this post was submitted on 21 Jul 2025
107 points (96.5% liked)

Selfhosted

49711 readers
238 users here now

A place to share alternatives to popular online services that can be self-hosted without giving up privacy or locking you into a service you don't control.

Rules:

  1. Be civil: we're here to support and learn from one another. Insults won't be tolerated. Flame wars are frowned upon.

  2. No spam posting.

  3. Posts have to be centered around self-hosting. There are other communities for discussing hardware or home computing. If it's not obvious why your post topic revolves around selfhosting, please include details to make it clear.

  4. Don't duplicate the full text of your blog or github here. Just post the link for folks to click.

  5. Submission headline should match the article title (don’t cherry-pick information from the title to fit your agenda).

  6. No trolling.

Resources:

Any issues on the community? Report it using the report flag.

Questions? DM the mods!

founded 2 years ago
MODERATORS
ruud@lemmy.world
Loki@lemmy.world
CannaVet@lemmy.world
devve@lemmy.world
HybridSarcasm@lemmy.world
HybridSarcasm@lemmy.hybridsarcasm.xyz
107
What are your VPN recommendations for accessing self-hosted applications from the outside? (sh.itjust.works)
submitted 2 days ago by waterproof@sh.itjust.works to c/selfhosted@lemmy.world
89 comments fedilink hide all child comments
 

Hello,

Some time ago, I started self-hosting applications, but only on my local network. So far, it's working fine, but I can't access them as soon as I go outside (which is completely normal).

For the past few days I've been looking for a relatively secure way of accessing my applications from outside.

I don't need anyone but myself to have access to my applications, so from what I've understood, it's not necessarily useful to set up a reverse-proxy in that case and it would be simpler to set up a VPN.

From what I've seen, Wireguard seems to be a good option. At first glance, I'd have to install it on the machine containing my applications, port-forward the Wireguard listening port and configure my other devices to access this machine through Wireguard

However, I don't have enough hindsight to know whether this is a sufficient layer of security to at least prevent bots from accessing my data or compromising my machine.

I've also seen Wireguard-based solutions like Tailscale or Netbird that seem to make configuration easier, but I have a hard time knowing if it would really be useful in my case (and I don't really get what else they are doing despite simplifying the setup).

Do you have any opinions on this? Are there any obvious security holes in what I've said? Is setting up a VPN really the solution in my case?

Thanks in advance for your answers!

you are viewing a single comment's thread
view the rest of the comments
[–] jobbies@lemmy.zip 3 points 2 days ago* (last edited 2 days ago) (2 children)

Apologies for the dumb noob question, but if your iOS device is VPNed to your home server, how does it access the open internet? Does it do this via the VPN?

[–] eszidiszi@lemmy.world 9 points 2 days ago* (last edited 1 day ago)

Depends on the client configuration. If you route all the traffic through vpn (so, simplified, 0.0.0.0/0) then all their client device network traffic would go through their vpn server at home and is seen as coming from there; otherwise, if you only route specific addressess (like your home network private addressess only) then only those go to their home network and everything else works like it would without a vpn.

[–] friend_of_satan@lemmy.world 6 points 2 days ago* (last edited 1 day ago) (1 children)

WireGuard routes certain traffic from the client (your iPhone) through the server (the computer at your house). If you route all traffic, then when your iPhone accesses the internet, it's as if you were at home. Since that WireGuard server is sitting on your home LAN, it is able to route your phones traffic to anything else on that LAN, or out to the internet.

Wireguard clients have a setting called AllowedIPs that tells the client what IP subnets to route through the server. By default this is 0.0.0.0/0, ::/0, which means "all ipv4 and all ipv6 traffic". But If all you want to access are services on your home LAN, then you change that to 192.168.0.0/24 or whatever your home subnet is, and only traffic heading to that network will be routed through the WireGuard server at your house, but all other traffic goes out of your phone's normal network paths to the internet.

[–] jobbies@lemmy.zip 1 points 2 days ago (2 children)

Ahh. But what if you already used a VPN on the client for normal browsing etc - can you have two VPNs configured?

[–] SpikesOtherDog@ani.social 3 points 2 days ago

No, think of a VPN as a network cable. You can only send out of one or the other.

Now, if you are connected to a device that has another VPN to somewhere you want to go, then technically yes you would be using 2 VPN connections.

[–] friend_of_satan@lemmy.world 1 points 1 day ago

I don't think iOS allows multiple VPNs to be enabled simultaneously. There appears to be only one VPN on/off toggle switch. From what I've seen you can have different vpn profiles but only enable one at a time. I could be wrong though.

Desktop operating systems like macOS, Linux (did I mention yet that I use arch Linux?), BSD, and um.. that other one... oh yeah, Windows do allow this. I'm sure there are a variety of compatibility problems, but in general, multiple VPNs with the same or even different technologies can work together.