this post was submitted on 21 Jul 2025
114 points (96.7% liked)

Selfhosted

49871 readers
619 users here now

A place to share alternatives to popular online services that can be self-hosted without giving up privacy or locking you into a service you don't control.

Rules:

  1. Be civil: we're here to support and learn from one another. Insults won't be tolerated. Flame wars are frowned upon.

  2. No spam posting.

  3. Posts have to be centered around self-hosting. There are other communities for discussing hardware or home computing. If it's not obvious why your post topic revolves around selfhosting, please include details to make it clear.

  4. Don't duplicate the full text of your blog or github here. Just post the link for folks to click.

  5. Submission headline should match the article title (don’t cherry-pick information from the title to fit your agenda).

  6. No trolling.

Resources:

Any issues on the community? Report it using the report flag.

Questions? DM the mods!

founded 2 years ago
MODERATORS
ruud@lemmy.world
Loki@lemmy.world
CannaVet@lemmy.world
devve@lemmy.world
HybridSarcasm@lemmy.world
HybridSarcasm@lemmy.hybridsarcasm.xyz
114
What are your VPN recommendations for accessing self-hosted applications from the outside? (sh.itjust.works)
submitted 1 week ago by waterproof@sh.itjust.works to c/selfhosted@lemmy.world
90 comments fedilink hide all child comments
 

Hello,

Some time ago, I started self-hosting applications, but only on my local network. So far, it's working fine, but I can't access them as soon as I go outside (which is completely normal).

For the past few days I've been looking for a relatively secure way of accessing my applications from outside.

I don't need anyone but myself to have access to my applications, so from what I've understood, it's not necessarily useful to set up a reverse-proxy in that case and it would be simpler to set up a VPN.

From what I've seen, Wireguard seems to be a good option. At first glance, I'd have to install it on the machine containing my applications, port-forward the Wireguard listening port and configure my other devices to access this machine through Wireguard

However, I don't have enough hindsight to know whether this is a sufficient layer of security to at least prevent bots from accessing my data or compromising my machine.

I've also seen Wireguard-based solutions like Tailscale or Netbird that seem to make configuration easier, but I have a hard time knowing if it would really be useful in my case (and I don't really get what else they are doing despite simplifying the setup).

Do you have any opinions on this? Are there any obvious security holes in what I've said? Is setting up a VPN really the solution in my case?

Thanks in advance for your answers!

(page 2) 40 comments
sorted by: hot top controversial new old
[–] damnthefilibuster@lemmy.world 6 points 1 week ago (8 children)

You got two options which I’ve tried -

  1. A solution like tailscale or zerotier. Simple setup, easy to turn on and just go. Tailscale is newer and has a nicer interface and features like using an actual VPN like Mullvad as an “endpoint” (or whatever they call it). Their Mullvad connection also basically gives you a discount as they charge only $5 for the vpn instead of €5. The catch is that Mullvad charges you that price for 5 devices. So if a sixth device connects to the VPN through tailscale, you get charged $10 for that month.
  2. A cloudflare tunnel with zero trust on top. More work to setup. But makes it easy to access your apps without any vpn. They’re basically exposed to the internet at that point, but locked in behind cloudflare’s authentication. You can literally set it up for one or two email IDs. Yours and a family member’s. Much simpler for others to wrap their heads around. But some people dislike cloudflare for some reason or the other.
load more comments (8 replies)
[–] phillipp@discuss.tchncs.de 5 points 1 week ago

I’m in the same boat and currently run WireGuard to access my services. However the more I extend my stack of services, the more I have use-cases to expose certain services to friends and family. For that I’m currently looking into using Pangolin.

[–] Atherel@lemmy.dbzer0.com 5 points 1 week ago

Wireguard with WG Tunnel on my phone so it automatically connects when I leave my WiFi. Some Apps excluded to use it like Android Auto because it doesn't work with an active vpn.

[–] Tywele@lemmy.dbzer0.com 5 points 1 week ago (1 children)

I use the built-in Wireguard feature of my Fritzbox to connect to my home network.

[–] waterproof@sh.itjust.works 1 points 1 week ago

Good point, I did not check if my router has already some built-in system that could let me connect to my home network with trusted devices from outside

[–] JohnSmithon@lemmy.world 4 points 1 week ago

1 pangolin 2 whatever is already on your router 3 wireguard

Pangolin also does RP with traefik so it's a win win

[–] Bort@hilariouschaos.com 4 points 1 week ago (1 children)

https://github.com/wg-easy/wg-easy

WG-Easy to run Wireguard

[–] mumblerfish@lemmy.world 2 points 1 week ago

I would recommend this too. This was the easiest to setup. I only had an issue with docker compose which made the pihole not being accessible while on wireguard. Once I put the pihole and wg-easy on the same docker network it started working.

[–] muusemuuse@sh.itjust.works 3 points 1 week ago

WireGuard is the fastest method, it’s free, there is no reason not to use it.

[–] communism@lemmy.ml 2 points 1 week ago

In that case, wireguard. I only occasionally need to access a service that's not exposed to the internet, so I use ssh -L, but that would be quite inconvenient for your own use case.

I know tailscale exists but I've never used it, only tried wireguard on its own. Maybe there's some huge benefit to using it but wireguard worked fine for me.

[–] UltraMagnus0001@lemmy.world -4 points 1 week ago (2 children)

My Asus router has a a few nice ones

[–] SupraMario@lemmy.world 4 points 1 week ago

This is a pointless comment. You don't even tell us what model router you're running...

[–] UltraMagnus0001@lemmy.world 1 points 1 week ago
  • pretty much any modern asus routers with a mesh setup and if you run merlin it has more security features.
load more comments
view more: ‹ prev next ›