If your VPN for remote access to your server goes down, what's your backup? reddit / selfhosted ---------------------------------------------------------------------- Illuminated_Humanoid · 2023-10-13 05:46 Hi, I just recently setup tailscale for accessing all my self-hosted fun stuff while I am away from home as securely an conveniently as possible. It dawned on me today that it's entirely possible that tailscale can have an outage one day and at that time I would need a backup. So I searched around and the best open source alternative with the same concept I could find was zerotier. So, I have a few questions for you. \#1. Can I use zerotier alongside Tailscale for backup connections in the scenario I described? If so, should I? \#2. What is your backup method you currently have set up? ---------------------------------------------------------------------- probablyjustpaul · 2023-10-13 05:54 SSH mapped to an ephemeral (but static) port that Ive memorized ---------------------------------------------------------------------- Vangoss05 · 2023-10-13 06:02 more then one vpn? ---------------------------------------------------------------------- botterway · 2023-10-13 06:14 I run my VPN server on my router. I don't use Tailscale etc. If my router VPN server goes down, it implies my router is down, or there's a power outage etc. In which case it all becomes moot, because I'm not getting into my network from anywhere (even home). ---------------------------------------------------------------------- parkerflyguy · 2023-10-13 06:25 This is also what I do ---------------------------------------------------------------------- Illuminated_Humanoid · 2023-10-13 06:26 What router do you have? I tried vpn at the router level on a Synology rt2600 and it was terrible for performance. I could not take advantage of my gig speed internet with it so I quickly switched back to tailscale. ---------------------------------------------------------------------- thekrautboy · 2023-10-13 06:38 Keep in mind that the exact type of VPN also impacts CPU load a lot, and because of that, impacts transfer speeds. So run some tests yourself between OpenVPN, Wireguard, and whatever else. /r/VPN and /r/Synology also exist ---------------------------------------------------------------------- bufandatl · 2023-10-13 06:39 I run WireGuard on my own server no third party involved. If that is down I have a SSH jump host on a raspberry pi configured. ---------------------------------------------------------------------- botterway · 2023-10-13 06:53 I have an AC86U. I bought it explicitly because it has decent CPU and can run a router comfortable. Also, note that I'm talking about a VPN ***server*** not a VPN Client. The former provides a VPN endpoint at the router, to which I can connect remotely when I'm out and about and get complete access to my LAN as if I was sitting on my home wifi. That's not the same as a router-based VPN Client, which basically sits between your LAN and the outside world, and redirects all outgoing traffic through the VPN (i.e., whole-house VPN for privacy/security/etc). I used to run that, but it had a number of issues: * As r/thekrautboy mentions, even with a router with a decent CPU, running an OpenVPN client will throttle your connection because the encryption is heavy duty. I used to see my 40mbps connection max out at about 28mbps when I ran it like this. * Some services don't play nice with VPNs (Netflix, iPlayer, etc) - which means that if you run a whole-house VPN client, you can't access everything you need. My VPN was mainly for the \*arrs so now I just run a VPN client proxy container in docker, and router the traffic for Prowlarr etc through that so the outgoing VPN is service-based. If I'm connecting into my LAN via the remote server, the openvpn overhead is typically less relevant, because I'm not usually uploading tonnes of stuff to my LAN (maybe just photo backups from my phone) and any video streaming from plex has more than enough bandwidth. ---------------------------------------------------------------------- botterway · 2023-10-13 06:55 There's nothing preventing OP from doing both - use Tailscale most of the time for convenience, but also ensure you have a VPN server running on your router, just in case. ---------------------------------------------------------------------- Effective-Media-3373 · 2023-10-13 07:07 Security by Obscurity is not the way though.. #nmap & zmap have entered the chat ---------------------------------------------------------------------- ElevenNotes · 2023-10-13 07:08 Same. ---------------------------------------------------------------------- NikStalwart · 2023-10-13 07:09 Port knocking has entered the chat. ---------------------------------------------------------------------- Accomplished-Lack721 · 2023-10-13 07:10 I run both Wireguard and OpenVPN directly on my router. If one goes down, I can try the other. If the whole router is down, I'm not going to be able to connect anyway. ---------------------------------------------------------------------- Effective-Media-3373 · 2023-10-13 07:12 I have reverse proxies(Traefik) with MFA(Authentik) and strict firewalls on anything (Crowsec) along with push notifications from Gotify if anything triggers defenses on Crowdsec. This gives me enough confidence, since I'm by no means a 'high' value target for a hacker. And it would be quite a pain to circumvent all of that (ofcourse possible) It all depends on how high of an interest your server may be. ---------------------------------------------------------------------- NikStalwart · 2023-10-13 07:14 ssh! I do use VPNs (vanilla wg, innernet and headscale/tailscale) but I still keep an SSH port open. I do not consider ssh to be a security risk. I always use key-based authentication, which is, fundamentally, the same mechanism securing my VPN connections. There are obvious things you do to make ssh more secure (disable root login, disable password auth, change port) and you can also do additional security precautions like port knocking (you need to hit a sequence of ports before the firewall will open the ssh port), jumphosts, allowlisted IPs, etc. Another thing to note is that your server provider will likely give you KVM/VNC access, so that's another backup. What I like about something like innernet is that the peer mappings are stored locally at each peer, which means that if your innernet control server goes down, you can still have access to the rest of your virtual private network. If you are running headscale and your headscale process dies, well, you need to call a necromancer. ---------------------------------------------------------------------- user3872465 · 2023-10-13 07:23 If my main VPN goes down (more performant on a Server) I have one less performant on my router. If that goes down, well I have no problems anyway. ---------------------------------------------------------------------- D3RLord · 2023-10-13 08:16 TeamViewer on a Windows VM i keep around. ---------------------------------------------------------------------- TheCaptain53 · 2023-10-13 08:44 It really depends. If you have a static IP at home, then this is really straight forward. Install and configure wireguard on your server, then set up your peer address to come from anywhere. If you have a dynamic IP, then you'll need to be a bit more sneaky about it. For this, you'll need a dynamic DNS service. Basically, set up your host to update the dynamic DNS entry each time the IP changes. The port forward will still be in place on your router, your remote device will just use a URL rather than a static IP. If your addressing is based on CG-NAT, basically if you can't port forward, then you will need to use a third party dynamic VPN service, like Tailscale or ZeroTier. Alternatively, if you're electing to be super paranoid, you could always set up something like Headscale on a public VPS and have all your Tailscale clients point to that. The low effort option is installing ZeroTier. With that in mind, the question I'd ask is why. If your setup is so important that you MUST be able to access it come what may, you probably need a more robust setup. If not, then you can probably just ride the Tailscale outage until it's back up. I personally wouldn't worry about it, but if you continue to do so, read the suggestions above. ---------------------------------------------------------------------- NurEineSockenpuppe · 2023-10-13 08:46 Wireguard runs pretty great on my router. AVM fritz box ---------------------------------------------------------------------- candle_in_a_circle · 2023-10-13 08:59 This is a terrible idea and, one day, will bite you ---------------------------------------------------------------------- nadmaximus · 2023-10-13 10:20 ssh. ---------------------------------------------------------------------- xkcd__386 · 2023-10-13 10:23 TLDR: if you have your own VPS you can setup plain wireguard yourself (essentially what tailscale does but more "hardcoded"), or you can setup nebula. If you *don't* have your own VPS but need protection against the provider having an extended outage, use yggdrasil here's an excellent review of various mesh VPNs: https://changelog.complete.org/archives/10478-easily-accessing-all- your-stuff-with-a-zero-trust-mesh-vpn (less readable but probably updated version at https://www.complete.org/easily-accessing-all-your- stuff-with-a-zero-trust-mesh-vpn/) before I read that I never knew about yggdrasil, but now I am totally sold on it -- **precisely** because of the concern you posted about (there is no one central host!) by the way my own research had also eliminated zerotier for licensing complexity as well as install complexity ---------------------------------------------------------------------- MrSliff84 · 2023-10-13 10:58 Another vpn a VPS l, and another von on my ISP modem/router. When all these are down there's a serious reason for it. ---------------------------------------------------------------------- Nidabey · 2023-10-13 11:05 I'm frequently working from remote location and my main ftth cpe goes down sometimes and by the way my primary wireguard access. I use a secondary wan in failover with a 4g router that use another wireguard tunnel I can connect remotely through a vps, just the time to reboot the cpe power with a Shelly plug or just access my network as usual if the issue is more tricky. It works well well for me since 2 years it saved my life few times. ---------------------------------------------------------------------- Sharkfacedsnake · 2023-10-13 11:14 My server is at my dads house. If that goes down i just will video call him when he is free. And talk him though whatever needs to be done. Nothing complicated yet. So far only issues i have had is power outages and router swaps out of my control. ---------------------------------------------------------------------- raunchieska · 2023-10-13 12:31 > Security by Obscurity is not the way though.. a lot of people repeat this mantra without understanding. You cannot rely just on obscurity for security, but it's absolutely helps a ton. Good luck discovering your service on rando ipv6 address (this doenst mean you dont have to set a password). ---------------------------------------------------------------------- LightningJC · 2023-10-13 12:53 I use CloudFlare tunnels. I only host web based interfaces though, don’t have a reason to need direct access to the server away from home. ---------------------------------------------------------------------- Correct-Ship-581 · 2023-10-13 13:09 I set up AnyDesk on a Linux desktop ---------------------------------------------------------------------- AnApexBread · 2023-10-13 13:22 I use a firewall rule in router to allow connections from an IP linked to a DDNS service. So if the VPN goes down I'll activate the DDNS updater on my laptop and in 5 minutes my router will pull the new IP for that DDNS address and update my firewall rule to let me back in so I can reset the VPN. Then I'll turn the DDNS updater off and 5 minutes later the router will disable the rule because there's no IP for the address anymore. ​ I've only had to do this a handful of times and I don't generally like doing it because it means anyone in the hotel I'm in could technically get through the firewall if they knew the address of my servers. It's unlikely someone would be able to both know when the firewall is allowing an IP AND be on that IP AND know the URL of my servers, but its technically possible. ---------------------------------------------------------------------- AnApexBread · 2023-10-13 13:25 >Security by Obscurity is not the way though.. Security Through Obsurity is a good additional tool. It won't stop anything and so it should not be your only defense but it does make things even marginaly more difficult so it's good. >nmap entered the chat Great. But changing the port isn't designed to stop someone using NMAP. It's to stop bots programmed to hit port 22. There is no perfect solution which can stop 100% of attacks. So you have to weight the cost to the benefit. Chaning SSH port takes almost 0 cost and provides > 0 benefits, so it's worth doing. ---------------------------------------------------------------------- chrishch · 2023-10-13 13:25 I have Tailscale running on a bunch of my systems. If that fails, I also have Pi VPN running on my RPi 3B. In addition, my Mac mini also has the cloud version of RealVNC on it. As long as my Internet connection at home is up, everything should be accessible. However, something did happen the last time I went away for vacation. Since then, I put a smart plug on my cable modem and it's set to shut down for two minutes every two days. ---------------------------------------------------------------------- Effective-Media-3373 · 2023-10-13 13:29 I completely agree, non-standard ports are perfect for SSH for example. I have it too because I was sick of the 5000+ login attempts in my logs every week. But more to point out some people think this will be sufficient. And about nmap, yes it's true. Like I said in my other comment it all depends on who you are protecting against and if it's an automated bot that is mass scanning or for example an advesary actively trying to scan and break in. ---------------------------------------------------------------------- ThatsNASt · 2023-10-13 13:44 Put your VPN at the firewall level and you won't have this issue. And if you do have an issue, it's because the internet is probably down. If you'd like a backup for that, use a jump box with remote access on it, or install an RMM agent on your servers and you can remote in to them using it. Plenty of options. I treat my lab like my little enterprise - it's patched, monitored and used just like a mini enterprise setup. ---------------------------------------------------------------------- PaulEngineer-89 · 2023-10-13 14:24 That’s a function of the VPN. Wireguard tries to take a middle of the road approach. Also as you found out network devices can be serious bottlenecks, even just basic Firewalls. This is where paying for good hardware is worth the money. ---------------------------------------------------------------------- phein4242 · 2023-10-13 14:42 I call my hosting provider to get access to the DC, and attach a crashcart to the server. (I have only a singe ethernet uplink, so no drac) ---------------------------------------------------------------------- brando2131 · 2023-10-13 14:47 fwknop has entered the chat. ---------------------------------------------------------------------- TheQuantumPhysicist · 2023-10-13 15:15 Consider using RustDesk for a better self-hosted experience. ---------------------------------------------------------------------- botterway · 2023-10-13 15:16 TBH, for road-warrier use what I've got is more than capable enough, given my current connection. My upload is 9mbps, so the VPN can more than keep up with that even on a cheap (£50) AC68U - and that's plenty to stream video from my plex server. So you don't have to spend a lot. ---------------------------------------------------------------------- D3RLord · 2023-10-13 15:16 Thanks for the heads-up. Will Check it out! ---------------------------------------------------------------------- TheQuantumPhysicist · 2023-10-13 15:19 I don't want to sound like a dick, but using Authentik, which is written in Python, is not really something I'd brag about when talking about security. Anything written in Python is absolutely not appropriate to be first line of defense. Besides my quick judgment to dismiss anything written in Python for security, I tried Authentik myself, and right after installation I had bugs show up on the UI. It's your network, and you're free to do whatever you want. But I wouldn't trust a pleb using Python with my security. You want security? You go for Rust or Golang at least. It's not a perfect world, so not everything is written in Rust, but still, I would stay away from making Python written by a random person facing the public. ---------------------------------------------------------------------- Effective-Media-3373 · 2023-10-13 15:30 Well 'bragging' is an interesting way of putting it.. but anyway. Like any programming language, Python is only as secure as the code that is written in it. I do agree however there are more robust languages out there in terms of security (and more). Like you said for example Go, which I am a huge fan of by the way). I was actually in the process of switching to Authelia as my MFA provider, which is written in Go. But still, it doesn't mean secure python code does not exist. ---------------------------------------------------------------------- mentalow · 2023-10-13 15:35 Opengear's Infrastructure Manager with a free 5G SIM, tailscale, and an additional reverse shell to a free Oracle VPS. ---------------------------------------------------------------------- Zedris · 2023-10-13 15:41 Wireguard+tailscale+rustdesk for remote desktop. ---------------------------------------------------------------------- TheQuantumPhysicist · 2023-10-13 15:48 Good on you switching to Authelia. > Like any programming language, Python is only as secure as the code that is written in it. This is actually one of the biggest misconceptions in software security. You're forgetting one very important factor: Humans. Humans are bad at type-checking. Humans are horrible maintaining invariants over large code-bases. This is why Rust is becoming insanely popular... because everyone suddenly realized how much damage bad languages have caused and how machines can help us verify code with correct types. Does that mean a secure Python software can't exist? Absolutely not what I'm saying. What I'm saying is (and check my original response again), I wouldn't bet my server security on program written by a random person online. ---------------------------------------------------------------------- ASCII_zero · 2023-10-13 15:59 Isn't that technically leaving two potential attack vessels open? ---------------------------------------------------------------------- botterway · 2023-10-13 16:28 Yep, but convenience, right? ---------------------------------------------------------------------- DzikiDziq · 2023-10-13 16:33 Potentially, yes. I have a direct wireguard connection to my router, which is my backup connection and it's setup on for me. I don't use it untill something really happens to my UNRAID. My tailscale on the other hand is more subnet limited, with access for me, my wife and even more limited for my friends and rest of the family (some services). I was too dumb to be able to manage the permissions/subnetting myself, tailscale is quite easy, even the pihole as dns. ---------------------------------------------------------------------- maxwelldoug · 2023-10-13 17:29 Not Op but I use an 11th gen I5 box with opnsense for a router, even with a bunch of plugins and OpenVPN running it doesn't even break a sweat. ---------------------------------------------------------------------- hotapple002 · 2023-10-13 19:38 I have a UniFi dreammachine and have setup both OpenVPN and wireguard on it. Teleport doesn’t work for me as the dreammachine is behind nat (can’t (easily) get rid of my ISP router-modem box) ---------------------------------------------------------------------- virtualadept · 2023-10-13 21:29 SSH over Tor (which can also do port forwarding, albeit slowly). ---------------------------------------------------------------------- Nassiel · 2023-10-13 21:44 Hi, I have two backup levels. If my internet connection works but what is broken is my VPN server, I have SSH access over a non-standard port for another server. If what is down is my internet connection, I have RPI4 with 4G data with a reverse tunnel always open into a cloud server. So if my internet is down, I can enter through SSH on my cloud server and then SSH again over 4G into my local network. ---------------------------------------------------------------------- zyberwoof · 2023-10-13 22:30 I've got Wireguard and SSH open on a Pi. If I wanted more, I'd probably just enable Wireguard on my router, and/or spin up another Docker container for it on a separate host. ---------------------------------------------------------------------- gsmitheidw1 · 2023-10-14 03:57 This is what I use as my main, I just tunnel everything. Clunky but secure and reliable. Open a nonstandard port under 1024, fail2ban, public key only (ed25519 is fastest I find) and keep sshd well patched. Integrating MFA with yubikey or equivalent too if you're very security conscious. ---------------------------------------------------------------------- gsmitheidw1 · 2023-10-14 04:06 it's not for direct security it's for disk space and server load. Port 22 is gonna get hammered more and it's gonna fill up btmp and other log files with crud from attempts. If it's a determined attack you could even (depending on log rotation and partitions) find the system fails from full disk or /var issues. It's not security by obscurity to limit your exposure but it's not a sole line of defence either. But it does have a reasonable value to not use 22 default. ---------------------------------------------------------------------- Wf1996 · 2023-10-14 08:15 Either your own vpn server or something like twingate ---------------------------------------------------------------------- Effective-Media-3373 · 2023-10-14 17:44 Which is what I've already clarified in my other comment. All I'm saying is some people are convinced that is enough, which it is not.