ELI5 how to safely expose my homelab reddit / selfhosted ---------------------------------------------------------------------- Pvaleriano · 2023-10-17 20:25 Hello! Sorry for the nth post on the same topic but let me explain myself: TLDR: I have troubles understanding the guides that I've searched because a combination of English not being my native language and lacking the proper technical terms to look for. I don't even know if networking work as I believe they do so I need an ELI5 on how to do things properly before messing it up BIG. Now, to the post. For the past 6 or 7 months I've been hosting some services at home. Up until now I didn't need nor wanted to expose them out of my home network, mainly because I didn't want to deal with the security problems associated with that. But here we are. My question would be how can I expose my network the good way? Can I access my home network without messing with the ports in my router? Let me elaborate on what I'm doing first to know how to continue and the things that I need to change or do. I run my services trough Docker. Currently I have a Pihole container that runs just fine in my home network, but while researching how to expose my lab, I watched [this video](https://www.youtube.com/watch?v=R29YBmYxXAk&feature=youtu.be) (in Spanish) about how to combine a container with Pihole and Wireguard to route the traffic from a device to the machine with the container. I ended up with this docker-compose file version: '3.7' services: wireguard: image: linuxserver/wireguard container_name: wireguard cap_add: - NET_ADMIN - SYS_MODULE environment: - PUID=1000 - PGID=1000 - TZ=${TZ} - SERVERPORT=51820 #optional - PEERS=2 #optional - PEERDNS=auto #optional - INTERNAL_SUBNET=10.13.13.0 #optional volumes: - ./wireguard:/config - /lib/modules:/lib/modules - /usr/src:/usr/src ports: - 51820:51820/udp sysctls: - net.ipv4.conf.all.src_valid_mark=1 dns: - 172.21.0.7 restart: unless-stopped networks: containers: ipv4_address: 172.21.0.6 pihole: container_name: pihole image: pihole/pihole:latest #Bindear el puerto 53 en ubuntu o fedora da problemas #https://github.com/pi-hole/docker-pi-hole#installing-on-ubuntu-or- fedora expose: - "53" - "67" - "80" - "443" environment: TZ: ${TZ} WEBPASSWORD: ${PW} volumes: - './etc-pihole/:/etc/pihole/' - './etc-dnsmasq.d/:/etc/dnsmasq.d/' cap_add: - NET_ADMIN #https://github.com/pi-hole/docker-pi-hole#note-on-capabilities restart: unless-stopped networks: containers: ipv4_address: 172.21.0.7 networks: containers: ipam: config: - subnet: 172.21.0.0/24 The video basically explains that, in order to bind the traffic of wireguard to Pihole, you need to create a subnet and define the ip addresses of the containers. The video also defines the subnet as [172.20.0.0/24](https://172.20.0.0/24), but I changed it to 172.21... because Mealie was using said subnet before. So I installed the wireguard client on my android device, turned off the WiFi, turned on the VPN tunnel and tried to open youtube and sonarr, both without success. The device was sending packages but I guess that, because my router is not properly configured, it didn't allow any traffic in. So, before I mess it up I wanted you guys to ask what would be the best approach and also what can be done. First thing first, let's rid of my fantasies ans misconceptions that I feel that I have. Can a whitelist my device IP/Mac to surpass opening any port or do I need to concede here? My ISP has IPv6 and so does my mobile. Can I somehow use this IPv6 to whitelist myself? Now the more serious questions Wireguard wants the 51820 udp port open in my router, Is this right? If I have to open the port what would be the safest way to do it? I've read about Cloudflare tunneling, but also I've read that some people do not want to associate themselves with cloudflare. Why could that be? I've also read that I could use ngix maybe? I'm not sure.. Also I've read people here using self-signed certificates to validate themselves. Maybe from let's encrypt. How would this work? So with all of this said, how can I continue in the safest way possible? Thank you for reading all of this. ---------------------------------------------------------------------- thekrautboy · 2023-10-17 21:04 Its no surprise that connecting from the outside with Wireguard doesnt work if you have not opened the port for it. That is required for Wireguard to work. Your phone needs to connect to your home IP:port for that. Is it safe to open a port for Wireguard? Simply put, yes. Its a widely used software so atleast you can trust that the software itself is secure and shouldnt cause you any problems. However every software needs to be configured correctly to stay secure. So you need to learn how to set up your Wireguard correctly and secure. /r/Wireguard can probably help you with that. Once that is done you can open that single port in your router for forwarding it to your Wireguard container and connect with your phone from the outside to it. You also need to tell Wireguard to actually use the Pihole for its DNS, but that is also something /r/Wireguard can tell you. > I've read about Cloudflare tunneling Cloudflare tunneling is sort of going the other way, instead of opening a port for incoming connections for Wireguard, you have a software running inside your home network which connects to Cloudflare on the outside (=the tunnel). And then from your phone you would not connect to your home network directly, but you connect to Cloudflare, and they redirect it to your home network through that tunnel. The advantage is that you dont need to open a port for this. The big disadvantage is that you need to trust Cloudflare, and its not a exactly selfhosted solution. With something like Wireguard you are in control, you host your Wireguard node, you connect directly to that, thats all. In the end its your choice how much security you are willing to sacrifice for some ease of setup and use. If you have specific Cloudflare questions, /r/Cloudflare exists. > So with all of this said, how can I continue in the safest way possible? Get Wireguard properly set up, open the Wireguard port, connect from the outside. Then make Wireguard use your Pihole. Once that is all working, pick a new goal. > I've also read that I could use ngix maybe? I'm not sure.. Also I've read people here using self-signed certificates to validate themselves. Maybe from let's encrypt. How would this work? Thats a bit different to what youre trying to do with your Wireguard and Pihole. With your WG+P setup you would be able to connect from the outside into your home network and use Pihole for adblocking for example, so you have secure internet with adblocking while youre away using Wifi at Starbucks. But you can also access any services you are hosting in your home network through the Wireguard connection, if you want. A reverse proxy like nginx, Traefik, Caddy and many more are typically only taking care of web services. Pihole (DNS) is not one. So you cannot use your Pihole through nginx for example. But if you have a web service in your home network, for example Portainer to manage your Docker containers, you can open the reverse proxy port to the internet, and the proxy is then listening there for incoming connections. If you connect from the outside to your public IP(*) of your home network then the proxy could detect what service you are trying to reach on the inside and redirect it to your internal Portainer for example. *Note that a reverse proxy expects a hostname (on the public internet, a domain or subdomain) when accessing it. Just a IP doesnt work. So for using that you need to have a domain. But it doesnt need to be a paid domain, you can easily use a free subdomain from a service like Duckdns.org or dedyn.io for example. Tons of threads and tutorials exist already about these things. But now you should know a few phrases you can search for and learn more. I would suggest you take one step at a time, dont try to set up everything at once. If your current goal is to use your Pihole while youre away, focus on that. Get your Wireguard working. And it doesnt conflict at all once you later add nginx for example to that. In this case they serve different purposes. ---------------------------------------------------------------------- Pvaleriano · 2023-10-17 21:12 Thank you very much! I'll read your answer a dozen times these next few days. I'll keep going for the wireguard+pihole setup then. I thought that somehow I could just magically connect to my node without opening any port because... Reasons, I guess. Now I feel like I know what I need to do. ---------------------------------------------------------------------- thekrautboy · 2023-10-17 21:21 Enjoy your selfhosting journey :) ---------------------------------------------------------------------- ShineTraditional1891 · 2023-10-17 22:49 I am not sure if you are free for other solutions, but a good way to expose your homelab to the internet without issues is a zero trust concept which you can realise with cloudflare for example. There are some youtube videos on it. Pretty neat. Just as a thought, I cant tell if it would be the better solution. ---------------------------------------------------------------------- msic · 2023-10-18 01:14 More like ELI35 ---------------------------------------------------------------------- parkercp · 2023-10-18 03:37 I’m close to 50 and struggling ! ELI50 ---------------------------------------------------------------------- vincat1 · 2023-10-18 04:57 Try PiVPN and Pi-Hole. This is what I've got, simple to setup, just open 1 port. From my android ph I can start the VPN and it is just like being at home. ---------------------------------------------------------------------- brando56894 · 2023-10-18 04:59 If you just want access to websites you host, you'd most likely want a reverse proxy which is the "nginx" you mentioned at the end. Nginx is actually one of the most complex and pains in the ass to use, especially when you have no experience with that sort of thing. If you want an easy reverse proxy to setup and have no experience with webservers or other reverse proxies, give Caddy a try. It's dead simple and enables SSL by default. Each reverse proxy takes 3 lines of code as compared to like the 10-15 that Nginx takes, along with having to install CertBot to request the certs from LetsEncrypt. In order to have an SSL secured reverse proxy working at all you need to have at least one DNS A record (matches domain names to IPs) and a domain name, it can be a free one via a Dynamic DNS service, or you can register your own domain name for cheap (like $10/year for non com/org/net TLDs, mine ends in US and costs me like $12/year). Now, if you want access to secure things which you would rather no expose to everyone on the internet (via a website/reverse proxy) than you would want a VPN. I see that you're attempting to use Wireguard, even as a Linux System Engineer I never had good luck using it. I could never get access outside of the internal VPN subnet and get access to my LANs subnet even though I specifically defined it. Also, Wireguard also requires static IPs on both ends which is great for places that have static IPs, but for my usage I rely on dynamic IPs (even if they don't change much, except for my cellphone). I've always had good luck with OpenVPN, it's a massive pain in the ass to setup though since it normally uses SSL certs and passwords to verify clients, you can use other auth methods too. You could probably setup a docker container for it and just setup the users and auth methods, which is definitely a lot less painful than setting it up from scratch on a Linux distro. It doesn't rely on pre-defined IPs like Wireguard does though. ---------------------------------------------------------------------- TheCudder · 2023-10-18 05:22 Highly suggest *wg-easy* for an easy to implement Wireguard setup. OpenVPN is extremely slow. ---------------------------------------------------------------------- noobgolang · 2023-10-18 05:23 wireguard is very safe ---------------------------------------------------------------------- brando56894 · 2023-10-18 06:33 Thanks I'll give it a try, I've tried tons of ways to do it on various hosts, maybe this will finally work. I know OpenVPN isn't the best, but it's what I've been using for years and it usually works well once the bugs are ironed out. ---------------------------------------------------------------------- Important_Creme_1331 · 2023-10-18 06:46 Warning: Deep Dive. Wireguard is device-to-device connection (broadly speaking). Start looking into Overlay VPNS. Tailscale is the most famous one and can be self hosted. ---------------------------------------------------------------------- alconaft43 · 2023-10-18 10:36 Internal/managment staff - via WireGuard or other VPN Services - via proxy and custome dns, like Ngnix proxy manager. ---------------------------------------------------------------------- Pvaleriano · 2023-10-18 10:50 I think I understand what you mean but if you could clarify a bit it would be super helpful. If I were to mess with my configuration while out of home, the best way is to VPN back to my local network, which requires opening a port for wireguard, right? If I just want to access my deployed services I could do that just with Ngnix? The word proxy is one of those terms that I don't fully grasp. According to google it's a piece of software to manage requests between a device and a service, like some sort of both a guide to point back to home and a traffic agent (???). In my case, lest say that I want to access Sonarr on the road. I would not connect to Sonarr but Ngnix? I guess that I still need to open a port for Ngnix then, right? What would be the difference between connecting to Sonarr through a VPN or a Proxy? Sorry and thank you for your comment ---------------------------------------------------------------------- Pvaleriano · 2023-10-18 10:53 I've read about tailscale. As far as I know, it's built on top of wireguard, so I guess it has extra functionalities. If this is correct, What would be in your opinion the main points to go for Tailscale instead of a pure wireguard deploy? ---------------------------------------------------------------------- Pvaleriano · 2023-10-18 10:55 Tbh the core of my question when I started tipying was something like can I expose my homelab without opening any ports? I'm scared, pls help x) ---------------------------------------------------------------------- bufandatl · 2023-10-18 10:56 By not exposing it. ---------------------------------------------------------------------- Pvaleriano · 2023-10-18 11:03 Your comment is kinda out of my league at the moment so I'll save it for when I feel like I know what am I doing. At the moment my ISP asks for a fee to get a static IP that I'm not willing to pay so, for what I understand at the moment, this is something else that I would need to consider. Thanks! ---------------------------------------------------------------------- bufandatl · 2023-10-18 11:10 > Simply put, yes. Its a widely used software so atleast you can trust that the software itself is secure and shouldnt cause you any problems Windows is also widely used software an has vulnerabilites all the time. Because a software is used widely doesn't mean it's safe and secure. ---------------------------------------------------------------------- alconaft43 · 2023-10-18 11:14 lets say you have something running in the docker with uri http://[192.168.1.100:3000](https://192.168.1.100:3000). If you have fixed IP, you can make custom domain [service.example.com](https://service.example.com), point it (a-record) to your public IP and configure HTTP proxy to forward HTTP requests coming to [service.example.com](https://service.example.com) to internal HTTP server [192.168.1.100:3000](https://192.168.1.100:3000) and return reply back. You will need to forward 443/80 port to proxy inside your network and proxy have to be able to access internal services. More than one "services" can be configured, it is only matter of DNS and proxy settings. Google ngnix proxy setup videos, it is simple. There are also options to use Cloudflare Tunnel, then you can hide your external IP and have more control/protection, but Cloudflare will be your man in the middle with access to all your exposed services. ---------------------------------------------------------------------- thekrautboy · 2023-10-18 11:21 Oh is Windows open-source now? Because Wireguard is and thats what i was talking about. ---------------------------------------------------------------------- Pvaleriano · 2023-10-18 11:22 Understood, thanks! As I don't have a static public IP nor I intend too (My ISP sells the expensive af and my planned usage doesn't justify it) I'm reading that I would need a DDNS too, right? ---------------------------------------------------------------------- thekrautboy · 2023-10-18 11:26 TS is based on the technology of WG, but they are not the same really. TS you can very easily connect multiple devices into one private network, regardless where they actually are. WG only connects one point to another. For example your phone from the outside to your homenetwork WG container. If the phone can also reach other computers in your network then is up to you. But WG stops there, basically. However TS is not fully selfhosted, just like i mentioned about Cloudflare. Because TS requires a outside node to be reachable (that is a control server provided by that company) and through that TS can start tunnels from your homenetwork to that public server, similar to what a Cloudflare tunnel would do. The advantage is you dont need to open any ports for that, TS can connect as outgoing connection. The downside is, you need the TS software running in order to connect to any of your hosted services, so it also differs there from a reverse proxy for web services. But you can selfhost the TS controlserver with the opensource project Headscale. But it still needs to run on a public facing node in order to make connections possible. ---------------------------------------------------------------------- bufandatl · 2023-10-18 11:27 No it's not and in that statement you didn't say it's because open source and widely used. And still doesn't make it secure because it's open source and widely used. And if you want to go by Open Source OpenSSL is open source, it is widely used and yet it had countless vurnabilities and security issues in the past, the present and will have in the future. https://www.openssl.org/news/vulnerabilities.html Yes they get fixed eventually but so will closed source too. Just because software is widely used it's not secure. It's only secure when vulnerabilities are addressed and fixed and users/admins update their software regularly. If you want to make a statement towards WireGuards securtiy then say it's secure because it has a small well tested code base, uses strong ciphers and as not much target surface for attackers. Also because it is that dead simple user errors are less likley to occur that risk your security. ---------------------------------------------------------------------- thekrautboy · 2023-10-18 11:28 > At the moment my ISP asks for a fee to get a static IP that I'm not willing to pay so, for what I understand at the moment, this is something else that I would need to consider. No, you absolutely do not need a static IP. Dont waste your money. As i mentioned in my original comment, look at free DDNS providers like Duckdns.org or Dedyn.io as they can "turn" your dynamic home IP into a static hostname. And then you can use that name for WG connections for example, and it doesnt matter when your IP changes. ---------------------------------------------------------------------- Pvaleriano · 2023-10-18 11:28 Thanks! ---------------------------------------------------------------------- thekrautboy · 2023-10-18 11:30 Idgaf about Windows, i was talking about Wireguard and you know exactly how it was meant. ---------------------------------------------------------------------- thekrautboy · 2023-10-18 11:30 Wow youre so helpful, exactly like in your other comments. ---------------------------------------------------------------------- alconaft43 · 2023-10-18 11:36 >Cloudflare Tunnel Yes, you can point your custom domain to DDNS via c-name, but I never use it myself. Also cloudfare has something about dynamic IP https://developers.cloudflare.com/dns/manage-dns-records/how- to/managing-dynamic-ip-addresses/ ---------------------------------------------------------------------- Important_Creme_1331 · 2023-10-18 14:08 u/Pvaleriano: See above. u/thekrautboy has explained it very clearly! tl;dr: Tailscale is more scalable to add more devices to it. Headscale is the selfhost option. ---------------------------------------------------------------------- Pvaleriano · 2023-10-18 15:35 The starting guide for pivpn also contains a section on how to run it with DDNS so it looks promising. Thanks! ---------------------------------------------------------------------- AkkariUs · 2023-10-18 15:58 Personally i use wireguard protocol but using PiVPN installed directly on the Raspberry (not a container) that i use for Docker services. Yes, it required an open port on router and (for me) a DDNS that update my dynamic ip. You can try Cloudflare tunneling, i read an article some days ago that explain how is more reliable than DuckDNS (a DDNS service) in maintaining the connection to the VPN BUT you will need to buy a domain for it. My 2 cent, try Tailscale: \- is free (at least for the first 100 devices that you connect) \- you DON'T need to open any port on the router \- the configuration is simple enough \- if you have concern on the privacy of tunneling your data on someone else server, you can try to self-host it (the self-hosted version is called HeadScale and all the app of Tailscale are compatible with it, you had to change only the pointer to your server) ---------------------------------------------------------------------- Pvaleriano · 2023-10-18 19:12 I just set up Tailscale and wow that was easy. I'll research Headscale because I don't know yet if I like that Tailscale can see my services or if I'm just being paranoid. Thank you again! ---------------------------------------------------------------------- msic · 2023-10-19 01:23 Yes, using Tailscale or headscale. It will not expose your homelab, but it will make it accessible over Wireguard on a device-to-device basis. ---------------------------------------------------------------------- ProffesionalAds · 2023-10-19 06:07 Use [Netmaker](https://www.netmaker.io/) or Tailscale. You don't need to expose any ports to the internet. Both Netmaker and Tailscale are built on Kernel Wireguard which makes them more secure. ---------------------------------------------------------------------- msic · 2023-10-20 01:38 Tailscale is built on the go implementation of wireguard, which is slower. It is not using kernel wireguard. fyi. ---------------------------------------------------------------------- brando56894 · 2023-10-27 15:47 Haha it sounds like a lot but it's actually pretty easy and take only a few minutes to do, it's just wordy to explain. Static IPs are nice, but aren't necessary, also most ISPs tend to give you the same IP even when you do a new DHCP request (like reboot your router) or the lease time is ridiculously long, so you may have the same dynamic IP for months. I always hosted locally using a dynamic IP, but it rarely ever changed.