[Poll] What do you use for remote service access? reddit / selfhosted ---------------------------------------------------------------------- Zestyclose_Car1088 · 2023-11-15 12:36 Also what additional security measures have you implemented? [View Poll](https://www.reddit.com/poll/17vspzn) ---------------------------------------------------------------------- mujimuji · 2023-11-15 13:09 I use a combination of VPN (WireGuard) and reverse proxy (Nginx Proxy Manager). All my services are running through the reverse proxy but any "sensitive" ones (e.g. ones I don't want publicly accessible) will only work if I'm local or connected over the VPN. ---------------------------------------------------------------------- cakee_ru · 2023-11-15 13:18 Same. Also suggest you to return 403 by default on all invalid responses so bots won't be able to scan for common subdomains. ---------------------------------------------------------------------- BinaryPatrickDev · 2023-11-15 13:20 I wish you had separated Tailscale and traditional VPNs ---------------------------------------------------------------------- Zestyclose_Car1088 · 2023-11-15 13:23 Should I redo it? What way would you split it? ---------------------------------------------------------------------- Spuxilet · 2023-11-15 13:23 I have two wireguard servers and a reverse proxy (Traefik). I have setup my services so that they are only accessible from one wireguard VPN. No matter i am on LAN or WAN. Second wireguard server is to connect to different vpn networks that i usually need to push some code or access the dev or prod servers for my projects. I have build wg-easy manually to install many vpn clients within it's image and configure routes so that they work without problems simultaniously. It all works GREAT. Openvpn, Openconnect, pptp and barracuda VPN. I had this setup on my router but i was given this barracuda vpn client which can't work on devices except X86. Sadly my router is not x86 and i just moved everything and installed all these vpn clients with that barracyda vpn client inside docker container with wg-easy. ---------------------------------------------------------------------- BinaryPatrickDev · 2023-11-15 13:23 Exactly the same except having tailscale/zero tier as its own selection. ---------------------------------------------------------------------- Anejey · 2023-11-15 15:05 Tailscale, and a Cloudflare Tunnel going to Nginx Proxy Manager. So all three, in a way. ---------------------------------------------------------------------- itsupport_engineer · 2023-11-15 15:36 PiVPN - Wireguard ---------------------------------------------------------------------- tounaze · 2023-11-15 15:41 We can’t choose multiple answers and I think a lot of us are using a combination of at least two of the answers ---------------------------------------------------------------------- CjKing2k · 2023-11-15 16:42 Cloudflare tunnel and Tailscale. Guacamole for remote desktop. ---------------------------------------------------------------------- CjKing2k · 2023-11-15 16:42 Cloudflare tunnel and Tailscale. Guacamole for remote desktop. ---------------------------------------------------------------------- eagle101 · 2023-11-15 17:17 How do i do that? ---------------------------------------------------------------------- aaronryder773 · 2023-11-15 17:41 How did you set this up? I have been using wg-easy too. Are they connected p2p? Is there something that I have to do to enable p2p? ---------------------------------------------------------------------- zezimeme · 2023-11-15 19:07 yes, don't leave us hanging here ---------------------------------------------------------------------- lucassou · 2023-11-15 20:12 Traefik only accessible through tailscale, cloudflare tunnel for one website and I just noticed a few days ago that apparently plex used upnp to make itself accessible to the internet... ---------------------------------------------------------------------- ceciltech · 2023-11-15 20:23 >Cloudflare Tunnel going to NPM Doesn't cloudflare tunnel do the reverse proxy thing? I keep seeing people using both so I must be misunderstanding it. ---------------------------------------------------------------------- adamshand · 2023-11-15 20:43 Reverse proxy, Cloudflare tunnels, Tailscale. ---------------------------------------------------------------------- Anejey · 2023-11-15 20:52 It works either way. You can have tunnels going directly to services with their own ip:port, or have the tunnel go to NPM from where it then gets proxied. I used to have multiple tunnels with their own configs going to separate services, but now I just run a single tunnel to NPM and all I have to do for a new service is add a DNS entry and add a proxy host in NPM. It's just simpler, and it feels like I got more control this way. ---------------------------------------------------------------------- EndlessHiway · 2023-11-15 21:14 Why bother with a tunnel if you are exposing all your data anyway? ---------------------------------------------------------------------- Anejey · 2023-11-15 21:18 How am I exposing all my data? Everything is protected behind NPM and passwords. The tunnel is necessary since I can't open ports due to being behind CGNAT. ---------------------------------------------------------------------- EndlessHiway · 2023-11-15 21:28 Well since it is all decrypted by Cloudflare as it goes through their servers they can see every bit of data you send. If you like big corporations having access to your data that is cool. You do you! ---------------------------------------------------------------------- cakee_ru · 2023-11-17 02:30 For Nginx you configure your default server to return 403. The point is that by returning 403 on everything the bot can't differentiate whether you don't have a service at all (404) or local access only (403) or other errors. I picked up this idea a long time ago watching DefCon, they were using 200 there by default on all requests, but I had some issues with that personally so I switched to 403. 200 would confuse bots even more. I have been in tech for a long time now and I really enjoy the ways you can actually actively hurt the bad guys instead of just blocking them. Like here with bots that will pollute someone else's logs that they authenticated successfully on my non-existent wordpress server. Or mail/phone scammers wasting their time while you have fun. Or, my favourite, things like AdNausea that confuses web advertisers by not only blocking the ads for you, but also clicking on random ones in the background. Google utterly hates it as it breaks your ad profile. This is a really fun topic and I wish it was more popular. ---------------------------------------------------------------------- s3r3ng · 2023-11-17 09:53 If you guard the machine well via firewall you can simply Let's Encrypt for SSL via AAAA records to the public IPV6 address of one of your home machines with nginx reverse proxy.