Exposing self-hosted services to internet for self-use only reddit / selfhosted ---------------------------------------------------------------------- r4nchy · 2023-11-17 07:48 I have several selfhosted services that I have been using for months, now I wish to access these while I am not at home. Likes of nextcloud, nocodb, wikijs and other media sharing self-hosted services I would like to know what precautions should I take so no one knows that such a domain exists. should I purchase a crazy numbered domain like [671341412312.com](https://671341412312.com) ? or should I go for .tk domains. Would like to get some suggestions from this community on other aspects that I am missing. ---------------------------------------------------------------------- thekrautboy · 2023-11-17 07:57 Using a "crazy number" domain does not provide any security. ---------------------------------------------------------------------- AlexisColoun · 2023-11-17 07:57 There are bots running constantly scanning specific ports on all public IPs. Your domain doesn't matter. Use something short and human readable. If you only want to use your own devices to connect to your services, connect them to your network via a VPN like wireguard. This way you will have to open up only one port and this can be a port with a non standard number like 59274. If you want to be able to reach that services from any browser, at least put a reverse proxy in between your services and the Internet. Not only will it make it simpler for you to access different services by simply typing in a subdomain, it also will handle certificates, tls encryption and in some cases if setup properly with authentic or similar services 2FA which will provide better security than a random number domain by a magnitude. ---------------------------------------------------------------------- niceman1212 · 2023-11-17 07:58 If you want no one to know the domain exists, don’t register one and don’t use letsencrypt (certificate transparency). Use a VPN. If you absolutely want remote access, a domain with a wildcard certificate is the best option since nobody knows exactly which subdomains you have ---------------------------------------------------------------------- Simon-RedditAccount · 2023-11-17 08:29 Security through obscurity is a bad idea. Buy a good domain name. Then, at your reverse proxy: * either configure mTLS (aka TLS client certs) - impossible to crack (at least until quantum arrives) * or just use HTTP Basic Auth + strict fail2ban rules Since you're the only user, you can also spin up your own CA, and use it for both server and client TLS certificates, if you want to *(note that it won't protect you from bots learning about your domain via PTR or other techniques)*. ---------------------------------------------------------------------- Own_Career_7388 · 2023-11-17 10:07 Read through the [post](https://www.reddit.com/r/selfhosted/comments/17u7a4x) that I made a few days ago. I'm a noob too, and people left some really great tips! ---------------------------------------------------------------------- PaulEngineer-89 · 2023-11-17 10:22 1. Install Tailscale. 2. Set 3 firewall rules on the server. First is allow incoming on port tailscale0. Second is deny incoming and outgoing on eth0. That way you block everything except Tailscale which is a private network. Alternatively if you prefer you can turn off UPNP and any port mapping at your router. Then add a firewall rule at the router or separate firewall to block incoming and outgoing for the server. Note that this of course blocks Tailscale too unless you whitelist UDP/51280. It also blocks Cloudflare tunnels. This is very close to router defaults except it blocks outgoing internet too. Here the server is not modified we are just setting in/out rules on the LAN firewall. ---------------------------------------------------------------------- GolemancerVekk · 2023-11-17 10:45 Install Tailscale on your server. Install Tailscale on the devices you take with you (it is available for PC and mobile). It's a VPN, but one that's very easy to use and can bypass ISP NAT so you don't need port forwards or a public IP. Whenever you want to connect you activate Tailscale on the device and boom, you can magically access your server. You can also configure it to access other things on your LAN if you want (look for "subnets" in Tailscale docs), or configure it like a normal VPN (look for "exit node") to protect your internet connections when you use hotel or airport wifi. ---------------------------------------------------------------------- chkno · 2023-11-17 11:42 If you really want no-trace services, consider running them as [Tor Onion services](https://community.torproject.org/onion-services/). But usually that's not what folks aim for? Most times it's fine to have a domain name and visibly open ports, as long as the protocols you'll be using require authentication. If you want to use protocols that don't authenticate, you can wrap them in another protocol that does. For example, I use [stunnel](https://www.stunnel.org/) for this: * The non-authenticating service listens on localhost only. * An instance of stunnel runs on the same machine and listens for connections from the internet on a different port. When a connection from the internet is established and authentication is satisfied, stunnel forwards it to the non-authenticating service via the lo/loopback/localhost interface, which it can access because it is running on the same machine. This stunnel server instance has a list of client certificates that are permitted to access the service. If you're not on the list, you don't get to use the service. * Another instance of stunnel runs on the client. It listens on localhost only. When a connection in established, it forwards the connection to the server stunnel instance, presenting a client TLS certificate and encrypting the traffic. It has a list of acceptable server certificates and will balk if other end's certificate is not on the list (mutual authentication!). * I tell the client application to connect to localhost: rather than give it the server's address, so that its connection will go through the TLS tunnel, be encrypted, and be presented with an authorized client TLS certificate. I do this separately for each service, which sounds like a pain, but I set up the first one in a flexible templatey way so using the same setup for multiple services was surprisingly easy. ... but maybe you just want a VPN? Not the commercial services that call themselves this, but plain ol' normal VPN where you authenticate to your home router/firewall from outside on the internet, bring up a pair of virtual network interfaces—one on your laptop and one on a machine on your internal home network (probably your router/firewall, but it doesn't have to be)—that encrypt traffic flowing between them and allow your laptop to behave as if it is on your internal home network, even though it is physically somewhere else. Check out [OpenVPN](https://en.wikipedia.org/wiki/OpenVPN) or [WireGuard](https://en.wikipedia.org/wiki/WireGuard). ---------------------------------------------------------------------- avdept · 2023-11-17 12:08 Use VPN and something like pihole for DNS resolution. Then get whatever domain name you'd like and. Inside pihole point this domain to your local network. You can even issue https certs, just make sure you have wildcard cert. ---------------------------------------------------------------------- GamerXP27 · 2023-11-17 12:10 vpn is all you need ---------------------------------------------------------------------- beje_ro · 2023-11-17 12:41 Warning: tk domains registrar has 0 GDPR. Might be irrelevant now, but I didn't managed to delete my data once I wanted out ---------------------------------------------------------------------- jbarr107 · 2023-11-17 13:06 This is my policy: For publicly accessible services like a website, I use a cloudflare tunnel. For restricted access to just a few users, I use a cloudflare tunnel and a cloudflare application to manage access authentication. For my exclusive restricted access to the infrastructure, I used tailscale. ---------------------------------------------------------------------- jaredearle · 2023-11-17 13:12 Getting an obscure domain name doesn’t matter as attackers go straight to the IP address. If you have a certificate on your secret domain name, they have your domain the moment they hit port 443. Don’t use “security through obscurity”; instead just secure your services or host a VPN. ---------------------------------------------------------------------- AnderssonPeter · 2023-11-17 13:12 If you go with a cert try to get a star cert that way you make it a little bit harder for hackers to find your subdomains. ---------------------------------------------------------------------- BebopTheRocksteady · 2023-11-17 13:21 ZeroTeir (or a VPN) - if all you want is to access those services from outside your network IMO - the only reason to put something “on the internet” is so that the entire “internet” can access it ---------------------------------------------------------------------- coconut-hail · 2023-11-17 13:32 Try using Tailscale. It's easy to use & free for personal use. It will only allow devices with Tailscale installed to view your self-hosted services. They have clients for mobile devices, PC's, Mac's and even Apple TV etc. Their technology is based on Wireguard so it's very fast and secure. https://tailscale.com/ ---------------------------------------------------------------------- ghanta-congress · 2023-11-17 13:54 Hi, I see this approach mentioned a lot. I wanted to know, in this scenario, let's say if I want to route bookstack.example.com to one of my machine which hosts bookstack wiki. Let's say I also use nginx reverse-proxy over https. So do I still make the 'A bookstack my.machine.ip 600secs' DNS record entry at my domain provider? (Where 'my.machine.ip' is a local IP only accessible if I am inside the VPN network?) I understand using the wildcard certificate generation method ensures the subdomain(s) in use (bookstack, mattermost, bitwarden etc) dont end up on a publicly available published report. But are there any downsides of having my local network IP in public DNS records? Or is that not the right way to do to begin with and a better alternative exists? I am assuming since it's behind VPN, bots obviously arent going to be able to reach it to ping/hit it for a scan? Is that correct? But then, arent the same subdomain values also the part of that DNS entry, is it not? Will DNS lookup not reveal those? ---------------------------------------------------------------------- cmdr_cathode · 2023-11-17 13:59 Seriously as everyone suggests: use tailscale or another VPN. Tailscale is incredbly easy to setup. ---------------------------------------------------------------------- Antonaros · 2023-11-17 14:15 6 to 9 digit .xyz domains are only around $1 a year. That's what I did and definitely recommend it. ---------------------------------------------------------------------- phein4242 · 2023-11-17 14:19 Id say, use a vpn, period. People are not that original and domain enumeration tools are widely available. Security through obscurity only shields you from naive attackers. ---------------------------------------------------------------------- pchrisl · 2023-11-17 14:44 VPN is the way to go. Could use this opportunity to upgrade your router. I bought a box from [protectli](https://protectli.com) and run OPNsense on it. There's good documentation on how to set up a wireguard vpn, and the community is vibrant. Its also nice because there's _lots_ of options so its a nice thing to grow and learn with. ---------------------------------------------------------------------- DIBSSB · 2023-11-17 15:36 Use tailscale ---------------------------------------------------------------------- rsachoc · 2023-11-17 16:00 I may be wrong, however even with a wildcard CNAME your subdomains are still discoverable. I did a check a while back when I saw someone developed a tool to do exactly that and mine certainly showed up. I did find https://subdomains.whoisxmlapi.com/ which seems to do the same thing. You could also use Cloudflare tunnels, which folks around here seem to recommend if you don't want your subdomains showing up ---------------------------------------------------------------------- geek_at · 2023-11-17 16:13 Very true! Too many people don't know that if you get a certificate (paid or free) it shows up in the certificate transparency reports. It's a common vector for attackers in the reco phase. You can get a wildcard cert though and just not use the root domain but that's also just "security by obscurity" which is not as safe as a VPN ---------------------------------------------------------------------- thekrautboy · 2023-11-17 16:39 How would that work if they are not defined anywhere at all? Impossible imo. And i just checked a few of mine on that link, no subdomains listed. ---------------------------------------------------------------------- rsachoc · 2023-11-17 17:01 I'm no expert, but my wildcard domains that I had did show up. I could be leaking the information elsewhere I suspect, which is probably bad. See this discussion also https://news.ycombinator.com/item?id=37531801 ---------------------------------------------------------------------- thekrautboy · 2023-11-17 17:08 I dont see anything in that link that says disagrees with my statement. ---------------------------------------------------------------------- rsachoc · 2023-11-17 17:11 I wasn't disagreeing, just expressing (my admittedly probably wrong) personal experience :-) ---------------------------------------------------------------------- thekrautboy · 2023-11-17 17:25 Okay :) ---------------------------------------------------------------------- FA40 · 2023-11-17 17:27 Out of curiosity. If someone is accessing self hosted services only from certain locations where ip addresses are known, is it a good idea to whitelist those ips in firewall and block external access for the rest? ---------------------------------------------------------------------- Victorioxd · 2023-11-17 17:40 Crazy number domain doesn't provide any security but you can buy a 1.111B class .XYZ domain for as cheap as 0,62USD a year ---------------------------------------------------------------------- KenadyDwag44 · 2023-11-17 18:01 Second this. I have certain things exposed via a reverse proxy but the majority is done using tailscale. Super easy, and for places I don’t want to have to worry about it (like for example parents house) I have a Pi 4 there as a subnet router. ---------------------------------------------------------------------- Do_TheEvolution · 2023-11-17 18:09 * install opnsense * set up geoip block where only IPs from your own country can ever initiate connection from the outside * keep your stuff up to date * enjoy security ---------------------------------------------------------------------- Fun_Chest_9662 · 2023-11-17 19:27 If it is just for you and no one else you could set up something like twingate in place of a vpn or punching holes in your network. When im out of town or just need to access something internaly when im gone, as long as. I am connected to my twingate connector i have access the what i need. Its also super easy to granularly set access controls to only allow access to systems on specific ports etc. Took the headache of port forwarding, ipsec, and vpn and made it simple to manage and access what i need. Simply run the connector in docker and your all good. Heres the link if you wanna read up on it or try it out. [link](https://www.twingate.com) ---------------------------------------------------------------------- r4nchy · 2023-11-17 19:32 I will be using cloudflared, in addition I have dynamic IP so would that protect the port detection ? Would definitely take a look at that sub, ---------------------------------------------------------------------- r4nchy · 2023-11-17 19:34 I will also be using cloudlfared, but will have to look at tailscale. Really appreciate you mentioning ---------------------------------------------------------------------- Ursa_Solaris · 2023-11-17 19:36 Also chiming in, no subdomains of mine show up except a temporary one that I made a certificate for 6 months ago, and it's not even one I ended up exposing to the internet or registering DNS for. ---------------------------------------------------------------------- tech2but1 · 2023-11-17 19:40 > I have dynamic IP so would that protect the port detection Nope. ---------------------------------------------------------------------- tech2but1 · 2023-11-17 19:42 Yep. ---------------------------------------------------------------------- r4nchy · 2023-11-17 19:45 well I guess I will have to get into VPN services, looks like it is very crucial ---------------------------------------------------------------------- Ursa_Solaris · 2023-11-17 19:47 > So do I still make the 'A bookstack my.machine.ip 600secs' DNS record entry at my domain provider? (Where 'my.machine.ip' is a local IP only accessible if I am inside the VPN network?) [...] But then, arent the same subdomain values also the part of that DNS entry, is it not? Will DNS lookup not reveal those? You should only set external DNS records for stuff you actually want to be reachable on the internet; for that, if you just use `*` as the host, `bookstack.domain.tld` or anything else will route with that rule. With both the certificate and DNS record set to wildcards, there's no external way for people to see your subdomains. > Or is that not the right way to do to begin with and a better alternative exists? You shouldn't be pushing internal IP addresses as DNS records, no. You should set up an internal DNS server and use that to make local DNS records. A common thing is to use PiHole or AdGuard to do this, on top of the adblocking. Other DNS systems can also do it, like Unbound on OPNSense, or the myriad of generic DNS servers you can set up from scratch. > I am assuming since it's behind VPN, bots obviously arent going to be able to reach it to ping/hit it for a scan? Is that correct? If the VPN is the only method of access, then yeah they won't be able to connect either way. ---------------------------------------------------------------------- thekrautboy · 2023-11-17 19:47 No. ---------------------------------------------------------------------- Ursa_Solaris · 2023-11-17 19:48 Obscurity is a perfectly valid *layer* of security. There's no reason to expose information that doesn't need to be exposed. ---------------------------------------------------------------------- r4nchy · 2023-11-17 19:55 I never really understood the concept behind their free domains, but I never purchased a free/cheap domain after my first experience of getting charged 2-3 times for renewal. However, are you talking about deletion of your personal data or your website data ? ---------------------------------------------------------------------- FatalV0rt3x · 2023-11-17 19:59 Couldn't you just get a regular domain and use a firewall to prevent access, so only your IP address(s) are able to access it. I'm currently doing this myself, however I have a VPN on my local network that allows me access to my self-hosted service remotely as if I was at home. There are other things you can do with cloudflare that will lock the sites down with authentication, but VPN and firewall have worked pretty well for my use cases. ---------------------------------------------------------------------- r4nchy · 2023-11-17 20:03 hmm the Tor network, there was this hacking of a famous site on tor network that used to check for online/offline tor links. Hackers deleted his online hosting platform and all the data along with it. I forgot its name. But what I fear most is if I have one low security service running wouldn't that be the gateway for all the attacks. I think I will have to run this VPN service, seems like a pretty good idea ---------------------------------------------------------------------- Patient-Tech · 2023-11-17 20:17 Tailscale, ZeroTier, whatever. It’s going to be much more secure, has good apps for GUI’s and mobile and will be setup and running in less than ten minutes. I love tinkering around with stuff like OP was thinking of domains and forwarding dns and ports and the like, but it’s a commitment. I’ll probably spend about an hour or two, get something started to work and then have to stop and do other things. (Like go to bed at a decent hour). Learned a lot, had some fun, but man, I miss the days of when I’d get home from school and have nothing but time and boredom to fill. ---------------------------------------------------------------------- phein4242 · 2023-11-17 20:18 Theoretically, yes. In the real world it is still a liability waiting to happen, since services that should not be exposed to the internet, should not be exposed in any way, full stop ;-) ---------------------------------------------------------------------- hand_in_every_pot · 2023-11-17 20:52 Just use Cloudflare Zerotrust - create a tunnel for your network and add sub-domains for each self-hosted item you want browser access to. After that set up an Application, add in the sub-domains (5 max per application, but you can keep creating application). Then under Applications/policies configure rules. Under Include I put selector/login methods and value one-time PIN. Under Required I put selector/login methods and value one-time PIN and then selection/emails and value ["mypersonal@email.com](mailto:"mypersonal@email.com)" (your email). So basically if I go to one of my subdomains from any device I need to request a pin (which ONLY will get sent to MY email address) and then enter the pin to finally get in. The access remains available based on your "Session Duration" in the Application/Overview tab. Also I don't need to login each time, just once during the duration I set for all of my subdomains. ---------------------------------------------------------------------- ripnetuk · 2023-11-17 20:58 Third this. You can even set public dns entries to private IP addresses, then you can have it all ssl on top of tailscale. ---------------------------------------------------------------------- BillGoats · 2023-11-17 21:12 I've been hardening my server recently after increasing the potential attack surface. Personally, I went for a mixed solution. Some of my services are available through public subdomains. All of them use a wildcard cert. MFA is enabled where possible. Via FireZone, can gain access to my home network and the services that are not otherwise exposed. The FireZone config site is publicly available (though it probably doesn't need to be), but the one and only user in it has MFA enabled. SSH is only available locally or through FireZone. Furthermore, I've disabled root login and only allow authentication via private key. I'm lazy, so my keys are passwordless, but I've also made it so that elevation (sudo) requires a (strong) password once per session. Oh, and I implemented geo-blocking in CloudFlare, so that any requests from outside my country are blocked. I have yet to set up a firewall - but only ports 80 and 443 are open (and point to my nginx/npm instance). Security isn't my expertise - but it thought I'd share my config for others to learn from or criticize. ---------------------------------------------------------------------- noaccess · 2023-11-17 22:01 cloudflare / cloudflared. No ports exposed, static or dynamic dns does not matter. ---------------------------------------------------------------------- SnooPets20 · 2023-11-17 23:34 I don't know why people recommend Tailscale so much when ZeroTier exists. Like, Tailscale is good and all, but it requires you to log-in to an account. Not just you, everyone who uses your network. ZeroTier doesn't give a damn. You just need an account to actually create the network, obviously, but anyone else can just join right away. ---------------------------------------------------------------------- themightychris · 2023-11-18 00:00 this ^ I use ZeroTier, and then point subdomains under my personal domain name at the ZeroTier IP for each of my devices. Then I can use those hostnames but no one else can, and name based virtual hosting is easy ---------------------------------------------------------------------- MrFlibble1980 · 2023-11-18 00:01 If the domain isn't critical if it changes, you could use [freedns.afraid.org](https://freedns.afraid.org). I've been using the free version for over a decade (but did donate recently). A couple of domains have come and gone, so I've had to pick new ones, but it's not a big deal. ---------------------------------------------------------------------- MrFlibble1980 · 2023-11-18 00:04 I'm not sure what you mean by gateway - you don't need to run an exit node to run tor, so all the traffic will stay within tor if you want to. ---------------------------------------------------------------------- thekrautboy · 2023-11-18 00:28 > But then, arent the same subdomain values also the part of that DNS entry, is it not? Will DNS lookup not reveal those? With a wildcard they dont have any entries. The only entry would be `* ` which would mean something like `*.example.com` and it points at whatever IP you want. Then every query for a subdomain will also point to that IP. But there are no records that would reveal which subdomains exist or not. > But are there any downsides of having my local network IP in public DNS records? No, your local IPs are completely useless info to the outside world. You can either set your local IPs in your public DNS and keep things unified and simple that way. And only if a client is actually inside your network can they do anything with the local IP, for anyone else its useless. Or you can run two points of DNS; the public one on your domain and you point that to whatever you like. And you run a private local DNS, like a Pihole or whatever, and that local DNS gives out the actual internal IPs for your services. Again, only if the client is also in that network. Anyone on the outside would automatically query the public DNS for that domain and get different replies. ---------------------------------------------------------------------- SpongederpSquarefap · 2023-11-18 00:45 This is why WireGuard is best You can't port scan WireGuard It drops traffic that doesn't use a public key it already knows ---------------------------------------------------------------------- mywittynamewastaken · 2023-11-18 00:56 In the past for threat intel I have subscribed to passive DNS feeds. If your subdomain is queried through any part of the collection network (which includes ISPs and major DNS providers), it will show up on a newly observed domain/subdomain list. ---------------------------------------------------------------------- SpongederpSquarefap · 2023-11-18 01:02 For just yourself? Get a domain that you can actually remember and use and then set up a WireGuard server (I recommend the Linuxserver.io WireGuard image) Use that to access your stuff Do you have 1 thing you desparately need to be publicly accessible? VLAN the VM off so it's on its own and put a reverse proxy in front of it with HTTPS (and ideally MFA if you need auth) ---------------------------------------------------------------------- saint11 · 2023-11-18 01:17 Have you heard about Twingate? It's kinda like a VPN but not really. It's free and does everything I need. If it's just for self use I think it's enough. ---------------------------------------------------------------------- dauntlesspotato · 2023-11-18 01:25 I use client certs in my lab. I was actually able to set it up to trust the CA for the company I work for, so that coworkers who already have pki set up can access my services ---------------------------------------------------------------------- LanguageManiac · 2023-11-18 02:25 You could use Zerotier. With zerotier you can create a private network between your server and as many as 24 other devices (i.e your phone, your laptop...) It doesn't expose your stuff to the whole internet. You have to manually approve the devices you want to add to the private network through zerotier website. I just did this for mi Raspberry pi, and now pihole filters my internet traffic even when I'm away. Seriously, look it up, it's free up to 25 connections and since it's private you don't need to go crazy about protecting your server from DDoS or buying a domain. ---------------------------------------------------------------------- Bytepond · 2023-11-18 03:05 Use cloudflared and Cloudflare Zero Trust / Access. You tunnel your services to Cloudflare, who then secures them behind a 2FA wall. No traffic ever goes to anyone aside from you. ---------------------------------------------------------------------- LukasAtLocalhost · 2023-11-18 03:45 this is what i did. a 10 CHAR domain of only numbers with .win ---------------------------------------------------------------------- Unis_Torvalds · 2023-11-18 04:42 Isn't this what VPNs were invented for? ---------------------------------------------------------------------- ghanta-congress · 2023-11-18 06:27 > With a wildcard they dont have any entries. The only entry would be * which would mean something like *.example.com and it points at whatever IP you want. Then every query for a subdomain will also point to that IP. But there are no records that would reveal which subdomains exist or not. aah... makes sense. But I guess that works better if my self-host machine is a monolith. I have several generation RPis and a few old laptops on which I am trying to distribute various self-host services via docker. While all those machines lie at one physical location (say A). My ideal usage would be to use them not only when I am at that physical location (A), but when I am at my home (B), out on road (via mobile data-public internet), and multiple other fixed locations (other offices/colleague homes) etc. ISP at 'Location A' also doesnt provide static IP service for my to do specific mapping at a singular entry point. I guess I could use a single reverse-proxy at A in one of those available machines which is what the * DNS record points to, and that is turn proxies all available services to it. This way I can still get way with recommended wildcard ssl certificate generation and wildcard dns entry to singular machine. >Again, only if the client is also in that network. Anyone on the outside would automatically query the public DNS for that domain and get different replies. Yep. This was the reason for not going with PiHole setup at location A. I needed accessing my services from outside and my wireguard setup is only to route VPN traffic through it (not all internet traffic, via the - ALLOWEDIPS param). I guess for the time being I'll stick to keeping my local IPs 10.x.x.x in public DNS records until I can shift to a better alternative. Thanks for the insight :) ---------------------------------------------------------------------- ghanta-congress · 2023-11-18 06:31 I guess using '*' at DNS provider is not an option for me. Not only do I have my personal website that I need the original tld to point to, my self-host services are also distributed to various different machine. I have highlighted some aspects in a [separate reply](/r/self hosted/comments/17x9zsm/exposing_selfhosted_services_to_internet_for/k 9qkk3t/) Thanks for the idea tho. ---------------------------------------------------------------------- soulimonster · 2023-11-18 07:04 Free domains such as .tk or .cf are scanned by various bots as soon as they are created. I remember when I created a domain and forwarded it to my server. The spam and attacks that subsequently hit my server were very high. Significantly higher than with a domain that I paid for. I therefore strongly recommend staying away from these free domains. Good luck with your project :) ---------------------------------------------------------------------- beje_ro · 2023-11-18 09:13 Personal data. They also moved a free domain that I have let expire to the paid ones, so if I wanted to renew I would have to pay... Which is kind of fair... They should also make money from somewhere... When buying a domain read all the details: renewal fee are mentioned there. For me they were turnoffs in some cases. I now have a .ovh as a cheap alternative. Iirc they are dirt cheap when you reserve the domain for 3 years... ---------------------------------------------------------------------- djc_tech · 2023-11-18 12:06 I use WireGuard for most stuff. My Nextcloud instance is open though because I lien to upload photos I take pretty quickly to keep a backup ---------------------------------------------------------------------- bgatesIT · 2023-11-18 12:52 VPN would be the quick and dirty If it’s just select items, an service like azure app proxy maybe ---------------------------------------------------------------------- Cold-Membership7654 · 2023-11-22 22:34 Consider exploring Netmaker as well. While it may not have the same age and maturity as the other two options, I appreciate its upward trajectory. It operates on Kernel Wireguard, boosting both speed and security. However, where it excels is in its user interface – it's straightforward to navigate, particularly with the [AZURE gateway](https://www.netmaker.io/resources/remote-access-to-azure). ---------------------------------------------------------------------- SnooPets20 · 2023-11-23 00:12 It is already worse since it allows you only 1 network whereas ZeroTier allows unlimited. It does raise the per-network user cap to 30 instead of ZTs 25, but I'll take that over not being able to make more networks. I guess it can be bypassed by having more accounts, but that's just bothersome. UI is not a big selling point for me, it's not something I'll interact with frequently. Once set up, I just forget about it.