WireGuard admin interface UI that is actively maintained but also isn't cloud-based? (e.g., no Tailscale or Headscale or ZeroTier) reddit / selfhosted ---------------------------------------------------------------------- lmm7425 · 2023-12-21 16:46 I'm looking for a self-hosted WireGuard VPN admin interface UI that is actively maintained but also is not cloud-based (e.g., no Tailscale or Headscale or ZeroTier). I'm talking about opening port 51820 in my firewall without some cloud-server brokering the connection. Project | Comments ---|--- https://github.com/subspacecloud/subspace | No longer maintained https://github.com/subspacecommunity/subspace | No longer maintained https://github.com/perara/wg-manager | No longer maintained https://github.com/joseantmazonsb/linguard | No longer maintained https://github.com/EmbarkStudios/wg-ui | No longer maintained https://github.com/firezone/firezone | New version 1.x doesn't allow self-hosting https://www.zerotier.com/ | Requires a cloud-based server https://www.twingate.com/ | Requires a cloud-based server https://www.bowtie.works/ | Requires a cloud-based server https://github.com/slackhq/nebula | Requires a cloud-based server https://github.com/tonarino/innernet | Requires a cloud-based server https://github.com/netbirdio/netbird | Requires a cloud-based server https://github.com/gravitl/netmaker | Requires a cloud-based server https://openziti.io/ | Requires a cloud-based server Based on what I've read, these are my best options: * https://github.com/WeeJeWel/wg-easy * https://github.com/h44z/wg-portal * https://github.com/donaldzou/WGDashboard * https://pritunl.com/ * https://pivpn.io/ (CLI-only, but I can deal) ---------------------------------------------------------------------- SameSecret8285 · 2023-12-21 16:49 Defguard is fully selfhosted ---------------------------------------------------------------------- probablyjustpaul · 2023-12-21 17:29 Where did you get the info on the upcoming Firezone 1.x release not being self hostable? I haven't seen anything to that effect in the roadmap ---------------------------------------------------------------------- nevotheless · 2023-12-21 17:30 Netbird also doesn't require a Cloud-Based Server you can fully self- host it last time i checked :D ---------------------------------------------------------------------- lmm7425 · 2023-12-21 17:33 https://github.com/firezone/firezone#can-i-self-host-firezone ---------------------------------------------------------------------- cenka · 2023-12-21 17:35 I use wg-easy and didn’t have any issues so far. ---------------------------------------------------------------------- lmm7425 · 2023-12-21 17:36 You can self-host it, but it needs to be cloud-accessible, right? It's basically like Tailscale (a cloud-based central broker). https://docs.netbird.io/about-netbird/how-netbird-works#management- service ---------------------------------------------------------------------- ztjuh · 2023-12-21 17:43 I'm not sure if it's still maintained but I think so, it is a docker called `ngoduykhanh/wireguard-ui`. ---------------------------------------------------------------------- musicman1601 · 2023-12-21 17:51 Was going to point to this one as well https://github.com/ngoduykhanh/wireguard-ui ---------------------------------------------------------------------- PhilipLGriffiths88 · 2023-12-21 17:57 OpenZiti does not require a cloud-based server, it can be deployed fully behind your own FW, in fact, a large defence contractor uses it in an air-gapped network. It does not use Wireguard though. ---------------------------------------------------------------------- Theweasels · 2023-12-21 18:00 I use wg-easy and it's great. It sounds like exactly what you want: open the port and connect your device, no third party servers involved. ---------------------------------------------------------------------- angelflames1337 · 2023-12-21 18:03 Headscale is not cloud based and can be self hosted. ---------------------------------------------------------------------- probablyjustpaul · 2023-12-21 18:07 This is absolutely infuriating. Thank you for the info. ---------------------------------------------------------------------- dovholuknf · 2023-12-21 18:09 You can also choose to forward ports through your firewall. You don't **have** to have a cloud-based server, it's just arguably better to have no inbound ports open through your home router and no ports fowarded etc. (imo) You can choose to self-host and forward ports. Any of the 'self- hostable' options would work that way. The biggest issue with this approach for some will be a non-static IP address. ---------------------------------------------------------------------- DJOCKERr · 2023-12-21 18:34 Remindme! 1 day ---------------------------------------------------------------------- RemindMeBot · 2023-12-21 18:35 I will be messaging you in 1 day on [**2023-12-22 18:34:20 UTC**](http ://www.wolframalpha.com/input/?i=2023-12- 22%2018:34:20%20UTC%20To%20Local%20Time) to remind you of [**this link **](https://www.reddit.com/r/selfhosted/comments/18nrbnf/wireguard_adm in_interface_ui_that_is_actively/kecuir0/?context=3) [**CLICK THIS LINK**](https://www.reddit.com/message/compose/?to=Remin dMeBot&subject=Reminder&message=%5Bhttps%3A%2F%2Fwww.reddit.com%2Fr%2F selfhosted%2Fcomments%2F18nrbnf%2Fwireguard_admin_interface_ui_that_is _actively%2Fkecuir0%2F%5D%0A%0ARemindMe%21%202023-12- 22%2018%3A34%3A20%20UTC) to send a PM to also be reminded and to reduce spam. ^(Parent commenter can ) [^(delete this message to hide from others.)] (https://www.reddit.com/message/compose/?to=RemindMeBot&subject=Delete %20Comment&message=Delete%21%2018nrbnf) ***** |[^(Info)](https://www.reddit.com/r/RemindMeBot/comments/e1bko7/remind mebot_info_v21/)|[^(Custom)](https://www.reddit.com/message/compose/?t o=RemindMeBot&subject=Reminder&message=%5BLink%20or%20message%20inside %20square%20brackets%5D%0A%0ARemindMe%21%20Time%20period%20here)|[^(Yo ur Reminders)](https://www.reddit.com/message/compose/?to=RemindMeBot& subject=List%20Of%20Reminders&message=MyReminders%21)|[^(Feedback)](ht tps://www.reddit.com/message/compose/?to=Watchful1&subject=RemindMeBot %20Feedback)| |-|-|-|-| ---------------------------------------------------------------------- lmm7425 · 2023-12-21 18:38 Headscale is like Tailscale. You put a broker in the cloud that connects the two endpoints. I want a traditional "VPN server" inside my network. ---------------------------------------------------------------------- shiftyduck86 · 2023-12-21 18:40 Just dropping a third reccomendation for wg-easy. It's worked flawlessly for me for the last 3 months. ---------------------------------------------------------------------- TheCaptain53 · 2023-12-21 18:49 You host the Headscale coordination server. It could be configured on a VPS in a public cloud like AWS, Linden etc, but this is basically no different to a server hosted somewhere, handling the Wireguard tunnels. ---------------------------------------------------------------------- LastTreestar · 2023-12-21 18:53 Then host headscale internally. It seems like you're not actually very familiar with headscale/tailscale. ---------------------------------------------------------------------- bloodguard · 2023-12-21 18:58 Right now for home use I'm just using the wireguard plugin for my OPNsense firewall. The web management is OK but not great. Really wish they'd add in QR code config generation because pasting keys is kind of fiddly. One of our work sites uses Pritunl (paid version with Google SSO) and seems happy with it. ---------------------------------------------------------------------- lmm7425 · 2023-12-21 19:07 I was under the impression that the headscale/tailscale coordination server needed to be publicly accessible. ---------------------------------------------------------------------- CabbageCZ · 2023-12-21 19:14 What would you say is the practical difference between opening a port for 'selfhosted wireguard admin interface' or opening a port for headscale? ---------------------------------------------------------------------- LastTreestar · 2023-12-21 19:20 \- *Grabs popcorn* - ---------------------------------------------------------------------- byttle · 2023-12-21 19:21 https://gitlab.com/cyber5k/mistborn bit more than just a wireguard server, but nifty nonetheless. ---------------------------------------------------------------------- mrpink57 · 2023-12-21 19:26 It does not, as someone who uses headscale with headscale-ui the only port that really needs to be open is `41641` which is the same as wireguard needing `51821` The control panel is going to be over 443 like anything else. ---------------------------------------------------------------------- blind_guardian23 · 2023-12-21 19:38 Btw: opnsense and pfsense have gui. ---------------------------------------------------------------------- petecool · 2023-12-21 19:59 I use it too, I saw a few updates this year. ---------------------------------------------------------------------- edgan · 2023-12-21 20:10 It looks very nice, but they are now just beginning to think about adding 2FA support to Wireguard access. I will keep my eye on it. ---------------------------------------------------------------------- UntouchedWagons · 2023-12-21 20:29 True but they're very manual. When I was setting up wireguard on my pfsense box (now opnsense) I had to use the wireguard client on my desktop to generate the key pairs for all my clients which I then copied to the web UI. ---------------------------------------------------------------------- blusls · 2023-12-21 20:33 I use ez-wireguard. Was easy to setup in a container. Put it behind a reverse proxy and that was it. ---------------------------------------------------------------------- blind_guardian23 · 2023-12-21 20:33 true, something like the openvpn-exporter from pfsense would be nice (just download client-bundle). ---------------------------------------------------------------------- RadMcCoolPants · 2023-12-21 21:30 If this doesn't get answered by him will you answer it. Things like this are how I learn. ---------------------------------------------------------------------- prime_1996 · 2023-12-21 21:52 what about [https://pritunl.com/](https://pritunl.com/) ? ---------------------------------------------------------------------- death_hawk · 2023-12-21 21:54 I just put up a https://github.com/donaldzou/WGDashboard recently and it works pretty well. ---------------------------------------------------------------------- autogyrophilia · 2023-12-21 21:56 Just get yourself a OpnSense or pfSense VM, and you can plug as many services as you want. Like for example putting things through a GIF or L2TP tunnel for L2 forwarding between hosts. Or protecting against lateral attacks with.suricata ---------------------------------------------------------------------- zfa · 2023-12-21 22:03 Is being WireGuard an absolute requirement? You've links to products that don't use WireGuard/Noise there? Also need to clarify why you dont want 'cloud-based'? Are you meaning you just want the one communication port open and nothing more, that is no co-ordination port / public management GUI? Again, there' stuff in your list that has that - Nebula, for example, only needs one port open one any one device (4242 is just analagous to WG 51820, say) and runs a dual-pupose being both the comm channel for traffic to and from that node plus acts as co-ordination if a node is deemed a lighthouse. So it has 'cloud-based control' but isn't something to be worried about. ---------------------------------------------------------------------- Fluffer_Wuffer · 2023-12-21 22:06 Do you mean easy-wg? ---------------------------------------------------------------------- blusls · 2023-12-21 22:07 Yeah. ---------------------------------------------------------------------- Fluffer_Wuffer · 2023-12-21 22:24 Thanks - I was testing lots of them a couple of weeks ago, this left me wondering if I had missed one. ---------------------------------------------------------------------- digitalindependent · 2023-12-21 22:35 Netbird. Just watched a video about it on the awesome open source YT channel and I am intrigued. I run wg easy and Pivpn ---------------------------------------------------------------------- Klippenhof · 2023-12-21 22:46 Firezone 1.x will allow self hosting, but it will get tricky. https://github.com/firezone/firezone/issues/2519#issuecomment- 1786588536 I really like Firezone 0.x and hope 1 will be just as nice ---------------------------------------------------------------------- la_tete_finance · 2023-12-21 22:46 Defguard looks..... amazing. I was just looking to transition from tailscale to either pure wireguard or headscale but now I'm rethinking it. Any gotchas? It looks like I could even use this instead of Authentik. ---------------------------------------------------------------------- BanananaHammmock · 2023-12-21 23:12 It's a rhetorical question. Headscale is basically a selfhosted wireguard admin interface. ---------------------------------------------------------------------- Reverent · 2023-12-21 23:19 No, it's a self hosted tailscale control plane. The tailscale client does the negotiation of the tunnel between peers. The coordination server provides configuration details and ACL rules, and helps jump some firewall shenanigans. It's not actually generating the tunnel. Short answer is tailscale is peer to peer, wireguard (at least wireguard the way most people here set it up) is not. ---------------------------------------------------------------------- Arioch5 · 2023-12-21 23:20 How about https://github.com/wg-easy/wg-easy ---------------------------------------------------------------------- murdaBot · 2023-12-22 00:18 > but they are now just beginning to think about adding 2FA support to Wireguard access. Can you elaborate? Are you saying there is talk about adding 2FA capability directly to core Wireguard? ---------------------------------------------------------------------- oriongr · 2023-12-22 00:21 Remindme! 9 days ---------------------------------------------------------------------- murdaBot · 2023-12-22 00:24 > but it needs to be cloud-accessible, right You keep saying this, but I don't think you understand the true risk. You're focused on "more open ports = bad" when really, having a separate purpose built management layer is much, much more secure. Those "traditional VPNs" you keep referring to as somehow superior have bastardized their control plane into the VPN protocol itself, which is why OpenVPN and IPsec are millions of lines of code and Wireguard is a few thousand. Separation of process and duties is a good thing in the security world, you let your VPN protocol only pass network traffic and your management layer only handle management duties. ---------------------------------------------------------------------- murdaBot · 2023-12-22 00:27 Why have I never seen this? It's everything I've been looking for in a Wireguard VPN solution ... and they even have a Kubernetes helm chart! ---------------------------------------------------------------------- webtroter · 2023-12-22 00:29 I've been using WGDashboard for some time. It's nice and easy. But I've since moved my wireguard endpoint on my firewall. ---------------------------------------------------------------------- Accomplished-Lack721 · 2023-12-22 00:32 Your router may be capable of running a Wireguard server in combination with a DDNS service, in which case you don't need to forward any ports to another device on your network. And once you connect to the VPN, you can reach your router's admin page as if you were on the local network . ---------------------------------------------------------------------- VviFMCgY · 2023-12-22 01:32 Same here, works great ---------------------------------------------------------------------- iavael · 2023-12-22 01:57 What do you mean what say “cloud-accessible”? Moreover what’s “cloud” for you? ---------------------------------------------------------------------- PkHolm · 2023-12-22 04:05 2FA in wireguard does not make any sense. It is low level protocol. If you need 2FA for WG just put node private key behind 2FA. ---------------------------------------------------------------------- jimheim · 2023-12-22 07:27 I use wg-easy too, but I don't recommend exposing the web UI to the public Internet. It doesn't have a strong security model, You could layer your own security on top if you want to. I just run the UI behind the VPN, and download new client configurations via an existing client. ---------------------------------------------------------------------- v47-io · 2023-12-22 08:16 I like wg-portal because it supports LDAP and OAuth, so I could integrate it into my existing infrastructure without having to worry about any extra login credentials. ---------------------------------------------------------------------- AkiVonAkira · 2023-12-22 08:55 Another recommendation for wg-easy. It's damn easy 😎 ---------------------------------------------------------------------- ozzeruk82 · 2023-12-22 12:11 Pivpn has worked flawlessly for me at multiple sites over the space of 5 years. Simple but reliable setup procedure. ---------------------------------------------------------------------- bigahuna · 2023-12-22 13:02 Same here ---------------------------------------------------------------------- querylab · 2023-12-22 13:44 Basically having a VPS always running 24/7 a cloud so to speak, but I don't see the point of not doing it in the cloud... that would be safer as you are not exposing your local network to the WAN. in fact I use Netbird and it works great for me as it has 2FA authentication and is selfhosted. ---------------------------------------------------------------------- malvim · 2023-12-22 14:07 Holy shit, guys, this dude has legit questions and maybe doesn’t perfectly understand every software out there. He’s got question marks and everything. He did some research beforehand, even, something we always complain about. Why are people downvoting fucking QUESTIONS to oblivion? Holy shit. ---------------------------------------------------------------------- boli99 · 2023-12-22 14:15 its basicaly a tunnelling/routing function - so just use a router that has wireguard among its VPN options ---------------------------------------------------------------------- mcr1974 · 2023-12-22 14:48 disappointed by the level of smugness on this sub. he just said "I was under the impression"... geez ---------------------------------------------------------------------- mcr1974 · 2023-12-22 14:49 yes, bad. ---------------------------------------------------------------------- mcr1974 · 2023-12-22 14:52 use an agent to update the dns e. g. with namecheap? ---------------------------------------------------------------------- mcr1974 · 2023-12-22 14:53 is there a docker image? ---------------------------------------------------------------------- mcr1974 · 2023-12-22 14:54 I wish you would draw a diagram. or point me to one. ---------------------------------------------------------------------- mcr1974 · 2023-12-22 14:56 behind a reverse proxy, you mean you only expose the nginx port on your home public ip (through router port forwarding?) ? sorry I'm noob. ---------------------------------------------------------------------- blusls · 2023-12-22 14:59 You are correct, but I only make the web UI for easy-wg available from my internal network using Nginx Reverse proxy. I could make it available to the internet as well, but I have no need for that. ---------------------------------------------------------------------- dovholuknf · 2023-12-22 15:02 Yeah, something like that is the way to go if you're going to forward ports in the home firewall. Still, imo it's safer and easier to just use a vps with something like OpenZiti (I'm a dev on that project) or any of the other self hostable solutions listed above. ---------------------------------------------------------------------- AkiVonAkira · 2023-12-22 15:06 https://github.com/WeeJeWel/wg-easy Yeah, everything you'd need is here ---------------------------------------------------------------------- mcr1974 · 2023-12-22 15:08 I'm new to the vpn scene, but not new to dev/IT. I currently access my machines at home tunnelling on an ssh server (port forward from router). if I go the vps route, will all traffic be flowing through the vps, or is the vps used only for the initial setup? ---------------------------------------------------------------------- dovholuknf · 2023-12-22 16:26 it'll depend on the tech used. some tech will use that vps for STUN, some will use it more TURN-like. It depends on the tech. (nice lil thing to read: https://developer.liveswitch.io/liveswitch- server/guides/what-are-stun-turn-and-ice.html) OpenZiti for example, will send all the traffic through that VPS, "TURN-style" but works by establishing outbound connections exclusively, so no UDP holepunch technique is needed to be allowed through the home firewall, you can keep it fully closed. So it just depends on the tech you use. ---------------------------------------------------------------------- RadMcCoolPants · 2023-12-22 16:46 Appreciate you. Thanks! ---------------------------------------------------------------------- spudd01 · 2023-12-22 17:06 I've been using firezone, good for multiple users but now looking to commercialise it so future for us homelabers not that clear ---------------------------------------------------------------------- mrgooglegeek · 2023-12-22 17:07 For an access VPN deployment for my department, I've tested several variations of wireguard based VPN provisioning servers. My basic requirements were simple setup for end users, split tunnel, and LDAP user support (can be via proxy like oidc) with groups and/or ACLs Tailscale - easy but not really self-hosted. Good off-the-shelf solution if you can pay for it Headscale - self hosted but not really easy. The configuration required for clients is problematic and there is no official web UI Pritunl - functional but very clunky. Had various issues with the client application failing to switch between openvpn and wireguard as well as authentication issues. Nebula - fantastic system but the user management isn't really there and it's not "point and click" enough for some end users NetBird - great UI and highly configurable, but poor error logging and some things intentionally difficult to set up to push people towards their cloud version Firezone - 0.X was nice but not ready, and 1.X apparently won't support self-hosting Zerotier - good but had a few issues with its nat-punching. Not a bad option but also not wireguard NetMaker - reasonably good product with easy user-facing support but lacking some client platforms and vital user/ACL features are paywalled I never ended up putting any of them into production, NetBird came the closest but with some small test groups I had lots of complaints of very slow connections which seemed to be from a storming issue between endpoints on different subnets. Not particularly easy to diagnose and didn't happen with a very similarly configured traditional VPN Based on this thread, I will be checking out DefGuard as it looks quite polished and feature-rich, although it does seem fairly new and very much "in development" ---------------------------------------------------------------------- spudd01 · 2023-12-22 17:08 Great to see another tool ditching their early days supporters that grew the community. Good to see some new tools with more features popping up in this thread! ---------------------------------------------------------------------- hhkk47 · 2023-12-22 17:43 OpenMediaVault has a built-in UI for Wireguard. Never tried using it though, since I'm happy with my wg-easy container setup. ---------------------------------------------------------------------- mcr1974 · 2023-12-22 18:44 i see. I guess I'm wondering whether there is an impact on performance. Surely it depends on the network connection between the vps and home, so the vps has to be selected somewhat wisely? ---------------------------------------------------------------------- redparchel · 2023-12-22 18:49 Bad bad bad ---------------------------------------------------------------------- LastTreestar · 2023-12-22 18:58 disappointed in the level of low effort in this sub. ---------------------------------------------------------------------- dovholuknf · 2023-12-22 19:16 Generally speaking, I'd be shocked if you notice any performance differences whatsoever. Yes, you'll be traversing the vps but I personally don't notice it as a human. It kinda all just depends to be totally honest. Sometimes it's actually faster to route through the vps but it's usually unnoticeable. TURN, or what OpenZiti uses, tcp relay has advantages to me I like that I don't have to muck with firewall rules on my home network and let some cloud vendor deal with that stuff. Alternatively there's great tools that are free like our zrok.io, Ngrok, cloudflare tunnels, tailscale funnels etc etc that you might find super interesting too, if you're unfamiliar.. glhf! 🤣 ---------------------------------------------------------------------- mcr1974 · 2023-12-22 19:19 yes gonna have some fun. another requirement I have is that I want to run only dockerized software. ---------------------------------------------------------------------- dovholuknf · 2023-12-22 19:30 That's no problem with OpenZiti/zrok (I don't know the other tech well enough to comment). You'll have to understand docker networking and the implications that entails. It definitely adds complexity but it's not terrible assuming you understand how that isolation works. ---------------------------------------------------------------------- mcr1974 · 2023-12-22 20:02 yes docker networking should be fine. of course I wouldn't want to find myself having to do too much manual ad-hocl hacking on the routing tables. ideally there's a best practice path already laid down. ---------------------------------------------------------------------- dovholuknf · 2023-12-22 20:07 Honestly, you might start with zrok (or one of those). Check out https://docs.zrok.io/docs/guides/docker- share/docker_private_share_guide/... You won't need to install or run your own VPS but you do need to "trust" zrok or whatever you end up choosing/using. that'll be true for any SaaS type offering. If you want to run your own network true r/selfhosted style, i think this guide still holds up https://blog.openziti.io/setting-up-oracle-cloud- to-host-openziti and then you'll want to provide access with a 'host- only' tunneler https://openziti.io/docs/reference/tunnelers/linux/container/ Or you know, choose any of the other ones :) OpenZiti is free and open source and i help develop the project so i'm clearly a wee bit biased here... :) ---------------------------------------------------------------------- phin586 · 2023-12-22 20:17 No dumb questions. Happy learning! ---------------------------------------------------------------------- edgan · 2023-12-22 21:02 https://github.com/DefGuard/defguard/issues/466 ---------------------------------------------------------------------- songokussm · 2023-12-22 21:16 Also interested in doing this and somehow using cloud fairs can. ---------------------------------------------------------------------- la_tete_finance · 2023-12-23 05:22 Looks like it’s coming in the next release? https://github.com/DefGuard/defguard/issues/466#issuecomment- 1845972994 ---------------------------------------------------------------------- BillGoats · 2023-12-26 10:41 Cool, thanks for sharing. Currently running Firezone, but considering making the switch now. With Firezone I can use the [WireGuard](https://play.google.com/store/ apps/details?id=com.wireguard.android) app to toggle my VPN connection from a quick settings tile. I assume the same will be possible with DefGuard? ---------------------------------------------------------------------- spudd01 · 2023-12-28 02:09 Literally looks like the perfect if not better replacement for firezone. Just curious, what's to stop it going the same commercialised route as firezone?