Newb - Wireguard VPN for NAS Access reddit / selfhosted ---------------------------------------------------------------------- DankeBrutus · 2023-11-29 12:52 I want to get out of the way the fact that I do not know networking. I work Desktop Support at my job so I have a pretty okay understanding of hardware. I use Fedora Linux at home and I am not scared of a terminal. When it comes to networking though it is a big shoulder shrug for anything outside my LAN. I would like to know more but it will take some time. I have a project that is coming together to make a little NAS with a Pi4 that I have collecting dust. I have the hardware figured out, I will probably use OpenMediaVault, may just set up the SMB share myself, and if all I wanted is a NAS at home I would be golden. But I want to set up a Wireguard VPN because my ultimate goal is to replace my pCloud subscription. I have watched some tutorials on YouTube from larger channels like Networkchuck and Wolfgang, but I am confused specifically around the whole DNS thing. I get that my public IP changes from time to time. I understand the need for a dynamic DNS to counter that. I purchased a domain from a registrar service up here in Canada and after the purchase the immediate next step was web hosting. Do I need to host the domain in order to use it for the Wireguard setup? ---------------------------------------------------------------------- sk1nT7 · 2023-11-29 13:14 Various ways to proceed: 1. Get DynDNS up and running. This ensures that your domain will always resolve to your WAN IP address of your router at home. Otherwise, if the router changes its IP regularly, you won't know it and cannot connect to your VPN at home. 2. Run a VPN network service (OpenVPN, WireGuars, IPSec) and expose its ports at the router (port forwarding). Regarding step 1 I recommend the following: 1. Your router may already provide a way for DynDNS. Check the router admin panel for such a thing. 2. If your router does not provide DynDNS out of the box: 1. Add your newly purchased domain to Cloudflare. This enables easy domain management. Make a free account on cloudflare. Use the provided nameservers by cloudflare and set them for your purchased domain. Then transfer the domain to cloudflare. May take up to a day. If the transfer worked, your domain is now managed at Cloudflare. You can inspect the DNS area to create and adjust your subdomains etc. 2. Get yourself an API token from cloudflare for your domain zone 3. Use the docker container [https://github.com/favonia/cloudflare- ddns](https://github.com/favonia/cloudflare-ddns) in conjunction with your CF API key to regularly set the WAN IP of your router to a DNS entry (e.g. [vpn.mydomain.com](https://vpn.mydomain.com)). A compose example can be found [here](https://github.com/Haxxnet/Compose- Examples/blob/main/examples/cloudflare-ddns/docker-compose.yml). 4. If set up correctly, your [vpn.mydomain.com](https://vpn.mydomain.com) subdomain will always resolve correctly to your router's external WAN IP at home. Neat! Regarding step 2 I recommend the following: 1. Use the docker container [https://github.com/wg-easy/wg- easy](https://github.com/wg-easy/wg-easy) to spawn a WireGuard VPN with a nice admin web panel. A compose file is [here](https://github.com/Haxxnet/Compose- Examples/tree/main/examples/wg-easy). 2. In the compose file you will find the env variable \`WG\_HOST\`. Provide it with your subdomain name that points to your router's WAN IP via DynDNS. Then spawn up the container and visit http://:51821. Use the password defined in the compose file's environment variable. Create your first VPN user and use the displayed QR code to scan with your mobile. Download the wg config for all other clients. 3. Log into your router admin panel and configure port forwardings. Expose the 51820 port of wg-easy, which likely runs on your Raspberry Pi. Ensure to not expose the web admin panel, which runs on 518201! Then just connect to your new WireGuard VPN. ---------------------------------------------------------------------- InfamousAgency6784 · 2023-11-29 14:26 When you buy a domain name, DNS is just a way to link that name to your IP. When your IP changes, you need to notify the DNS servers that it has changed. In the real world, DNS would be a book where people's names are written alongside their house address. If you change house, you need to tell the editors of those books your new address. Dynamic DNS providers are like normal providers except that they continuously edit new versions of their book and make it easy for just anyone to update their address automatically. --- Given what you say though, I would not proceed like that. Either just get a cheap VPS as a fixed-IP bridge or use something like Tailscale to manage the dynamic side for you. I say this because dynamic DNS services can be a bit problematic at times. If you change IPs like once a week/month, it's absolutely fine though long-term SMB/NFS shares **will** fail very badly when that happens. If you change IP for every GB downloaded, that will be a real pain real quick (IP update is far from instant when going through DNS). You'll learn more about routing with the bride setup but you'll get a much nicer 'turn key' experience with Tailscale, whereever you are. With both solutions, long-term connections won't be a problem: the only downtime you'll get is where either one of your box actually restarts. ---------------------------------------------------------------------- Ordinary_Employer_39 · 2023-12-01 02:04 This might be what you're looking for https://github.com/NOXCIS/Wiregate