Hello,

Some time ago, I started self-hosting applications, but only on my local network. So far, it’s working fine, but I can’t access them as soon as I go outside (which is completely normal).

For the past few days I’ve been looking for a relatively secure way of accessing my applications from outside.

I don’t need anyone but myself to have access to my applications, so from what I’ve understood, it’s not necessarily useful to set up a reverse-proxy in that case and it would be simpler to set up a VPN.

From what I’ve seen, Wireguard seems to be a good option. At first glance, I’d have to install it on the machine containing my applications, port-forward the Wireguard listening port and configure my other devices to access this machine through Wireguard

However, I don’t have enough hindsight to know whether this is a sufficient layer of security to at least prevent bots from accessing my data or compromising my machine.

I’ve also seen Wireguard-based solutions like Tailscale or Netbird that seem to make configuration easier, but I have a hard time knowing if it would really be useful in my case (and I don’t really get what else they are doing despite simplifying the setup).

Do you have any opinions on this? Are there any obvious security holes in what I’ve said? Is setting up a VPN really the solution in my case?

Thanks in advance for your answers!

  • spaghettiwestern@sh.itjust.worksEnglish
    6·
    2 days ago

    I self-host various applications and have been really happy with Wireguard. After watching just how hard my firewall gets hammered when I have any detectable open ports I finally shut down everything else. The WG protocol is designed to be as silent as possible and doesn’t respond to remote traffic unless it receives the correct key, and the open WG port is difficult to detect when the firewall is configured correctly.

    Everything - SSH, HTTP, VNC and any other protocol it must first go through my WG tunnel and running it on an OpenWRT router instead of a server means if the router is working, WG is working. Using Tasker on Android automatically brings the tunnel up whenever I leave my house and makes everything in my home instantly accessible no matter what I’m doing.

    Another thing to consider is there’s no corporation involved with WG use. So many companies have suddenly decided to start charging for “free for personal use” products and services, IMO it has made anything requiring an account worth avoiding.

    • Tinkerer@lemmy.caEnglish
      2·
      2 days ago

      Can I ask how you have this setup? Do you also have a reverse proxy setup or just WG on your router and everything gets routed via your router?

      • spaghettiwestern@sh.itjust.worksEnglish
        1·
        2 days ago

        I have everything route through the tunnel and my router. Along with allowing instant access to everything I self-host and my home server through VNC, it allows me to use Adguard Home for phone DNS lookups no matter where I am. Theoretically my cell carrier should no longer be able to see any of my Internet traffic which I consider an added bonus. I’ve found no downside except some weirdness from Google if I’m out of the country for an extended period.