I need help figuring out where I am going wrong or being an idiot, if people could point out where…
I have a server running Debian 12 and various docker images (Jellyfin, Home Assistant, etc…) controlled by portainer.
A consumer router assigns static Ip addresses by MAC address. The router lets me define the IP address of a primary/secondary DNS. The router registers itself with DynDNS.
I want to make this remotely accessible.
From what I have read I need to setup a reverse proxy, I have tried to follow various guides to give my server a cert for the reverse proxy but it always fails.
I figure the server needs the dyndns address to point at it but I the scripts pick up the internal IP.
How are people solving this?
Wireguard, simply connect to it whenever I’m out somewhere and boom, instant access to everything on my local network
If it’s only you (or your household) that is accessing the services then something like hosting a tailscale VPN is a relatively user friendly and safe way to set-up remote access.
If not, then you’d probably want to either use the aforementioned Cloudflare tunnels, or set up a reverse proxy container (nginx proxy manager is quite nice for this as it also handles certs and stuff for you). Then port forward ports 80 and 443 to the server (or container if you give it a separate IP). This can be done in your router.
In terms of domain set-up. I’ve always found subdomains (homeassistant.domain.com) to be way less of a hassle compared to directories (domain.com/homeassistant) since the latter may need additional config on the application end.
Get a cheap domain at like Cloudflare and use CNAME records that point domain.com and *.domain.com to your dyndns host. Iirc there’s also some routers/containers that can do ddns with Cloudflare directly, so that might be worth a quick check too.
I am using duckdns.org and let my router ping it when it’s public IP changes. Then I use nginx as a reverse proxy with help of https://nginxproxymanager.com/ so I don’t need to write config files and it also runs certbot for my so I don’t need to deal with https manually.
Actually I also have my own domain so I use a subdomain pointing via CNAME to the duckdns subdomain. This way I can easily change the provider of dyndns.
Try to scout opening ports on your modem. CloudFlare tunnel plus traefik reverse proxy is an option you can go.
There are many how-to guides like Jim’s Garage that walk you through setting it up.
I do it the simple way. I just stick nginx in front of everything. If I don’t want it to be publicly accessible I stick nginx basic auth in front of it.
The advantages is that I can easily access the services from anywhere on any device with just the password. I only need to trust nginx’s basic auth to keep me protected, not various different service’s authentication.
The downside is that some services don’t work great when you have basic auth in the front. This is often due to things like public links or APIs that need to be accessed with other auth.
I just use nginx because I’ve always used it. I’ve heard that there are newer reverse proxies that are a bit easier to configure.
How safe/secure is that approach
It depends on how much you trust nginx. A HTTP server is probably a bit more complex that your average VPN solution so probably more likely to have vulnerabilities, but it is also the most popular web server on the planet, so if there is a zero day I’m probably not the first target. If you stay up to date you are probably fine.
I do that, but only allow access to private services from local IP addresses, rather than putting auth in front of them. Then I use IPsec to access my local-only things.
wireguard and dynamicdns
Acronyms, initialisms, abbreviations, contractions, and other phrases which expand to something larger, that I’ve seen in this thread:
Fewer Letters More Letters CF CloudFlare CGNAT Carrier-Grade NAT DNS Domain Name Service/System HTTP Hypertext Transfer Protocol, the Web IP Internet Protocol NAT Network Address Translation SSL Secure Sockets Layer, for transparent encryption SSO Single Sign-On TLS Transport Layer Security, supersedes SSL VPN Virtual Private Network VPS Virtual Private Server (opposed to shared hosting) nginx Popular HTTP server
[Thread #695 for this sub, first seen 21st Apr 2024, 07:55] [FAQ] [Full list] [Contact] [Source code]
OpenVPN to internal network
Mhh I don’t know if I can help you too much. I initially followed spaceinvader ones tutorials for my unraid machine. But with time I changed from swag to nginx proxy manager. And I changed from using a duckdns docker to a router based dyndns tracker. But honestly I don’t remember too much from the process I currently try to switch domain but just can’t get them to work :D so I am in a smilar spot like you.
I use nginx as a reverse proxy and assign each service either a subdomain or a specific url. SSL is configured once so all services get https. Its not the best though, some services don’t like being behind a reverse proxy or don’t play nice with the url, subdomain management can get cumbersome and if the service doesn’t have a login page, it is open to bad actors… i was thinking of making a website with login and exposing other web services through an iframe but i don’t know how viable that may be.
A vpn would probably be the best way to go from a security standpoint but accessing services may be a pain on remote devices where a vpn isn’t supported - like how would a TV on a remote network access tour jellyfin server if the service is only accessible through a vpn tunnel and the tv has no way of connecting to it? Not sure.
I used to use Wireguard with Authelia, then I switched to Tailscale (with a self-hosted Headscale server), and now I’m trying out Netbird (which is open source btw)
Another response for “VPN”. I don’t have any of my self-hosted services exposed publicly & use WireGuard with the on-demand settings so that whenever I’m not at my house, I am automatically connected.
Some users did mention that things like TV’s, etc outside your network wouldn’t be able to connect, but that hasn’t been an issue for me, since I don’t use my services like that.
Wireguard for network access, istio gateway for exposing services, and keycloak for SSO. I want to experiment with Teleport for more fine grained access to my services.
If I had more exposed services I would mess with crowdsec for some another firewall rule set and maybe even exposing it through a TOR service proxy.
The easiest and quickest way thats still safe is to just use tailscale.
Its a zero config VPN that you can install on all your devices. I’ve been using it for quite some time now and I’m still fascinated by how easy to use it is.
Or Twingate. It works very well for me
I found Tailscale/Headacale way more difficult to setup than Wireguard.
Enable Funnel and the Tailscale client isn’t required.
I would want to go that appros but it feels very inconvenient having to connect to VPN every time I want to check something, also the battery drain if I stayed connected all the time
No significant battery drain for me, and I use it a lot, almost all the time.
Yea, it’s a little drain, just nothing to worry about.
I’ve been using Tailscale for about 2 months now. It has a VPN-on-demand setting that I keep enabled. That way, anytime I am not on my local WiFi, it automatically connects the VPN. According to my battery health settings, Tailscale has used 5% of my battery in the last 10 days. And I am even using a Mullvad exit node, which would use even more battery.
Where is VPN in demand setting?
On iOS, I tap on my profile in the upper right, and the VPN-on-demand setting is right below my account.
Not sure is it same, I don’t use tailscale, but using pure wireguard. In my experience battery drain is not even noticable, but staying connected is not smooth as I’d like. I tried to keep active VPN all the time, but then sometimes I just notice my internet is not working ( I have disable or restart VPN connection). It could be issue with my phone (Android), missconfig or something else, but I switched to manually enabling VPN every time I need it. Not amazing, but few clicks every now and then is more than acceptable for my use case
I have a wireguard tunnel set up between my home server and the VPS, with persistent keepalive. The public domain name points to the VPS, then I have it set up (simply using iptables) so that any traffic there in port 80 and 443 is sent back to my honeserver and there it’s handled by caddy, and sent to the actual service.
The only ports I need to open are 80 and 443 on my VPS to make this setup work. So, no open ports on my local machine. This does however require you to pay for VPS. Since you aren’t doing much on it though, you can get away with a cheap one. I have a $12/year VPS from Rack nerd that I use for this job.
For completely free options, you can do one of three things. (That I can think of. There are probably more ways.)
- Either open up some ports on your machine. You’ll need to make sure that you aren’t behind a CGNat for this. I simply don’t like opening ports to the internet, though.
- You can use a VPN. Tailscale works great for this. I use it personally for sshing remotely into my machines.
- You can use cloudflare-tunnels. Potentially bad privacy-wise since they can technically access the data. So don’t use it for sensitive stuff. Also, their policy doesn’t allow traffic that’s not mostly HTML. So something like a Jellyfin server would violate this. But you do get to use their firewall which is great for protection against DDOS attacks.
P.S. If you need help setting any of these up, lmk.
Your setup sounds great! I hadn’t come across something like that and I’d love to try it out, myself. Do you have a guide or any other resources with more info? I’m currently using a reverse proxy, but I’m not excited about the open ports, even with firewall rules keeping them contained.
I’m afraid that I don’t have any guides. But, you’re halfway there anyway. Which one of these methods do you prefer? I can maybe give you some pointers.
I like the idea of using the VPS and forwarding requests via WireGuard. I’m about to switch my setup from using NPM to Traefik. The next step after that may be to put the VPS in front of it all.
My setup looks like the following:
/etc/wireguard/wg-vps.conf on the VPS ----------------------------------------------------- [Interface] Address = 10.8.0.2/24 ListenPort = 51820 PrivateKey = ******************************************** # packet forwarding PreUp = sysctl -w net.ipv4.ip_forward=1 # port forwarding 80 and 443 PreUp = iptables -t nat -A PREROUTING -i eth0 -p tcp --dport 80 -j DNAT --to-destination 10.8.0.1:80 PreUp = iptables -t nat -A PREROUTING -i eth0 -p tcp --dport 443 -j DNAT --to-destination 10.8.0.1:443 PostDown = iptables -t nat -D PREROUTING -i eth0 -p tcp --dport 80 -j DNAT --to-destination 10.8.0.1:80 PostDown = iptables -t nat -D PREROUTING -i eth0 -p tcp --dport 443 -j DNAT --to-destination 10.8.0.1:443 # packet masquerading PreUp = iptables -t nat -A POSTROUTING -o wg-vps -j MASQUERADE PostDown = iptables -t nat -D POSTROUTING -o wg-vps -j MASQUERADE [Peer] PublicKey = ******************************************** AllowedIPs = 10.8.0.1/etc/wireguard/wg-vps.conf on my home-server --------------------------------------------------------------- [Interface] Address = 10.8.0.1/24 PrivateKey = ******************************************** [Peer] PublicKey = ******************************************** AllowedIPs = 10.8.0.2 Endpoint = <VPS-DDNS>:51820 PersistentKeepAlive = 25Now, just enable the tunnel using
sudo systemctl enable --now wg-quick@wg-vps. Make sure that the port 51820, 80, and 443 are open on the VPS. Now, allow 80, 443 through the firewall on the home-server (not on the router, just allow it locally), and it should work.Thanks so much! Hopefully I’ll be giving this a try soon.
