Opinions on best practices for using self-hosted website as landing page for home server access (While behind CG-NAT) reddit / selfhosted ---------------------------------------------------------------------- PMaxxGaming · 2023-10-19 15:08 Sorry in advance for the long post; I'm just trying to be as specific and detailed as possible. ​ Due to the type of ISP I'm using I'm stuck behind CG-NAT with no standard way of accessing my home network from outside. **My current implementation** (which isn't ideal for my use-case) is using a VPS on Google Cloud Compute Engine that runs an OpenVPN server and using OpenVPN client apps on mobile devices as well as my Blue- Iris (security camera) server, and Emby Media Server. This allows me access to those two servers (two separate machines), but makes it somewhat difficult to give access to my media server from certain devices - or for friends, family, etc. I have a domain on Cloudflare that I currently use to access my media server, but it's a bit of an annoyance to have to type in the port instead of just using something like "*emby.example.com*" and I'd ideally like to set it up to route to a self-hosted landing page on my home network that allows access to other services on my network - *behind a username and password authentication page.* **Right now my Cloudflare domain works as follows:** [*www.example.com*](https://www.example.com) **->** *Local IP of my Heimdall server* (Temporary landing page, until I can get something more secure set up, with access from outside my LAN) [*emby.example.com*](https://emby.example.com) **->** *IP from my OpenVPN client on Emby Server* (which I need to manually append the Emby port in order to access my Emby server) Right now my Heimdall server just has links pointing to the local IP's of services running on my network, so obviously that doesn't work for accessing them from outside of my home network. The current services I'm hoping to be able to access from outside my network are as follows: \- Emby Media Server (currently using my OpenVPN VPS for external access) \- qBittorrent and some ARR's running on the same machine as Emby \- Blue Iris Server (currently using my OpenVPN VPS for access) \- Proxmox Server (currently no external access\*) \- \* I have Home Assistant running on a VM in Proxmox which I currently use Nabu Casa (Home Assistant Cloud Service) to access. \- Within Home Assistant I also have AdGuard Home and Unifi Controller addons (Containers) that I'd like access to; I have no problem moving them to my Docker LXC that's running on the same Proxmox machine, if need be. \- Docker with Jellyseerr, Portainer and Heimdall running in containers on my Proxmox machine. As with everyone that gets into self hosting, this list is bound to expand as my knowledge grows. Right now I'm very much a "n00b" when it comes to these things, which is why I'd like to learn how to do it "properly". Yes I know the *best way* is to just not expose my network to the internet, but I'm sure there must be a way for me to do this safely (or at least as safe as reasonably possible). ​ **TL;DR** My ideal scenario would be as follows: \- Head to "[*www.example.com*](https://www.example.com)" **->** End up at self hosted authentication page asking for Username/Password. \- Skip authentication if being accessed from within local network (Need to have WAF or I'll be in the doghouse...) \- Upon authentication be sent to self-hosted landing page (similar to Heimdall) with links to my local services. \- Clicking on said links would send you to different subdomains depending on service chosen ([*emby.example.com*](https://emby.example.com)*,* [*blueiris.example.com*](https://blueiris.example.com)*,* [homeassistant.example.com](https://homeassistant.example.com), etc...) ***In addition to that***, what would be more than ideal (ie. perfect for me) would be to have a different landing page per user; allowing me to give only media server access to friends/family, rather than exposing all my services to everyone with a password to my server, while being able to have private access to all of my services for myself. (I can do this using auto-login links with Heimdall, but I'd still need an authentication page before this). Apologies again for the long-winded post, I'm just really helping some of you more experienced self-hosters might be able to point me in the right direction to get me started on moving away from my current "workaround", and toward my ideal end-goal for my home network setup. Thanks in advance ---------------------------------------------------------------------- thekrautboy · 2023-10-19 15:22 > - Head to "www.example.com" -> End up at self hosted authentication page asking for Username/Password. You can do that easily with Authelia for example. The question is tho, how people end up at that prompt initially. If you want to fully selfhost, you either need some outside node on a VPS for example which redirects through a tunnel to your actual home network. Or you use a third party service like Cloudflare. > - Skip authentication if being accessed from within local network (Need to have WAF or I'll be in the doghouse...) Again, Authelia can do that. > - Upon authentication be sent to self-hosted landing page (similar to Heimdall) with links to my local services. If you combine Authelia with a reverse proxy, you can redirect after auth to wherever you want, for example exactly Heimdall, or Homarr or whatever. > - Clicking on said links would send you to different subdomains depending on service chosen (emby.example.com, blueiris.example.com, homeassistant.example.com, etc...) Again, a reverse proxy, ideally combined with a local DNS like Pihole for example, would do that easily for you. And you could use Lets Encrypt certs for valid SSL to use `https://emby.example.com` instead of `http://emby.example.com:8096` or `http://192.168.50.120:8096`. You do not need to purchase a public domain for that, but LE requires a public domain which could be a free subdomain for example from a provider like Duckdns.org or Dedyn.io Many reverse proxies have support for LE dns01-challenge with a lot of providers, so you dont even need to open any ports for that part. ---------------------------------------------------------------------- PMaxxGaming · 2023-10-19 15:35 Thanks! Those are great tips, and definitely sound like the type of thing I'm looking for, and I'm sure I'd have no problem setting them up, aside from one issue: My main concern, is using these services while behind CG-NAT; currently the only way I know how to access my network from outside at all is to go through my VPS using OpenVPN clients, since I don't have a public IP. I'd ideally like to do away with the VPN entirely, so I don't need to set up client apps to give new devices access, but adding the extra layer of CG-NAT on top of those services makes this all more confusing for me, since most of the information I've found online doesn't involve CG-NAT. ---------------------------------------------------------------------- thekrautboy · 2023-10-19 16:09 > I'd ideally like to do away with the VPN entirely, so I don't need to set up client apps to give new devices access, but adding the extra layer of CG-NAT on top of those services makes this all more confusing for me, since most of the information I've found online doesn't involve CG-NAT. You could run the reverse proxy on your VPS, and keep your VPN as a tunnel between your VPS and your home network. Clients would connect without any extra software to the public reverse proxy, which then redirects them through the tunnel to your home network. If you want to keep your VPS, that is the way i would do it. If you want to get rid of your VPS and also dont use software on the clients to connect, then you would need to use something like Cloudflare tunnels, which would replace your own setup. Clients connect to Cloudflare, and they redirect through a tunnel to your home network. ---------------------------------------------------------------------- PMaxxGaming · 2023-10-19 16:15 >You could run the reverse proxy on your VPS This may be the way I need to do it, unfortunately (it seems a fair bit more complicated for someone with pretty limited knowledge on this kind of networking). Ideally I'd like to use your second approach, with CF Tunnels (something I've looked into a bit in the past), but from what I understand, I'd run the risk of violating their TOS and being blocked if too much video passes through their server, which is fairly likely to happen when running a service like Emby through CF. ---------------------------------------------------------------------- thekrautboy · 2023-10-19 16:37 Yes, afaik CF doesnt allow media streaming with their free tunnels. But there was some noise about changes to their ToS about this recently, i dont know what exactly came out of it. ---------------------------------------------------------------------- PMaxxGaming · 2023-10-19 16:56 Thanks, for now I guess I'll look into setting up NGINX on my VPS; I just wanted to clarify something first. In order for this method to work, I'd still need an OpenVPN client running somewhere on my network, correct? If so, given the network structure I've listed in my OP, where should I run the client to minimize how many clients need to be installed on my home network? Having my services spread across multiple machines/containers (physical and virtual) sort of makes it difficult for me to figure out the most concise way of allowing myself access to \*everything\* on my network, without having to figure out how to spread OpenVPN clients all over the place. Also, just so I can make sure I'm understanding how this should work in the end, will the process to access my network go something like this? Head to *example.com* (I bought/registered this through Cloudflare) **->** *Cloudflare DNS* **->** *NGINX via VPS public IP* **->** *OpenVPN Server on VPS* **->** *OpenVPN Client IP on LAN* (**\***not sure exactly where to run this) **->** *Local Home Network Authentication Page* **->** *My self-hosted landing page* **->** *My Services, etc.* ---------------------------------------------------------------------- thekrautboy · 2023-10-19 17:04 > In order for this method to work, I'd still need an OpenVPN client running somewhere on my network, correct? Yes, as a tunnel between your VPS and your home network. Maybe consider switching from OpenVPN to Wireguard but if youre happy with OpenVPN there is nothing wrong with keeping it. > If so, given the network structure I've listed in my OP, where should I run the client to minimize how many clients need to be installed on my home network? Wherever you want. If you set it up as a site-to-site VPN tunnel, then you dont need to install OpenVPN anywhere else, only a single "exit node" on some device. Could be a container running somewhere or on a dedicated Raspi, doesnt exactly mater. Just make sure you have clear separation between the two networks, the home network and the VPN. So use distinct different subnets. You dont need to spread out OpenVPN clients all over, with site-to- site only a single install is needed. With correct setup, your VPS then basically exists as a device inside your homenetwork, the tunnel becomes invisible and nothing requires OpenVPN to access the VPS, and the other way around, whatever you want to come from the VPS can go through the tunnel and reach whatever you want in your home network. > Head to example.com (I bought/registered this through Cloudflare) -> Cloudflare DNS -> NGINX via VPS public IP -> OpenVPN Server on VPS -> OpenVPN Client IP on LAN (*not sure exactly where to run this) -> Local Home Network Authentication Page -> My self-hosted landing page -> My Services, etc. Almost. Your current OpenVPN setup as i understand it is a classic client-server setup. Switch that to a site-to-site tunnel and then there is no more client or server, the two sides are equal. Head to example.com (I bought/registered this through Cloudflare) -> Cloudflare DNS -> NGINX via VPS public IP -> OpenVPN on VPS -> through tunnel -> OpenVPN on LAN -> Local Home Network Authentication Page -> My self-hosted landing page -> My Services, etc. Guides about running a site-to-site OpenVPN or Wireguard exists in thousands and i imagine since you already have one running it should be easy to switch it around a bit. ---------------------------------------------------------------------- PMaxxGaming · 2023-10-19 17:19 Great, thanks for all the help. I'm in the process of setting up NGINX on my VPS right now, but I might actually just leave it how it is for now and start a new VPS (possibly with a different provider than GCP) and try something like Wireguard or Tailscale. The only reason I'm using OVPN is because that was the first tutorial I was able to understand when I switched ISP's and was forced to set up a VPS to access my network. One more question before I dive into this (hopefully I don't have to keep bothering you with questions, lol); after setting it up as a site-to-site, will *ALL* traffic from my LAN route through my VPS? If so, I may need to find a different provider with better bandwidth egress caps; GCP has been very cheap so far, but I've been really limiting what traffic I'm sending through it, and if all of the traffic coming out of my home network (general browsing, YouTube, etc.) ends up going through my VPS, the pricing scheme on GCP is pretty convoluted and difficult to understand/track. Currently, my services are all running on the same network as my "daily driver PC's"; I haven't split them onto their own VLAN yet, since I didn't want to break too many things at once and not have much time to fix it right away. My Emby/\*ARR Server is running on my "main" livingroom HTPC, which also happens to be the computer that gets the most use in the house (YouTube videos for my son, regular browsing, etc.); am I correct to assume that if I go the site-to-site VPN route, that in order to access my Emby server I'd also have to route all other traffic to and from that machine through the tunnel as well? Splitting my other machines onto their own VLAN will be trivial enough; it's mostly just this particular machine I'm concerned with, security-wise. I suppose my other option would be to move all of these services off of this machine to somewhere else if need be; I'm just not sure if it's completely necessary, or if there's a better option. Thanks again ---------------------------------------------------------------------- thekrautboy · 2023-10-19 17:58 > after setting it up as a site-to-site, will ALL traffic from my LAN route through my VPS? No, you can set it up how you like. You could route all traffic from your LAN through the tunnel to the VPS and from there to the open internet. Or you could set it as a split-tunnel and only route specific things through that tunnel. For example you could configure it that your torrentclient as a Docker container is connected to the tunnel and all of its data goes through there. But your desktop PC is not and it just uses your home router and ISP connection directly. Split-tunnel is probably the phrase you want to look up for that. > am I correct to assume that if I go the site-to-site VPN route, that in order to access my Emby server I'd also have to route all other traffic to and from that machine through the tunnel as well? No, your local emby server keeps his local IP address. Within your home network nothing really changes, your local router would know that emby is within your local network (based on the subnet) and doesnt route that anywhere else. But if you set up your VPS with a different subnet (and you should), and you try to access that IP, then your router (when set up with a custom route) points that to the Wireguard/OpenVPN tunnel, it gets routed through there and reaches the VPS. ---------------------------------------------------------------------- PMaxxGaming · 2023-10-19 18:13 Hmm, okay. I believe I've got a lot more research to do, haha. I'm not really familiar with setting up subnets, I'm more comfortable with VLAN's, and that's currently how I have my network segregated (as well as with pretty specific firewall rules). For example, my main normal-use network is 192.168.1.0/24, I have 192.168.2.0/24 as a separate VLAN for IOT devices, 192.168.3.0/24 for guests, and I'm just now moving some other machines to 192.168.4.0/24 for self-hosted servers and related IP's. Should I do further network segregation than this using subnets? Or would this VLAN setup be sufficient? My thoughts were to have all of my Internet-facing services (emby, Blue iris, home assistant, etc) on VLAN 4, and just block their access to the rest of my networks (unless needed for a certain device or whatever), that way my VPS is only connected to IP's on VLAN 4 ---------------------------------------------------------------------- thekrautboy · 2023-10-19 18:18 I never used it this way myself but i would assume its also possible to keep your VLAN separation and just send a entire VLAN through the tunnel, and keep other VLANs as standard etc. Maybe /r/HomeNetworking would be of help ---------------------------------------------------------------------- PMaxxGaming · 2023-10-19 18:20 Thanks, I was actually just starting to think I might be getting more toward /r/HomeNetworking territory with my questions. I appreciate all your help, it's definitely helped clear my head a bit and set me on the right path. I know I still have a lot of learning to do though. ---------------------------------------------------------------------- thekrautboy · 2023-10-19 18:28 :)