The only externally accessible service is my wireguard vpn. For anything else, if you are not on my lan or VPN back into my lan, it’s not accessible.
This is the way.
Can I ask your setup? I’d like to get this for myself as well.
Sorry, haven’t logged on in a bit. I use OPNSense on an old PC for my firewall with the wireguard packet installed.
Then use the wireguard client on my familys phones/laptops that is set to auto connect when NOT on my home wifi. That way media payback, adguard-home dns and everything acts as seamless as possible even when away while still keeping all ports blocked.
Try pivpn. It is meant to run on a raspberry pi, but it should work on most Ubuntu and Debian based distributions.
Everything is accessible through VPN (Wireguard) only
Same. Always on VPN on phone for on the go ad blocking via pihole.
Same here. Taught my wife how to start WireGuard on her android phone and then access any of the services I run. This way I only have one port open and don’t have to worry too much.
How about running your wireguard server on a VPS and then connecting to the same interface as clients from your mobile and home network? No ports open on your side!
Nothing I host is internet-accessible. Everything is accessible to me via Tailscale though.
100% is lan only cause my isp is a cunt
Tailscale with the Funnel feature enabled should work for most ISPs, since it’s setup via an outbound connection. Though maybe they’re Super Cunts and block that too.
Prompt: Super Cunt, photorealistic, in the style of Jill Greenberg.
Ah, CG-NAT, is it? There are workarounds
NAT to extremes… it’s Starlink so I think I’m almost completely obfuscated from the internet entirely.
quite frankly i don’t really host anything that needs to be accessible from the general Internet so I never bothered with workarounds.
Available to the internet via reverse proxy:
- Jellyfin
- Navidrome
- Two websites
- matrix chat server
- audiobookshelf
LAN only:
- homepage
- NGINX Proxy Manager
- Portainer
There’s more in both categories but I can’t remember everything I have running.
What is homepage? I’m testing homarr right now (assuming it’s similar) but haven’t set on it yet
It’s another dashboard like homarr. I set up homarr and homepage side by side to pick one and landed on homepage. No specific reason, I just gravitated to it over homarr.
Thanks, I’ll check it out :D
You’re welcome!
I believe it’s this
I’ve been eyeing it myself
Woo thank you!
That it is!
I currently keep everything LAN-only because I haven’t figured out how to properly set up outside access yet.
(I would like to have Home Assistant available either over the Internet or via VPN so that automations keyed off people’s location outside the home would work.)
Just recommendes something that could help you to someone else here
Yeah, same, except I tunneled HA out via that Cloudflare daemon. Kinda janky because I cannot use the app with it to do locations, but I can check in on the pets from anywhere.
I’m planning to set up a legit VPN sometime soon.
Why can’t you use the app to do locations?
I cannot get the app to connect to my HA with the current setup. I have Cloudflare doing email verification, and the app doesn’t understand how to collect the cookies to make that possible.
deleted by creator
Everything exposed except NFS, CUPS and Samba. They absolutely cannot be exposed.
Like, even my DNS server is public because I use DoT for AdBlock on my phone.
Nextcloud, IMAP, SMTP, Plex, SSH, NTP, WordPress, ZoneMinder are all public facing (and mostly passworded).
A fun note: All of it is dual-stacked except SSH. Fail2Ban comparatively picks up almost zero activity on IPv6.
Only my emby and ombi containers has an open path in/out, everything else is local or VPN only
Most of my things are open to the web but thats kinda nessasary for them to be functional file shairing links, link shortening, mc server etc etc
Only my Stremio add-ons, such as Knightcrawler, Annatar and Stremio-Jackett.
I expose most things to the web so long as they have auth and 2FA options. The one exception being my Jellyfin server. I share it with friends and needed to make it as easily accessible as possible.
With Cloudflare WAF, reverse proxy, and an isolated subnet with IDP I feel comfortable with public services. Nothings perfect but if they get through it and pwn my lab I’ll just nuke it and rebuild.
I keep everything behind a VPN so I don’t have to worry much about opening things up to the Internet. It’s not necessary about the fact that you’re probably fine but more so what the risk to you is if that device is compromised, ex: a NAS with important documents, or the idea that if that device is infected, what can that device access.
You could expose your media server and not worry too much about that device but having it in a “demilitarized zone”, ensuring all your firewall rules are correct and that that service is always updated is more difficult than just one VPN that is designed to be secure from the ground up.
Each time I’ve read into self-hosting it often sounds like opening stuff up to the internet adds a bunch of complexity and potential headaches, but I’m not sure how much of it is practicality vs being excessively cautious.
It’s always a balance between security and convenience. You have to mitigate what risk you are willing to well…risk
Jellyfin and Miniflux are internet facing because it would be turbo annoying otherwise to deal with them
