There’s no magic bullet here. If you want good defense against bots you should use fail2ban and/or crowdsec. Geoblocking is also worth looking into. You will always have to open a port if you are selfhosting a VPN and will need to take aforementioned steps (or alternatives) to secure it. I believe Tailscale is a very good alternative for people who don’t have time to do this as it does not (to the best of my knowledge) require you to expose a port.
I use Netbird (open source networking software from a German company) as it integrates well with Authentik and allows me to use the same SSO for VPN and most of my other services. Setting it up with Authentik and Nginx is a bit complicated but very well documented in my opinion. I do not have a positive experience of the official Android client but Jetbird is a nice alternative. Setting up DNS servers and network routes through peers is quite easy. Enrollment is also a breeze due to the Authentik integration.
There’s no magic bullet here. If you want good defense against bots you should use fail2ban and/or crowdsec. Geoblocking is also worth looking into. You will always have to open a port if you are selfhosting a VPN and will need to take aforementioned steps (or alternatives) to secure it. I believe Tailscale is a very good alternative for people who don’t have time to do this as it does not (to the best of my knowledge) require you to expose a port.
I use Netbird (open source networking software from a German company) as it integrates well with Authentik and allows me to use the same SSO for VPN and most of my other services. Setting it up with Authentik and Nginx is a bit complicated but very well documented in my opinion. I do not have a positive experience of the official Android client but Jetbird is a nice alternative. Setting up DNS servers and network routes through peers is quite easy. Enrollment is also a breeze due to the Authentik integration.