Selfhosting, VPN and other questions! reddit / selfhosted ---------------------------------------------------------------------- mrRNobodY1 · 2023-11-13 12:45 Selfhosting, Fastweb and other questions! Hi, I recently tiptoed into the beautiful world of sefhosting and am starting to put together various pieces of knowledge scattered around the web. I'll get straight to the point, I have a server machine running debian 12 in which I have installed -through docker- the whole *rr suite (radarr, sonarr, etc) and in addition I am using jellyfin as a media player. I then switched to PiHole and my next steps would be to try: - Nextcloud for storing personal files - Bitwarden Questions: I currently have a natted IP from my ISP, however they told me they can give me a public and static IP. So the next step would be to open only the port for VPN (wireguard) on my modem. In this way am I covered from being exposed on the Internet or is there anything else I should know? ---------------------------------------------------------------------- EspritFort · 2023-11-13 13:04 >I currently have a natted IP from my ISP, however they told me they can give me a public and static IP. Congratulations, I'd say that this is very much the exception, not the rule. >So the next step would be to open only the port for VPN (wireguard) on my modem. In this way am I covered from being exposed on the Internet or is there anything else I should know? This is important: The whole point of using a VPN to remotely access local services in you home network is to **minimize** exposure by only providing a single way of entry. *Your VPN server is - by its very nature - exposed*. Secure it to the best of your ability. ---------------------------------------------------------------------- mrRNobodY1 · 2023-11-13 13:13 Does securing the VPN server mean doing the Wireguard configuration done very scrupulously, or should I inquire about something else besides that? ---------------------------------------------------------------------- EspritFort · 2023-11-13 13:40 You will get various different answers depending on personal experience, risk tolerance. There just *are* many [possible answers here](https://openvpn.net/blog/vpn-hardening/). My minimum setup involves adding [fail2ban](https://github.com/fail2ban/fail2ban) to each exposed host.