Alternative to VPN for remote connection to home network reddit / selfhosted ---------------------------------------------------------------------- tamale_tomato · 2023-12-14 20:27 So I run a big NAS and domoticz for automation on my home network. I would like to be able to smoothly access this from the outside world, primarily from an android phone. I know VPN would be the standard and I've done that in the past, but frankly I found it to be tremendous a pain in the ass connecting and disconnecting, especially for my girlfriend. I'm currently exploring something like port forwarding 22 to a linux machine on my network using pre shared key only ssh, but I'm not real clear on how network access would work from that point. Can that be set up to direct local traffic to my network and all other traffic via the normal network connection on the phone? Any article recommendations? All I can find seem to be directed towards tunneling all internet traffic through your home network, which isn't what I'm trying to do. I just want to be able to hit my domoticz instance and my file server through the tunnel. ---------------------------------------------------------------------- momsi91 · 2023-12-14 20:36 Look into Tailscale. It's the exact opposite of pain in the ass ;) ---------------------------------------------------------------------- chaplin2 · 2023-12-14 20:51 OP is a Tailscale employee with 1 karma ---------------------------------------------------------------------- tamale_tomato · 2023-12-14 20:54 I'm not, and being that this is a self hosted forum, I don't particularly want to route my traffic through a third party. I'm still reading about tailscale because I don't know enough about it to say how it works, but I'm really looking for something using ssh directly. ---------------------------------------------------------------------- Max-_-Power · 2023-12-14 20:56 I'm using a reverse SSH tunnel, like this: $home $server $office $office creates a reverse SSH tunnel to $server. $home jumps via $server to $office. On top of that connection I could use SSH port forwarding and so on. No need for a VPN or even extra software. ---------------------------------------------------------------------- tamale_tomato · 2023-12-14 21:01 Hadn't thought of a server outside of my network, that might make this a lot easier. Are you accessing any of this via phone or maintaining a persistent connection from a phone? If so, what are you using? ---------------------------------------------------------------------- [deleted] · 2023-12-14 21:10 [deleted] ---------------------------------------------------------------------- rickestrada · 2023-12-14 21:17 Tailscale 👍🏻 ---------------------------------------------------------------------- Lucifer4o · 2023-12-14 21:30 SSH with SOCKS5 Proxy. This is how I used to jump out of my corporate network. ---------------------------------------------------------------------- Nintenuendo_ · 2023-12-14 21:33 Why not just setup a domain and do things properly? [here is my site](https://nintenuendo.tv) where I'm doing this for reference ---------------------------------------------------------------------- nosyrbllewe · 2023-12-14 21:43 Security. Can you really ensure that none of your services have any zero-day vulnerabilities? Also, it does reveal a bit much publicly. I would suggest at least putting a login in front of your dashboard and services (e.g. Authentik). Your setup looks nice though. ---------------------------------------------------------------------- mrXmuzzz · 2023-12-14 21:46 Twingate ---------------------------------------------------------------------- Nintenuendo_ · 2023-12-14 21:51 I don't think you looked too hard at what's behind login authentication and what's not. Things like whoogle which are kept locally segmented and designed to be open to the public are not a security risk, especially if you have a little bit of fail2ban experience. Things like plex/overseerr which don't use login credentials, and instead use login tokens are also mean to be forward facing like they are. The whole site is behind cloudflare, and protected from ddos/hammering/blahblah through the cloudflare system before it ever gets forwarded to my A records. The site also does use authentication, you probably only clicked on one link. ---------------------------------------------------------------------- ljh47 · 2023-12-14 21:52 A wireguard VPN can be set to only tunnel your home LAN and let all other traffic go via the remote device. Self hosted and no third parties involved. It can be beneficial to have a domain with ddns so you don't need to track your home WAN IP but that's fairly easy to add. ---------------------------------------------------------------------- the9engines · 2023-12-14 22:07 Its honestly absurd that there is no easy setup docker image to get an vpn or tunnel. Why is that? There is some very outdated openvpn helper image, but its outdated and needs network privileges, why can't this be as easy as just setting up a docker image? Is there something inherently difficult with setting up an image with openvpn and just exposing its port? ---------------------------------------------------------------------- Oujii · 2023-12-14 22:26 If you can forward ports, just roll your own WireGuard VPN. ---------------------------------------------------------------------- mordac_the_preventer · 2023-12-14 22:31 I use WireGuard. I have the client installed on my phone, my MacBook and a Linux box and it just does the right thing. I actually held off using WireGuard for several years because I already had OpenVPN installed (which was a PITA) and the WG setup seemed so easy that I thought I was missing a step. ---------------------------------------------------------------------- Eisai_Kurosawa · 2023-12-14 22:44 Tailscale or Netbird both have Docker Image, and for clients, you don’t need to open any port for it. ---------------------------------------------------------------------- tamale_tomato · 2023-12-14 22:49 I'll look into it, OpenVPN was what I was using before and it was definitely a pain in the ass. ---------------------------------------------------------------------- tamale_tomato · 2023-12-14 22:49 I'll look into it, I was using OpenVPN before, maybe WireGuard is less obnoxious. ---------------------------------------------------------------------- InkognetoInkogneto · 2023-12-14 23:15 Every post about networking here has someone talking about Tailscale. It's a cool thing but as you said depending on the third party is not great. For example they just stopped working in Russia this fall. I know, I know, sanctions, etc, but that's an example of what can happen that's not under your control. I also haven't found a good self hosted alternative for myself and use SSH tunnels, but it's not really convenient sometimes. ---------------------------------------------------------------------- user01401 · 2023-12-14 23:41 I use cloudflare tunnels to access my Domoticz instance with the Domoticz for Android app. Simple setup and nothing else is needed. ---------------------------------------------------------------------- Slow_Wafer3174 · 2023-12-15 00:03 Check out ZeroTier so you don't have to expose any ports. ---------------------------------------------------------------------- Impressive-Cap1140 · 2023-12-15 00:08 Headscale is the self hosted version of ---------------------------------------------------------------------- ChesterDood · 2023-12-15 00:38 Definitely do so, the android client is simple to flick on and off ---------------------------------------------------------------------- activ8xp · 2023-12-15 01:25 TAILSCALE and stop thinking about it ---------------------------------------------------------------------- LukeLC · 2023-12-15 01:49 I feel like I must have missed something with Wireguard, because I see this take a lot. But for me, I spent an entire afternoon trying unsuccessfully to get Wireguard to work, and when I gave up and tried OpenVPN, it was up and running in 5 minutes. Plus, the OpenVPN Connect client app is really nice, while Wireguard clients seem incredibly primitive still. What are the issues people have with OpenVPN, and how did Wireguard solve them? Because my experience has been the polar opposite. ---------------------------------------------------------------------- LukeLC · 2023-12-15 01:55 If you're on Windows, SoftEther is another option worth considering. Easier than Tailscale/Headscale to get running self-hosted. You can run it on Unix too, but you're mostly on your own and it's no longer simple. ---------------------------------------------------------------------- zfa · 2023-12-15 01:58 Absolutely the best way - just set AllowedIPs = home subnet(s) only. If using IOS one can even set the WG client to only connect when not on home wifi network, say. But even if on Android there's no harm just leaving it connected all the time really. ---------------------------------------------------------------------- sparcv9 · 2023-12-15 02:25 A really, really long cable. ---------------------------------------------------------------------- Educational-Hold-321 · 2023-12-15 03:00 Currently running Tailscale and been wanting to switch to self hosted WireGuard on my Synology. Are there benefits to switching? With Tailscale, I have it to Connect on Demand on iOS whenever I leave my network. ---------------------------------------------------------------------- blusls · 2023-12-15 03:00 Try Easywiregaurd. Runs Ina docker container. Has web GUI for client setup with QR code or configuration import. Then, you can setup split- tunneling to always be connected. Or cloudflared. ---------------------------------------------------------------------- jonyskids · 2023-12-15 03:08 Cloudflare tunnels ---------------------------------------------------------------------- Simon-RedditAccount · 2023-12-15 08:46 * if you're just trying to access the network as a whole, split tunneling VPN is your friend. WG probably will be the best option here. * if you're interested in accessing certain services, then: * set up a VPS that will do tunneling for you, acting as reverse proxy * set up strong auth, like mTLS, and expose services on your home IP directly, probably with a 'dynDNS'-style tool that will change your A/AAAA records when your IP changes ---------------------------------------------------------------------- tamale_tomato · 2023-12-15 10:11 I've read a bit about it and it sounds promising. I'll give it a go. Thank you. ---------------------------------------------------------------------- domanpanda · 2023-12-15 10:20 OpenVPN is way slower than WG. ---------------------------------------------------------------------- domanpanda · 2023-12-15 10:36 Don't port forward SSH - it's dangerous. You dont need tunnel ALL traffic through VPN, you can push only the one relevant to your home network. In case of OpenVPN read this https://forums.openvpn.net/viewtopic.php?t=27618 Another option is to use ZeroTier/Tailscale - SaaS VPNs which you dont selfhost but you install clients only on those machines which has to be connected together (in your case domoticz, NAS and android phone). But it requires "split horizon" solution to be "always on" option. ---------------------------------------------------------------------- Fesional · 2023-12-15 11:25 Very nice, so if one wanted, where would they start? (assuming they are dummy) ---------------------------------------------------------------------- bufandatl · 2023-12-15 11:38 That's easily done with the wireguard app too. I use it for years now exactly this way. As soon as I leave home WiFi VPN kicks in and I use my piholes as dns at home to get ad block while on the road. ---------------------------------------------------------------------- Nintenuendo_ · 2023-12-15 11:59 If you're up for it, feel free to pm me with a discord username, and we can go over everything, and maybe spend a night setting things up for you. It helps to have someone go through things with you, documentation isn't as easily understandable heh. ---------------------------------------------------------------------- json12 · 2023-12-15 12:08 Is that the same thing as wg-easy? Any guide to set this up in Synology docker? ---------------------------------------------------------------------- bufandatl · 2023-12-15 12:24 I am not a Synology user and hate WireGuard in docker too. Have tried to help with way to many issues over at r/WireGuard with people using it in docker and docker doing whacky stuff on network. Also I don’t have experience with wg-easy I have WireGuard running since before any tools were made so I do it all bare bones on bare metal. But it’s nothing fancy just setup a peer with any guide you find on the Google. And create a config for your iPhone as second peer and have it connect to the Synology peer. ---------------------------------------------------------------------- LukeLC · 2023-12-15 14:23 Speed I could believe, but I just haven't experienced the other two. Wireguard seems way more convoluted, unless there's some easy setup guide I've missed. Most I ever got was for clients to connect to the server, but without access to the broader internet. And just that took hours of fiddling with config files. Not so with OpenVPN. ---------------------------------------------------------------------- Xenkath · 2023-12-15 15:24 I didn’t realize that was an option in the iOS app, I’ve been trying to figure out how to do it via Shortcuts or some other automation. Thanks for the heads up! I can finally ditch Cloudflare and close the http ports on my router. ---------------------------------------------------------------------- domanpanda · 2023-12-18 09:03 I've setup OpenVPN couple times, only once from script (easy stuff) but rest was manual process. Also I've setup Wireguard once manually and about 3 times with docker. Docker is the easiest way. BUT, indeed wireguard is not as packed as OpenVPN. Its just a protocol. Where OpenVPN comes with a plethora of options. One of the thing in WG which i miss the most is password protection. If your connection config is leaked and you dont know it - you're screwed. With password bad actor would have to break it first. In openvpn is relatively easy to set it. But in wireguard you cannot do it unless you start to use some more advanced solution built arround wireguard (firezone) with SSO and stuff. ---------------------------------------------------------------------- LukeLC · 2023-12-18 14:35 See I even tried WG with Docker, but it never could successfully bridge the internal network with my host network. I set up my routes and firewall just like I've had to do with OVPN as well, but WG was a no-go.