Recommendations on accessing home network services reddit / selfhosted ---------------------------------------------------------------------- gyzerok · 2023-10-09 06:44 Hello everyone! Beginner in self hosing here. I am running just couple of services on a Raspberry Pi 4 at home using Docker Compose, no plans for big and complex setups. Now looking into migrating to Vaultwarden from my password manager. Since Bitwarden does not support offline mode for creating new records, I would need to be able to somehow sync with it even outside my home network. It's clear to me that exposing a home network service to the internet isn't a good idea, hence there are several other routes (based on my research) I could take and here I'd like to ask your advice and guidance on which way to go. **1. Wireguard server** *Benefits:* ease of authentication (one need to pass wg auth to access the network) *Downsides:* still need to expose wireguard port (not sure about security implications, how safe is it); unfortunately mobile operators are banning VPNs time-to-time on a protocol level here so not reliable (and I need it to be). *Solutions:* instead of hosting wg server on my router, I could host it on the VPS and bridge traffic through it, but the ban problem still persists and it's the main reason to avoid this route. **2. Cloudflare tunnel** *Benefits:* easy to setup and won't struggle from VPN bans (right?). *Downsides:* not sure how to implement auth to restrict access to selected devices only. *Solutions:* am not aware of any yet. Can you help me? Any recommendations are welcome, just please remember that simplicity is preferred :) ---------------------------------------------------------------------- Bekar_vai · 2023-10-09 07:29 Have you tried Tailscale? ---------------------------------------------------------------------- gyzerok · 2023-10-09 09:15 Read about it, but I haven't yet. Isn't it the same as running Wireguard? I assumed it will fall short with protocol ban ---------------------------------------------------------------------- adamshand · 2023-10-09 09:23 There's nothing wrong with exposing ports to the internet. Every single service you have ever used online is via an exposed port. :-) Also, nothing wrong with either Cloudflare Tunnels or Tailscale / Wireguard (I use both, stupid CGNAT), but personally I prefer to put a reverse proxy in front of my services and have them directly accessible whenever possible. ---------------------------------------------------------------------- Bekar_vai · 2023-10-09 09:24 >Isn't it the same as running Wireguard? Not really, on Vanila wireguard, you need to open up ports, Tailscale on the otherhand works without any port opening or works behind NAT/Firewall. And if tailscale cant connect with its default configuration, it will try other ways to connect with peer Which should work well enough for your use case. ---------------------------------------------------------------------- gyzerok · 2023-10-09 09:42 > on Vanila wireguard, you need to open up ports, Tailscale on the otherhand works without any port opening Sounds a lot like what I mentioned in the "solutions" section for Wireguard, which is neat, I agree > And if tailscale cant connect with its default configuration, it will try other ways to connect with peer What other ways are there? Would they be able to circumvent Wireguard protocol ban? ---------------------------------------------------------------------- gyzerok · 2023-10-09 09:45 Yeah, agreed, nothing wrong. The wrong part here comes from the fact that I do not have enough understanding of the possible attack vectors, so it is easier for me to skip it altogether. Otherwise I'd need to have some additional security measures and configure some observability and alerts. ---------------------------------------------------------------------- Bekar_vai · 2023-10-09 09:51 >Would they be able to circumvent Wireguard protocol ban? Can never say that for certain, you should ask this on r/WireGuard ---------------------------------------------------------------------- ithakaa · 2023-10-09 12:09 There are numerous compelling reasons why one should never expose ports to the internet. It's not meant to be harsh, but acknowledging a lack of understanding about the risks is a sufficient reason in itself. If you're unsure about the potential attack vectors, it's advisable to refrain from exposing anything and instead consider setting up Tailscale. ---------------------------------------------------------------------- GolemancerVekk · 2023-10-09 12:24 You don't need to open any ports. Both Tailscale and Cloudflare can intermediate connections between your server and your device on-the- go. They don't need open ports and can traverse NAT because the connections are opened *from* your device/server *to* the Cloudflare/Tailscale service. You can install the Cloudflare/Tailscale daemon on your server inside the Vaultwarden container, or install it in a separate container and expose it to other containers that need it (probably best this way) through a docker network. The side of the tunnel on your server can stay online at all times, there's no downside. On your mobile device you can turn it on only when needed, or you can keep it on at all times as well. Not sure what to recommend about circumventing VPN filtering. Unfortunately WireGuard-based tunnels are fairly easy to detect and block so that may be a problem. 🤔 ---------------------------------------------------------------------- gyzerok · 2023-10-09 15:42 Yeah, that is the main problem. Otherwise I would take exactly the route you suggested :) ---------------------------------------------------------------------- gyzerok · 2023-10-09 15:43 Exactly! ---------------------------------------------------------------------- querylab · 2023-10-09 16:17 If you want a quick and easy solution use Tailscale https://tailscale.com/ if you want a more customized solution with more privacy use a VPS either aws,digitalocean,oracle,linode any and use a VPN wireguard bridging the VPS so you can portforwading from your local machine to your raspeberry or other machine in a secure way use this https://github.com/mochman/Bypass\_CGNAT ---------------------------------------------------------------------- FunDeckHermit · 2023-10-09 17:39 I'm using Wireguard on a VPS. Domain name points to VPS server, configs are made using PiVPN and wireguard CLI on the local peer connects to the VPS. Only exposed port is Wireguard on the VPS, not locally. If you're running Docker, also have a look at Gluetun. ---------------------------------------------------------------------- Crazy-Hall8823 · 2023-10-09 19:10 I hated tailscale. I run twingate ---------------------------------------------------------------------- PhilipLGriffiths88 · 2023-10-09 19:30 Depends on how they ban the protocol. If they reject UDP, that's where Tailscale falls back to an outbound TCP connection. ---------------------------------------------------------------------- GolemancerVekk · 2023-10-10 07:00 You can look into masking the traffic inside [stunnel](https://www.stunnel.org/) or inside a [ssh tunnel](https://www.comparitech.com/blog/vpn-privacy/hide-openvpn- traffic-with-ssh-tunnel/). Check out [ProxyChains](https://github.com/haad/proxychains) and [sshuttle](https://sshuttle.readthedocs.io/en/stable/) too.