Wireguard tunnel to home network using Hetzner VPS reddit / selfhosted ---------------------------------------------------------------------- Technerden · 2023-12-09 21:09 Configured Hetzner VPS with Wireguard tunnel back home to my Nginx Proxy Manager. Using NPM to expose my self hosted apps in Docker etc. Any suggestions to securing this? Thinking about Geoblocking, any suggestions? And yes I know Cloudflare Tunnel, but I want to self host it. ---------------------------------------------------------------------- bmaeser · 2023-12-09 21:26 you might want to look into tailscale + headscale ---------------------------------------------------------------------- MonetHadAss · 2023-12-09 21:31 If your host at home is behind a firewall, and you have not opened any ports on it, it already secured, no? You're accessing the self-hosted apps through the tunnel, right? ---------------------------------------------------------------------- Technerden · 2023-12-09 21:33 Yep. But I still want to protect my application. ---------------------------------------------------------------------- Anejey · 2023-12-09 21:36 Fail2ban, strong passwords, 2FA, geoblocking, ... You could also set up the firewall so that the Wireguard tunnel is only ever able to go to NPM. Something like Authentik isn't a bad idea either. Allows you to set up 2FA for apps that don't support it by default. I actually have the same setup, except I use an Oracle VPS. ---------------------------------------------------------------------- MonetHadAss · 2023-12-09 21:40 From who? Only people who have access to the Wireguard tunnel has access to the applications. Or if you mean there are other people other than you who can connect to the tunnel, then you could use HTTP basic authentication on NPM, or Authelia, or even Authentik. Not sure how easy it is to set them up with NPM, but with [linuxserver.io](https://linuxserver.io)'s \`swag\` image, HTTP basic and Authelia are easy to set up while Authentik is a little more complicated but still doable. ---------------------------------------------------------------------- Technerden · 2023-12-09 21:41 How can you Geoblock using this setup? Any suggestions? I got Authentik, but with Nextcloud for example it will be problematic. ---------------------------------------------------------------------- Technerden · 2023-12-09 21:47 I have port 80 and 443 open on my cloud server, but no ports open at home since I use the tunnel. I need to protect my end services, like Nextcloud. Not nessesary protect, but reduce attack surface with for example Geoblocking. I have already implemented all security functions built in Nextcloud. ---------------------------------------------------------------------- Anejey · 2023-12-09 22:00 Authentik has documentation for setting up Nextcloud, so it shouldn't be too hard As for geoblocking, I don't know. A couple minutes of googling didn't really get me anywhere, but there probably is some tool out there that should make it possible. ---------------------------------------------------------------------- Technerden · 2023-12-09 22:08 Yeah, tried Googling too. Thats why I asked here maybe someone had suggestions. Only thing I found is iptable rules with geo location data, but its too much manual work updating ip list etc. ---------------------------------------------------------------------- querylab · 2023-12-09 22:13 Well I use a Specific Container in my Proxmox and I share some ports of that specific container example jellyfin,grafana etc I use a vps since I am behind cgnat and my isp does not provide me a static ip I use this I hope this is of your help https://github.com/mochman/Bypass\_CGNAT/wiki/AWS-Lightsail-(Manual- Installation) ---------------------------------------------------------------------- digitalindependent · 2023-12-09 22:24 Rathole? ---------------------------------------------------------------------- d_maes · 2023-12-09 22:27 Why though? I get that it's very nice for multiple tunnels and/or road warriors, but for a single tunnel? ---------------------------------------------------------------------- d_maes · 2023-12-09 22:32 Not really geoblock, but take a look at crowdsec. Basically fail2ban but with a public crowdsourced blocklist. ---------------------------------------------------------------------- MonetHadAss · 2023-12-09 22:45 Ah okay, got it. I thought you already have your end devices connected to the Wireguard tunnel as well. That's what I have. A VPS running Wireguard, and my home server as well as my end devices are permanently connected to the VPS via Wireguard. I access the services via the internal (Wireguard tunnel) IP of the home server without opening any ports on any devices other than the Wireguard port on the VPS. That would be the most secure I think. ---------------------------------------------------------------------- Nintenuendo_ · 2023-12-09 23:17 So, the Linuxserver.io image of Wireguard handles this perfectly, streight out of the (yaml) box. I've had amazing experiences with this image, and it just makes things easy! Step 1 : Port forward the Wireguard port you intend to use before launching docker container Step 2 : [In the yaml](https://i.imgur.com/n9jdHg9.png), change the PUID/PGID to whichever user you want wireguard to run as (type "id" in cli to get current user), then change "PEERS" to how ever many users you want it to automatically create for you Step 3 : Fire up container Step 4 : Scp over to your server (or if it's local just open the folder) and head over to where you Volume mounted /home/blah/wireguard/config:config or wherever you put it, and go to the wireguard/config folder, in there if you set 2 PEERS to be created, you now have 2 peer folders. Step 5 : The container has now automatically made you QR codes to scan on your cell phone/tablet apps in the form of *.png's, and has created the correct *.conf files you would need to feed into a windows/linux system using the "import" function You can now connect, and browse local lan ip's as if you were on the same local LAN, eg 192.*.*.* ip's will work on remote machines. I use this as a backdoor to my systems, if i ever don't want to go through nginx to access my services ---------------------------------------------------------------------- zfa · 2023-12-10 00:03 FireHOL has simple tooling for this - e.g. [apply-ipset.sh](https://ra w.githubusercontent.com/firehol/firehol/master/contrib/ipset- apply.sh). Downloading a country netset and putting it in an ipset couldn't be simpler: curl -sO https://raw.githubusercontent.com/firehol/blocklist- ipsets/master/geolite2_country/country_us.netset ./ipset-apply.sh country_us.netset Just use that ipset in your iptables rule and you're done: iptables -S | grep -q -- "INPUT -i eth0 -p tcp -m set --match-set country_au src -m tcp --dport 443 -j ACCEPT" ---------------------------------------------------------------------- Simplixt · 2023-12-10 13:01 Use forward proxy, e.g. via Authelia and Authentik, so that attackers cannot reach your not-hardened self-hosted apps directly, but you must use 2FA first. That's the only real security against vulnerabilities in your self- hosted apps behind a reverse proxy. Besides of this you can use Crowdsec etc. ---------------------------------------------------------------------- dually · 2023-12-10 15:07 >How do you secure a wireguard tunnel? Wireguard is secure. ---------------------------------------------------------------------- janstadt · 2023-12-10 16:29 Any chance u have a good writeup for this? I tried and failed to do exactly this. Couldnt ping anything from the vps host running wireguard (in a docker container) but could ping my home network from within the container itself. ---------------------------------------------------------------------- Technerden · 2023-12-10 20:34 Im exposing something in the end to port 80/443 open to internet. Leaving the application as attack surface. The tunnel itself is fine. ---------------------------------------------------------------------- Technerden · 2023-12-10 20:35 Sound like misconfiguration in the allow list maybe, try to allow 0.0.0.0/0? ---------------------------------------------------------------------- dually · 2023-12-10 22:53 Oh well if these are self-hosted apps, there's no need to expose them to the public internet. For applications that are exposed to the internet for public consumption, configure the relevant virtual host on the reverse-proxy server with letsencrypt, and secure each upstream service with good passwords and 2fa. Just redirect 80 -> 443. ---------------------------------------------------------------------- arcadianarcadian · 2023-12-11 10:16 add Authelia with 2FA onto your setup. ---------------------------------------------------------------------- janstadt · 2023-12-11 19:54 Thanks for the reply. I'll give that a go. I thought i had it set to the VPS IP but maybe i missed something. I was using wireguard-ui for all the settings and presumed it would set everything up for me. ---------------------------------------------------------------------- janstadt · 2023-12-11 20:46 Ok so according to my wireguard server, i have connected successfully. This is my vps wg server conf: ` [Interface] Address = 10.13.13.1 ListenPort = 51820 PrivateKey = [redacted] PostUp = iptables -A FORWARD -i %i -j ACCEPT; iptables -A FORWARD -o %i -j ACCEPT; iptables -t nat -A POSTROUTING -o eth+ -j MASQUERADE PostDown = iptables -D FORWARD -i %i -j ACCEPT; iptables -D FORWARD -o %i -j ACCEPT; iptables -t nat -D POSTROUTING -o eth+ -j MASQUERADE [Peer] # peer1 PublicKey = [redacted] PresharedKey = [redacted] AllowedIPs = 10.13.13.2/32 ` This is my home client wg conf: ``` [Interface] Address = [redacted] PrivateKey = [redacted] DNS = 1.1.1.1 MTU = 1450 [Peer] PublicKey = [redacted] PresharedKey = [redacted] AllowedIPs = 0.0.0.0/0 Endpoint = [redacted] PersistentKeepalive = 15 ``` From within my wg server container i can ping the wg client IP. I cannot however access any of my other docker containers from the server (cant wget a container at a port for example). Do i have to set the allowlist on my server to 0.0.0.0/0 as well? I was hoping this would be as simple as "configure wireguard to create the tunnel and then let nginx route fqdns directly through the tunnel to other docker containers." im clearly missing something and i bet its something trivial. I might try and just setup wireguard on both hosts outside of docker and see what i can get, but i like the ephemeral nature of docker in case things get messed up. I also tried setting my network_mode to host for wireguard without any luck as well.