Ways to access a server behind CGNAT safely? reddit / selfhosted ---------------------------------------------------------------------- fdegil · 2023-11-10 15:42 Hi, this is my first post on this subreddit. I've been self-hosting various applications (Syncthing, Pi-hole, Navidrome, Jellyfin, Actual...) for almost two years now, and I want to take a step forward by accessing my resources from the public Internet. I've been researching for one year about topics like port forwarding, reverse proxying, setting up VPN, and moving to a VPS; and I recently started trying Microsoft Azure's Standard B1s VM. However, I can't devise an acceptable and satisfactory solution. These are some of my concerns: * I don't want to apply for static IP and port forward from my router to my modem to the public Internet. * I need a sustainable solution since most VPS providers are too pricey for me. ​ I'm open to every type of suggestion; you can criticize my concerns, too :) ---------------------------------------------------------------------- schklom · 2023-11-10 15:56 Oracle gives free VPS, permanently free. Have a backup of these VPSes though, Oracle sometimes (haven't experienced it myself, but some people here did) kills these VPSes. ---------------------------------------------------------------------- ElevenNotes · 2023-11-10 15:56 Tailscale. ---------------------------------------------------------------------- Significant-Neat7754 · 2023-11-10 16:19 This. Nothing else gives you as much freedom or is as reliable or secure. ---------------------------------------------------------------------- tschloss · 2023-11-10 16:30 CF Tunnels. Based on a reverse proxy in the cloud with a VPN between local and CF. So different from a direct IP connection. ---------------------------------------------------------------------- certuna · 2023-11-10 16:46 /r/Zerotier or /r/Tailscale with the caveat that this entails installing a application on the client device that accesses the device - so workable if you're accessing your server using your own phone/laptop, not so much on a company PC or your friends. ---------------------------------------------------------------------- ElevenNotes · 2023-11-10 17:04 but please with headscale and OICD. ---------------------------------------------------------------------- zachfive87 · 2023-11-10 17:37 vps + [boreing proxy](https://boringproxy.io/) Need your own domain that supports wildcard subdomains. Pretty easy to set up though and works well. ---------------------------------------------------------------------- TheCaptain53 · 2023-11-10 22:16 Headscale requires port forwarding, so OP would have to host it in a public cloud, increasing complexity and cost. ---------------------------------------------------------------------- ElevenNotes · 2023-11-10 22:17 Thanks for your input, I did not reply to OP but to /u/Significant- Neat7754, I think you got a little confused who I addressed. ---------------------------------------------------------------------- ismaelgokufox · 2023-11-10 22:48 I think we need a well-configured bot that replies “Tailscale” and/or “Headscale” 🤪 ---------------------------------------------------------------------- ElevenNotes · 2023-11-10 22:50 Add a bot that says "don’t use Wi-Fi mesh", “use Proxmox or ESXi”, “Wi-Fi is not internet speed, if you have 1Gbps that does not mean your Wi-Fi can transmit at that speed too, check your devices”, “Use Plex or Jellyfin”, “TrueNAS, Unraid or get a second-hand Synology NAS”, “RAID is no a backup, follow the 3-2-1-1-0 backup rule, use RAID6 on big drives and RAID5 on smaller drives (< 10TB)”, … ---------------------------------------------------------------------- Sajberspejs · 2023-11-11 00:53 Is headscale even secure? The devs says themselves that security isn't a top priority yet, getting as much working as possible is. ---------------------------------------------------------------------- betanu701 · 2023-11-11 04:19 Is it me or does this question keep getting asked like every few days? I know OP is not the one that keeps asking but it seems like I see this or something very similar a couple times a week. ---------------------------------------------------------------------- xkcd__386 · 2023-11-11 04:31 also, I get the feeling if someone does a massive `sort -u` on this sub it'll reduce to a few GB ;-) ---------------------------------------------------------------------- Toastytodd4113113 · 2023-11-11 05:10 Cloudflare tunnels are easiest. and pretty secure. just have to be able to trust the middleman.. other than that.. Localxpose works pretty well. I use 3 seats on that, for game world hosting, and some specific pages, and sometimes temp pages. its fairly simple. documentation is subpar but its configurable, and can set it up as a service. has a gui i think now too. ---------------------------------------------------------------------- ElevenNotes · 2023-11-11 08:07 Unaware to be honest, but if you don’t, you rely 100% on Tailscale for your VPN infrastructure which is bad, very bad. ---------------------------------------------------------------------- junialter · 2023-11-11 17:47 IPv6 ---------------------------------------------------------------------- DopeBoogie · 2023-11-12 05:09 I think that's a little unfair. Tailscale only coordinates routing, the actual communication is peer- to-peer in the majority of cases and encrypted end to end. Additionally with TailNet Lock you can designate signing nodes which effectively makes it zero-trust by eliminating the only point where you had to trust tailscale's servers. ---------------------------------------------------------------------- ElevenNotes · 2023-11-12 05:10 Agreed, but still. Use plain old Wireguard if possible and only use Tailscale as a last resort. ---------------------------------------------------------------------- DopeBoogie · 2023-11-12 05:14 > If you want 'random' externals accessing your server, you'll have to VPN out to a third party server that forwards ports, or host the entire thing in the cloud. Check out [Tailscale Funnel](https://tailscale.com/kb/1223/funnel/) ---------------------------------------------------------------------- PhilipLGriffiths88 · 2023-11-12 12:50 You could also use [zrok.io](https://zrok.io). It's an open source alternative which can be self-hosted or has a free SaaS. It also includes cool features like 'private sharing' (which means both sides can be private with no inbound ports). I work on the parent project.