VPN & VPS Mesh for Homelab reddit / selfhosted ---------------------------------------------------------------------- fiR3W4LL87 · 2023-12-14 08:39 Hello everyone! I've been deeply involved in setting up my Homelab with a strong emphasis on security. In this context, I'm particularly interested in VPN and VPS services that don't require opening ports and, ideally, can be self-hosted. I'm curious about the services and providers that the community here prefers and the reasons behind their choices. **Some questions I'd love to discuss:** 1. Do you use security-oriented VPN solutions for your Homelab that don't require opening ports? Which ones are these and what security mechanisms do they offer? 2. Are you utilizing self-hosted VPS solutions? Which tools or platforms do you prefer for running VPS solutions internally? 3. Are there specific security features or criteria that you prioritize when selecting VPNs or VPS services? Emphasizing security in my Homelab setup is crucial for me, so I'm eager to hear your insights and experiences concerning these specific requirements. [View Poll](https://www.reddit.com/poll/18i48ti) ---------------------------------------------------------------------- blackstar2043 · 2023-12-14 09:17 My underlying mesh is managed by Nebula, and Wireguard is used to access the network. Nebula only requires one host to have an opened port, which is commonly known as a Lighthouse. For emergency access that does not require opening ports, I have TOR hidden services bound to various daemons: SSHD and WireGuard. All are open-source, with no closed-source components. They provide minimal features that require minimal resources and limit the potential attack vectors compared to alternatives. ---------------------------------------------------------------------- bmullan · 2023-12-14 10:17 I've deployed all but Twingate before. IMHO wireguard has become more or less a standard. Based on performance if for no other reason. But Wireguard required a mesh capability and a web management tool. Github lists dozens of solutions for Wireguard. I'd recommend adding ***[netbird](https://github.com/netbirdio/netbird)*** to this list: - *Really easy to install/deploy/configure (native or docker)" - Wireguard tunnels - 2FA capable - Great & easy web Mgmt GUI - much more ***https://github.com/netbirdio/netbird*** ---------------------------------------------------------------------- fiR3W4LL87 · 2023-12-14 10:47 Hi Thank you very much for your recommendation. I also read about Netbird, unfortunately I forgot to add Netbird and couldn't add any more points to choose from. However, I have also read about Netbird and will keep this in mind. ---------------------------------------------------------------------- FuriousRageSE · 2023-12-14 11:09 > I have TOR hidden services bound to various daemons: SSHD and WireGuard. Do you have any config to share that we other could get a running start for the backup ssh server? ---------------------------------------------------------------------- blackstar2043 · 2023-12-14 11:43 Just add the following to the torrc configuration: HiddenServiceDir /var/lib/tor/ssh/ HiddenServicePort 22 127.0.0.1:22 HiddenServiceAuthorizeClient stealth clientname Restart the TOR service; /var/lib/tor/ssh/hostname contains the onion address to use for access. ---------------------------------------------------------------------- PhilipLGriffiths88 · 2023-12-14 14:20 Twingate does not allow self-hosting as its SaaS. Check out OpenZiti, similar design intention as a zero trust network overlay, also free and open source (thus self-hostable). Also, I would argue (I work on the project) that its more powerful... for example, unlike TG, it will happily do 'east-west' zero trust networking in your LAN. Also, though not relevant to your use case, it incls. SDKs to embed ZTN into apps and make them secure-by-default. ---------------------------------------------------------------------- hereisjames · 2023-12-14 15:33 And Netmaker : [https://github.com/gravitl/netmaker](https://github.co m/gravitl/netmaker) It's pretty similar to Netbird. They also both use kernel Wireguard. ---------------------------------------------------------------------- bmullan · 2023-12-14 21:29 I've often wondered why Tailscale opted to utilize User-Space wireguard instead of kern based? ---------------------------------------------------------------------- hereisjames · 2023-12-14 23:55 There are some clues scattered around in the early Tailscale blogs. Basically I think they felt they could move more quickly and without a kernel version dependency by operating in userspace. They feel they can get as fast or faster than the kernel version, if you read the recent blog posts. ---------------------------------------------------------------------- EnterpriseGuy52840 · 2023-12-15 03:28 Voted Wireguard, but my 4th gen Core VM hosts that run pfSense run circles with IPsec + AES-NI compared to Wireguard so I'm using that for site to site.