Means to privately connect to my home server other than Tailscale?

Submitted ⁨⁨5⁩ ⁨hours⁩ ago⁩ by ⁨myszka@lemmy.ml⁩ to ⁨selfhosted@lemmy.world⁩

Wireguard is blocked in my country, so I no longer can use Tailscale or other Wireguard-based solutions. My home server is behind a NAT. What other ways of secure private connection can I use?

original

Comments

Sort:hotnew top

kugmo@sh.itjust.works ⁨1⁩ ⁨hour⁩ ago
AmneziaWG is a Wireguard fork built against deep packet inspection, try that.

original
- xthexder@l.sw0.com ⁨42⁩ ⁨minutes⁩ ago
  Neat, I might have to set this up for myself. It sounds like it could get around some of the VPN blocking I’ve seen while traveling through airports.
  
  original
MuttMutt@lemmy.world ⁨1⁩ ⁨hour⁩ ago
First, you need to verify whether you actually have a public IP or if your ISP has you stuck behind CG-NAT, because that dictates your options.

If you’re behind CG-NAT, Cloudflare Tunnel (cloudflared): This is usually the easiest path if you are mostly trying to access web-based services (HTTP/HTTPS) on your server. Your home server initiates the outbound connection to Cloudflare, so CG-NAT doesn’t matter. You just set up a domain (or subdomains) for each service you want to reach. If you need full network-level or SSH access rather than just web apps, check out ZeroTier.

If you have a direct public IP (even a dynamic one), you can run a reverse proxy like Caddy paired with a free DDNS provider like DuckDNS or FreeDNS. One nice thing about Caddy is that it handles getting and renewing real, valid Let’s Encrypt SSL certificates automatically, so you don’t have to deal with manual or self-signed certs at all.

Dealing with the WireGuard block, if your country’s ISP is using Deep Packet Inspection (DPI) to identify and drop WireGuard traffic, traditional VPNs like OpenVPN might get blocked pretty quickly too. If you still want a true VPN setup, look into AmneziaWG (it’s a fork of WireGuard specifically modified to scramble packet signatures and bypass DPI) or obfuscated proxy protocols like V2Ray / Xray or Shadowsocks.

original
hendrik@palaver.p3x.de ⁨5⁩ ⁨hours⁩ ago
https://github.com/erebe/wstunnel

Or maybe OpenVPN over nirmal TLS on port 443.

You could also try to run wireguard on a different port which would be otherwise used by some common service…

original
- shininghero@pawb.social ⁨4⁩ ⁨hours⁩ ago
  OpenVPN is my current method. Got it running on port 443 with user certificate authentication, and tls-crypt on top of that to completely mask the protocol from VPN detectors.
  
  Also technically prevents DoS attacks, but that wasn’t my primary goal.
  
  original
- hoshikarakitaridia@lemmy.world ⁨4⁩ ⁨hours⁩ ago
  Does netbird run on wg on on ovpn as well? Maybe that’s an option…
  
  original
  - hendrik@palaver.p3x.de ⁨4⁩ ⁨hours⁩ ago
    I’m not really an expert on VPN, but I believe solutions like Tailscale, Netbird, Pangolin all leverage the Wireguard protocol.
    
    original
    -> View More Comments
  - Dojan@pawb.social ⁨3⁩ ⁨hours⁩ ago
    NetBird is Wireguard yes.
    
    original
exu@feditown.com ⁨4⁩ ⁨hours⁩ ago
Self hosted networking! Legitimately one of my favourite topics

You won’t get around the requirement of a publicly reachable endpoint. That can either be a small server with a public ip or dynamic DNS to your home with port forwarding for the VPN.

A classic option is OpenVPN. You can run it on Port 443 in TCP mode and while it won’t be performant, it has a better chance of bypassing most simple blocks

Other than that I’m a fan of completely decentralized mesh VPNs.

The one I use and am most familiar with is Yggdrasil. Connections can be established over TCP, TLS or QUIC on any port you want.
I’ve written a somewhat lengthy comment under this post. One advantage to Yggdrasil would be its existing public network. If you can firewall of your home lab to the point where joining the public network doesn’t expose a security risk to your local network, you could use that to transport your traffic instead of having your own public node or port forwarding.

The same post also mentions Anywherelan, it’s intended to have better NAT handling out of the box by using community nodes.

Then there’s also EasyTier mentioned at the bottom, it is a Chinese project and those tend to have good censorship resistance.

Finally I’ll mention Nebula, it requires at least one coordination server but might also be an option

original
- possiblylinux127@lemmy.zip ⁨1⁩ ⁨hour⁩ ago
  Nebula might actually work as it doesn’t use Wireguard
  
  original
- Tiger@sh.itjust.works ⁨2⁩ ⁨hours⁩ ago
  Thank you for your info, I’ll be checking out these projects.
  
  original

Decronym@lemmy.decronym.xyz ⁨1⁩ ⁨hour⁩ ago

Acronyms, initialisms, abbreviations, contractions, and other phrases which expand to something larger, that I’ve seen in this thread:

Fewer Letters	More Letters
DNS	Domain Name Service/System
ISP	Internet Service Provider
NAT	Network Address Translation
SSH	Secure Shell for remote terminal access
TLS	Transport Layer Security, supersedes SSL
VPN	Virtual Private Network
VPS	Virtual Private Server (opposed to shared hosting)

[Thread #84 for this comm, first seen 21st Aug 2026, 16:20] [FAQ] [Full list] [Contact] [Source code]

original

BCsven@lemmy.ca ⁨1⁩ ⁨hour⁩ ago
Can you port forward on the router?

original
possiblylinux127@lemmy.zip ⁨1⁩ ⁨hour⁩ ago
Possibly Tor? It supports TCP traffic so SSH should work

Outside of that I would look into censorship resistant protocols and techniques. What country are you in?

original
bjoern_tantau@swg-empire.de ⁨4⁩ ⁨hours⁩ ago
Port forward your SSH-server. You can forward ports through SSH to access web services or others running on the server or anything else in the network.

But only allow access through keys. And maybe try to use a different port than 22. That usually gets hammered a lot, trying to find accounts with weak passwords.

original
- possiblylinux127@lemmy.zip ⁨1⁩ ⁨hour⁩ ago
  Changing the port doesn’t actually accomplish much
  
  Best practice is to just harden SSH so that not traffic gets nowhere
  
  original
gooeyglob@lemmy.world ⁨4⁩ ⁨hours⁩ ago
Big Netbird fan, and they support a fully self hosted version.

original
talkingpumpkin@lemmy.world ⁨4⁩ ⁨hours⁩ ago
Wow. Do they block VPNs inside your country too?

Anyway, there’s openvpn and there’s nebula (I think nebula doesn’t use wireguard… do double-check), or you look into things built specifically to hide traffic (keyword: “vpn obfuscation”).

No idea if VPN protocols other than wireguard may be blocked too (probably?).
No idea if trying too hard to circumvent government policies may get you added to some list you’d rather not be in.

original
- Tiger@sh.itjust.works ⁨2⁩ ⁨hours⁩ ago
  Wireguard is effectively blocked in China, from my experience so far.
  
  original
  - possiblylinux127@lemmy.zip ⁨1⁩ ⁨hour⁩ ago
    China uses deep packet inspection so that makes sense
    
    I think the the great Firewall is less restrictive with QUIC traffic. It might be worth trying fragmented QUIC as from what I’ve read the GFW struggles to reconstruct the traffic
    
    original
- FedX@quokk.au ⁨4⁩ ⁨hours⁩ ago
  From what I can tell, the issue with Wireguard is that the traffic is quite obvious. Other options might be blocked, but technically harder to implement said blocks.
  
  original
damnthefilibuster@lemmy.world ⁨4⁩ ⁨hours⁩ ago
See if you can use ZeroTier. It doesn’t use wire guard but rather their own protocol as far as I know.

original
FedX@quokk.au ⁨4⁩ ⁨hours⁩ ago
That’s quite fascinating, didn’t realize Wireguard could be blocked in that way (although the WG traffic is pretty obvious looking, so it makes sense). The only solution I know of without a need for a VPS is hosting everything on Tor. Wildly private and secure, but also wildly slow. Beyond that, there are a number of ways of using a VPS to similar effect, I know people have used Cloudflare Tunnel to similar effect in the past.

Also, there are apparently quite a number of wiregaurd derivatives which protect better against detection and blocking methods. amnezia and (wstunnel)[https://github.com/erebe/wstunnel] are the two that came up. Likewise, you will need a VPS, and might even be able to set up a tailscale-like coordination server that way (maybe with headscale, or maybe with one of its competitors like NetBird).

ZeroTier might also get the job done, but I really don’t know much about it.

Hope this helps, and good lucks!

original
Nikki@lemmy.blahaj.zone ⁨4⁩ ⁨hours⁩ ago
I had luck with zerotier before switching to wireguard, but I imagine it has similar issues as talescale. Worth a try

original
Auli@lemmy.ca ⁨4⁩ ⁨hours⁩ ago
OpenVPN on port 443 would be my guess. Just regular nat or carrier grade nat.

original
tlekiteki@lemmy.dbzer0.com ⁨4⁩ ⁨hours⁩ ago
There is Nym

original
mushroommunk@lemmy.today ⁨4⁩ ⁨hours⁩ ago
Can you switch to IPv6? My ISP NATs me on IPv4 but I’m clear through on IPv6 and so that’s how I run everything.

I’m assuming the NAT is your ISP’s, if it’s yours then ignore me.

original
somehacker@lemmy.world ⁨4⁩ ⁨hours⁩ ago
www.defined.net

original