides on it? Or should I just google :P
  
  source
  - bless@lemmy.world ⁨1⁩ ⁨year⁩ ago
    Good thing about wireguard is it’s really simple. Google should get it done, if you get stuck send me a DM. I started with basic wireguard, I now run firezone in docker as I like the frontend.
    
    source
    -> View More Comments
  - sunbeam60@lemmy.one ⁨1⁩ ⁨year⁩ ago
    Honestly it couldn’t be simpler. Look at wg-easy docker container. You’ll be up and running in 10 minutes.
    
    source
TCB13@lemmy.world ⁨1⁩ ⁨year⁩ ago
Yes, you can use a Cloudflare tunnel but why since you’re into self-hosting why should you depend on some random company to tunnel your traffic when you most likely don’t need it? You also have all the potential tracking, spyware, risks and “being hostage” scenarios that may come with that choice.

The following assumes your use case is a simple home server for “standard arr apps, jellyfin, pi-hole” for personal usage that sits inside your network and your objetive is to be able to access those services. If you’re instead trying to host a game server / few services for friends (that doesn’t really need to be “inside” your home network) there’s a more complete comment with other security considerations and recommendations here.

Your basic requirements are:

Some kind of domain / subdomain payed or free;

Preferably Home ISP that has provides public IP addresses - no CGNAT BS;

Ideally a static IP at home, but you can do just fine with a dynamic DNS service such as freedns.afraid.org.

Quick setup guide and checklist:

Create your subdomain for the dynamic DNS service freedns.afraid.org and install the daemon on the server - will update your domain with your dynamic IP when it changes;

List what ports you need to access remote;

Setup Wireguard VPN on the server. There’s also this nice UI that can be used to do most of the setup and create client config files;

For the VPN use custom ports with 5 digits - something like 23901 (up to 65535) to make your service harder to find;

Configure your ISP router to assign a static local IP to the server and port forward the VPN port to the server IP;

Only expose absolutely required services (the VPN port in this case) to the Internet. Any service the server provides, SSH, configuration interfaces and whatnot can accessed through the WireGuard VPN;

In the server consider setting up nftables / iptables / another firewall 10 minute guide;

Configure nftables to only allow traffic coming from public IP addresses (IPs outside your home network IP / VPN range) to the Wireguard port - this will protect your server if by some mistake the router starts forwarding more traffic from the internet to the server than it should;

Configure nftables to restrict what countries are allowed to access your server. Most likely you only need to allow incoming connection from your country (wiki.nftables.org/wiki-nftables/…/GeoIP_matching).

Since you’re only allowing access to your services through the VPN and you’ve heavily restricted access to the VPN port you’ll be safe. Just a side note, don’t be afraid to expose the Wireguard port because if someone tried to connect and they don’t authenticate with the right key the server will silently drop the packets.
source
- jaykay@lemmy.zip ⁨1⁩ ⁨year⁩ ago
  Thanks for this awesome write-up.
  
  Yeah, that’s what I’m kind of thinking about Cloudflare, so I’m trying to set up WireGuard right now. I don’t know if I’m shooting myself in the foot by trying to do in docker for now or not, but I’d rather do that before I do it on bare metal. It seems to work already, as I can see that my IP changes on my phone when I access it. Hell, I can even access my routers’ dashboard. However, I still can’t access the services on the server (by IP, like 192.x.x.x:8989), so I’m trying to figure that out.
  
  May I ask, why do I need a domain if I’m going through WireGuard, which goes through the IP and port, anyway?
  
  source
  - lemmyvore@feddit.nl ⁨1⁩ ⁨year⁩ ago
    Before you invest a lot of time into this just wanted to say that it’s a 2m job with Tailscale. You install it on the server and on your phone (or laptop whatever), you start it, and you can access anything on the server at a short name you can customize fully, or at a long name you can pick from randomly generated choices generated by Tailscale. (The long name is usually only relevant if you’re going to expose your server to the internet or in unusual DNS setups, if you just want to access the server from your phone the short name will do.)
    
    source
    -> View More Comments
  - theit8514@lemmy.world ⁨1⁩ ⁨year⁩ ago
    If your home ip changes a lot a dynamic dns provider will keep up with it so you don’t constantly have to change your phone’s wireguard configuration
    
    source
    -> View More Comments
psion1369@lemmy.world ⁨1⁩ ⁨year⁩ ago
Check out Tailscale. They have 20 machine limit on the free plan. It runs on wireguard and is pretty secure.

source
- Rootiest@lemmy.world ⁨1⁩ ⁨year⁩ ago
  Tailscale Free has a 100 device limit.
  
  Virtually its only limitation against the paid plans is the user limit.
  
  And network logging because it’s heavy on their servers.
  
  source
- avidamoeba@lemmy.ca ⁨1⁩ ⁨year⁩ ago
  And there’s an OSS control plane replacement called Headscale although I don’t know what’s involved in using it. That’s my backup plan for when Tailscale turns to shit.
  
  source
  - Rootiest@lemmy.world ⁨1⁩ ⁨year⁩ ago
    I am big into self-hosting and would be happy to run my own Headscale server (I have actually) but imo it’s not worth the effort.
    
    It can be done but it requires a lot of effort and consideration to ensure the relays and routing work for when your clients are in challenging NAT scenarios. And the user experience is not as good.
    
    Instead what I do is continue to use Tailscale but I use the Tailnet Lock feature to give signing authority to my own specified devices so any new devices must be signed off by one of those other devices.
    
    This effectively eliminates the last point of trust where you had to trust tailscale’s servers to manage authorization. The result is you don’t have to worry about trusting tailscale at all, the entire system is zero trust.
    
    The catch is if you lose those devices and the recovery keys you lose the ability to trust or add to your tailnet and your only real option is to delete all the devices and start fresh.
    
    They also have the option to send a recovery key to their servers so support can rescue you in that scenario, but I think if you are using this feature on the first place it’s because you don’t want to do that so I imagine most choose not to lol
    
    source
  - uzay@infosec.pub ⁨1⁩ ⁨year⁩ ago
    Setting up headscale isn’t too hard. But last time I tried, connecting the clients to it didn’t work properly (on mobile). Since they are using the regular tailscale clients, they don’t have much control over that.
    
    source
    -> View More Comments
- jaykay@lemmy.zip ⁨1⁩ ⁨year⁩ ago
  Wireguard itself works software far, thanks anyway :)
  
  source
- EarthBoundMisfit@lemmy.world ⁨1⁩ ⁨year⁩ ago
  Tailscale is awesome, and super easy to set up. I think the free tier allows up to 100 devices now!
  
  source
- BastingChemina@slrpnk.net ⁨1⁩ ⁨year⁩ ago
  Tailscale is amazing, I work with a small company and we were battling with our IT contractor to have a VPN running for remote work.
  
  After a while of things not working as it should I just set up tailscaled because I was using it with my home server and it just works.
  
  We are now on a paid plan and everyone else is using it when working remotely.
  
  source
devfuuu@lemmy.world [bot] ⁨1⁩ ⁨year⁩ ago
Maybe something like tailscale.

source
- ebits21@lemmy.ca ⁨1⁩ ⁨year⁩ ago
  It’s just so easy.
  
  Headscale if you want to self host.
  
  source
- jaykay@lemmy.zip ⁨1⁩ ⁨year⁩ ago
  I might, but I’m gonna explore the open source solutions first :)
  
  source
  - nis@feddit.dk ⁨1⁩ ⁨year⁩ ago
    I’ve been using Tailscale, it’s lovely. But I didn’t like that I had to use Google/Apple/Github to log in.
    
    Last night I set up a Headscale server which works with the tailscale client. It’s lovely as well.
    
    source
  - netchami@sh.itjust.works ⁨1⁩ ⁨year⁩ ago
    Some Tailscale clients are open-source and you can self-host a Headscale server
    
    source
EncryptKeeper@lemmy.world ⁨1⁩ ⁨year⁩ ago
I use Tailscale with their DDNS feature that generates you a domain that resolves each of your Tailnet devices when connected. You can even run a command that generates an SSL cert for your given node and you can use that to further secure it with TLS in case you don’t want to deal with untrusted cert warnings.

source
- BearOfaTime@lemm.ee ⁨1⁩ ⁨year⁩ ago
  I was about to ask why you’d need DDNS for Tailscale, had no idea about iOS issues. Thanks!
  
  source
  - EncryptKeeper@lemmy.world ⁨1⁩ ⁨year⁩ ago
    Because even when you have static IPs it’s still nice to just use a host name, and to properly secure things with a certificate. It’s not really DDNS as much as it is plain old DNS, but it works without configuration on your part. Once you enable it, whatever the tailnet name of your device is, becomes ‘device name.yourdomain.ts.net’.
    
    source
h3ndrik@feddit.de ⁨1⁩ ⁨year⁩ ago
Make your services password protected and have some software like fail2ban that blocks people from brute-forcing passwords.

Keep your software up to date.

source
- jaykay@lemmy.zip ⁨1⁩ ⁨year⁩ ago
  They are password protected. Plus, behind 2FA authelia. Plus Crowdsec (which originally made me make this post, cos I can see http probing etc on it)
  
  source
  - h3ndrik@feddit.de ⁨1⁩ ⁨year⁩ ago
    Alright. I wouldn’t worry too much, then. If you set it up correctly and you keep it up to date so there aren’t any security vulnerabilities, you should be okay.
    
    Of course there are arbitrary, more strict approaches. You could do monitoring. Or restrict the IP addresses the server answers to. Or put everything behind a VPN and not have it exposed. But I also have my NAS and a few internet services like Nextcloud and it’s been fine, similar to this, for years.
    
    source
    -> View More Comments

Decronym@lemmy.decronym.xyz ⁨1⁩ ⁨year⁩ ago

Acronyms, initialisms, abbreviations, contractions, and other phrases which expand to something larger, that I’ve seen in this thread:

Fewer Letters	More Letters
CF	CloudFlare
DNS	Domain Name Service/System
HTTP	Hypertext Transfer Protocol, the Web
HTTPS	HTTP over SSL
IP	Internet Protocol
SSL	Secure Sockets Layer, for transparent encryption
UDP	User Datagram Protocol, for real-time communications
VPN	Virtual Private Network

[Thread #319 for this sub, first seen 1st Dec 2023, 09:55] [FAQ] [Full list] [Contact] [Source code]

source

onlinepersona@programming.dev ⁨1⁩ ⁨year⁩ ago
Why so complicated? Why not just SSH? Put it on some random port, make it public key login only, and you’re done.

source
- Eris@l.os33.co ⁨1⁩ ⁨year⁩ ago
  This is what I do and I’ve wondered why people always shill for tailscale or cloud flare tunneling, seems like way too much extra bs for the same thing
  
  source
- ExploratrixLunae@kbin.social ⁨1⁩ ⁨year⁩ ago
  I've beeb looking into a similar setup and I didn't know SSH could do this kind of tunneling. Thanks for the tip! I'm going to consider using it.
  
  source
  - onlinepersona@programming.dev ⁨1⁩ ⁨year⁩ ago
    I’m not sure what you mean by tunnel, but SSH allows a “secure shell” aka an encrypted connection to a shell on a device. Tailscale, Headscale, and others are VPNs, which means they allow making it seem as if your computer is in the same (private) network as that of the server - but in order to have a shell on the server, you’ll still need SSH.
    
    To my knowledge, adding a VPN to open a secure shell on the server is unnecessary and has no security benefits.
    
    source
taladar@sh.itjust.works ⁨1⁩ ⁨year⁩ ago
It largely depends on what you mean by ‘anywhere’, in particular if you only want to access it from your own devices or also other people’s you can only access for a minute or two and where you can’t install anything.

Of course there is also the question which services you want to access, e.g. just Websites and -Applications over HTTPS or do you also want e.g. the pi-hole’s DNS service to be available.

source
- jaykay@lemmy.zip ⁨1⁩ ⁨year⁩ ago
  My own devices. Mostly over https. Pi-hole would be nice, but not necessary.
  
  source
JoeKrogan@lemmy.world ⁨1⁩ ⁨year⁩ ago
Duckdns will gicw you a free domain name. Run wireguard on the machine to connect remotely. Only allow WG port for remote access. Optional limit app access to VPN and lan ip. You can also run something like adguard home to get ad blocking. In that case set your wireguard dns as the server ip eg 10.0.0.1 and add your ddg domain name in adguard so it will resolve without having to do an external lookup when on the lan or vpn.

source
- sunbeam60@lemmy.one ⁨1⁩ ⁨year⁩ ago
  I’ve had really poor results with duckdns recently - it seems propagation flakes out every 2-3 months. Wrote to them about it but never had a response.
  
  source
themeatbridge@lemmy.world ⁨1⁩ ⁨year⁩ ago
Is ngrok still a thing?

source
- jaykay@lemmy.zip ⁨1⁩ ⁨year⁩ ago
  Seems like it is
  
  source
  - themeatbridge@lemmy.world ⁨1⁩ ⁨year⁩ ago
    Yep, and it used to be free for personal use, although I don’t know if that’s the case anymore.
    
    source
    -> View More Comments
Nyfure@kbin.social ⁨1⁩ ⁨year⁩ ago
If its only you and you want best security, setup a VPN system. (Tailscale, Netbird, or others are quite easy)
If someone else should also, and you dont want everyone to have to use a VPN, then you can expose some services directly. Of course behind CGNat you need some third-party system to allow this (e.g. cloudflare or a rented server).

I am not a big fan of cloudflare, they are a huge centralized company, easily allowing tracking across websites with clear-text access and kinda discouraging learning how to secure things yourself (which you have to do anyways, because you are a service provider and only cloudflare is not enough if its still publicly accessible though them)
But in the end its your choice. They easily allow you as service provider to protect yourself from DDoS attacks or allowing IPv4 access when you are behind CGNat, things you just cannot easily do yourself, certainly not without costs.

source
nutbutter@discuss.tchncs.de ⁨1⁩ ⁨year⁩ ago
If you are behind CGNAT, this might help you understand things a little better.

source
- jaykay@lemmy.zip ⁨1⁩ ⁨year⁩ ago
  Yeah, I looked it up and checked and I’m not behind CGNAT
  
  source
  - stown@sedd.it ⁨1⁩ ⁨year⁩ ago
    Since you aren’t behind CGNAT you can go full self-hosted! Don’t bother with Tailscale or Cloudflare Tunnel or other VPN services that connect through third parties if you can help it.
    
    Here’s something to get you started with setting up a wire guard server on your NUC. github.com/Nyr/wireguard-install
    
    source
    -> View More Comments
pimeys@lemmy.nauk.io ⁨1⁩ ⁨year⁩ ago
As said in the thread, you need some kind of tunnel that stays up and doesn’t need to be fixed if the internet goes down.

Wireguard, or if wanting super easy setup, Tailscale version of Wireguard great for this. Now you have a private IP address in your VPN network to your home server, that stays up and answers to HTTP. Next thing you need is a cheap VPS somewhere with a public IP address. When that is running, and its in the Wireguard network so you can access your home server from the VPS, you need a Nginx proxy in the public server. Either do it by hand, or use a service such as the Nginx Proxy Manager to handle the proxy setup.

How it basically works is you register a domain name (A, CNAME) to the public VPS service, then with Nginx you setup that anything coming in to the domain X should be proxied to the VPN IP address Y and port Z. Now you can add HTTPS to this domain and get a Let’s Encrypt certificate for it. You can, again, do this manually with Nginx, or let Nginx Proxy Manager handle it for you.

source
possiblylinux127@lemmy.zip ⁨1⁩ ⁨year⁩ ago
First off, don’t expose anything that doesn’t need exposed. If your the only one using it you could use a VPN or ssh.

Second off, make sure you isolate everything with firewalls. Your reverse proxy should only have access to each service and each service should only have access to the reverse proxy. You should also block non essential ports.

For the services themselves, make sure you use strong passwords and keep them updated. For docker you can use watchtower to automatically pull and deploy software.

source
Evotech@lemmy.world ⁨1⁩ ⁨year⁩ ago
Cloudflare is just so nice. Handles ssl for all your sites automatically.

source
Waluigis_Talking_Buttplug@lemmy.world ⁨1⁩ ⁨year⁩ ago
My router supported OpenVPN out of the box so I just use that and have remote connections disabled in all of my software

I’m curious what the other, more advanced users here have to tell me about it because I’m still new to the self hosted stuff and that was the first thing I thought of to do

source
- rooster_butt@lemm.ee ⁨1⁩ ⁨year⁩ ago
  I his is what I sue too, also using the provided dynamic dns server just makes this dead simple and has been working for years. Is there a good reason to switch.
  
  source
- ebits21@lemmy.ca ⁨1⁩ ⁨year⁩ ago
  Wireguard is just much faster connection-wise. Built into the kernel too.
  
  Nothing wrong with openvpn otherwise.
  
  Something like Tailscale makes wireguard setup dead easy.
  
  source
Wander@yiffit.net ⁨1⁩ ⁨year⁩ ago
I’d say to start with CF tunnels unless you need non-web based applications. Cloudflare tunnels require you to have a domain, though.

It has the added benefit that you have network monitoring, logging and some filtering for security that they do on top and you get to manage everything from their web interface.

be warned that the first time can be a bit confusing, but since it’s done using their web interface it’s easier than if you have a problem making wireguard work.

Create a tunnel with a public hostname that will be the url to access that service. During the creation of the hostname specify you want it protected by L7 application firewall.

Create a new self-hosted application in cloudflare application section and for starters use the default login email and in rules specify the list of emails that are allowed to login

you should now be able to access your application from anywhere.

Alternatively, if you have a DNS server in your home network you can add a private IP range to your tunnel. Let’s say 192.168.0.0/24. Then when you connect with their pseudo-VPN (cloudflare warp or cloudflare ONE) you can directly use your home network’s ip address from that device. If you tell your device to use a local DNS server that resolves your internal services, you’ll be able to connect to them that way.
source
- BaroqueInMind@kbin.social ⁨1⁩ ⁨year⁩ ago
  This is he best Cloudflare guide I've seen so far. Thank you!
  
  source
- jaykay@lemmy.zip ⁨1⁩ ⁨year⁩ ago
  Thanks fro this little guide, might come in handy :)
  
  source
spark947@lemm.ee ⁨1⁩ ⁨year⁩ ago
My advice: only forward ports 8080 and 443, then make sure that you have fail2ban or crossed properly set up on your reverse proxy. After that, you are pretty much fine as long as you keep on top of updating your containers.

I would be careful about which apps you proxy. Idk why you need to access the admin portal for pi hole worldwide. If you really want to do that, you should set up a vpn.

source
Apollo2323@lemmy.dbzer0.com ⁨1⁩ ⁨year⁩ ago
I want to have the same setup as you! Do you have any guides on how you did it?

source
- jaykay@lemmy.zip ⁨1⁩ ⁨year⁩ ago
  I have an Intel NUC with i3-4010U, 8GB of RAM and 250GB of storage. Got it for 50GBP off of eBay. Unfortunately, I have to delete shows/movies to watch another, as there isn’t much space, but it manages :)
  
  (I should be paid for how many times I have mentioned this lmao) I used this smarthomebeginner.com. If you follow this guide, you should be good to go :)
  
  source
  - Apollo2323@lemmy.dbzer0.com ⁨1⁩ ⁨year⁩ ago
    Thank you!
    
    source
angelsomething@lemmy.one ⁨1⁩ ⁨year⁩ ago
Twingate has been my go to. It’s amazing. Highly recommended.

source
- jaykay@lemmy.zip ⁨1⁩ ⁨year⁩ ago
  Looks very similar to tailscale, thanks :)
  
  source
Symphonic@lemmy.world ⁨1⁩ ⁨year⁩ ago
You can also try looking into no-ip.

source