Hello,

Some time ago, I started self-hosting applications, but only on my local network. So far, it’s working fine, but I can’t access them as soon as I go outside (which is completely normal).

For the past few days I’ve been looking for a relatively secure way of accessing my applications from outside.

I don’t need anyone but myself to have access to my applications, so from what I’ve understood, it’s not necessarily useful to set up a reverse-proxy in that case and it would be simpler to set up a VPN.

From what I’ve seen, Wireguard seems to be a good option. At first glance, I’d have to install it on the machine containing my applications, port-forward the Wireguard listening port and configure my other devices to access this machine through Wireguard

However, I don’t have enough hindsight to know whether this is a sufficient layer of security to at least prevent bots from accessing my data or compromising my machine.

I’ve also seen Wireguard-based solutions like Tailscale or Netbird that seem to make configuration easier, but I have a hard time knowing if it would really be useful in my case (and I don’t really get what else they are doing despite simplifying the setup).

Do you have any opinions on this? Are there any obvious security holes in what I’ve said? Is setting up a VPN really the solution in my case?

Thanks in advance for your answers!

  • friend_of_satan@lemmy.worldEnglish
    1·
    3 months ago

    Run WireGuard on some home machine. (Does not need to be the machine the app you want to access is hosted on.)

    Run WireGuard on your road warrior system.

    There is no step 3.

    I’m doing this right now from halfway around the world from my house and it’s been great. Been using iPhone, iPad, and macOS clients connected to linuxserver/WireGuard docker container. Been doing this on many WiFi networks and 5G, no difference.

    • dantheclamman@lemmy.worldEnglish
      1·
      3 months ago

      I use Wireguard via PiVPN and it’s pretty much foolproof. I don’t bother with Dynamic DNS but have in the past

    • jaybone@lemmy.zipEnglish
      0·
      3 months ago

      Is wire guard a service you pay for? Otherwise how does wire guard in your home machine not need your router to forward ports to it? And then the remote client need to be pointed at your home’s external IP?

      • friend_of_satan@lemmy.worldEnglish
        1·
        3 months ago

        WireGuard is free. Obviously my instructions didn’t go into detail about specifically how to set everything up. Port forwarding is required. Knowing your servers external IP address is required. You also need electricity, an ISP subscription, a home server (preferably running Linux), so on and so forth. This is /c/selfhosted after all.

    • jobbies@lemmy.zipEnglish
      0·
      3 months ago

      Apologies for the dumb noob question, but if your iOS device is VPNed to your home server, how does it access the open internet? Does it do this via the VPN?

      • eszidiszi@lemmy.worldEnglish
        1·
        3 months ago

        Depends on the client configuration. If you route all the traffic through vpn (so, simplyfied, 0.0.0.0/0) then all their client device network traffic would go through their vpn server at home and is seen as coming from there; otherwise, if you only route specific addressess (like your home network private addressess only) then only those go to their home network and everything else works like it would without a vpn.