A place to share alternatives to popular online services that can be self-hosted without giving up privacy or locking you into a service you don't control.
Rules:
Be civil: we're here to support and learn from one another. Insults won't be tolerated. Flame wars are frowned upon.
No spam posting.
Posts have to be centered around self-hosting. There are other communities for discussing hardware or home computing. If it's not obvious why your post topic revolves around selfhosting, please include details to make it clear.
Don't duplicate the full text of your blog or github here. Just post the link for folks to click.
Submission headline should match the article title (don’t cherry-pick information from the title to fit your agenda).
No trolling.
Resources:
Any issues on the community? Report it using the report flag.
Questions? DM the mods!
I run pfsense as my router on a small form factor PC with two Ethernet cards. I run Wireguard which is pretty easy to setup in pfsense. I have the client installed on my PC at work and my mobile devices. I'm never more than a click from being connected to my home network.
In the past I used ssh tunnels with port forwards to the services I wanted to access remotely.
Tailscale is great in that config is super simple. Downsides tailscale ssh has to be called at launch if you want ssh access over that network... Could be a benefit for security...however its a tailscale specific ssh and not everything is available.
Data servers moved to the USA a few ears back.
Wireguard is more setup, but a better (self host option ). There is also Headscale if you want to selfhost a tailscale type server
I do have both (VPN and Reverse Proxy) running. For VPN my router uses Wireguard and at work we use Wireguard as well. You can alter the config in such a way, that only internal traffic would get routed through your VPN. I love this, because for regular traffic, I'm not bound to the upload at my home network or with work, route my personal traffic through the company internet or lose access to my own network.
Reverse proxy isn't bad either. I have a DNS running at home, that redirects my domain used for home stuff, directly to the reverse proxy. This way I can block certain stuff, I want a fancy domain but not be accessed from the outside, because its not needed or not set up properly.
With a VPN, you would be more secure, because its a single instance you need to keep safe. With regular updates and set up properly, this shouldn't be an issue. But I would suggest reading tech news portals, that do cover security breaches of well known software.
With a reverse proxy setup I use, I must trust so many things. I must trust my reverse proxy with the firewall and then each server I run.
But keep one thing in mind. If you for example use stuff like Home Assistant, that you access in the background, it wouldn't work if you connect via a VPN. With Wireguard I can be connected 24/7 to my VPN, even at home. With the previous VPN my router used (I guess it was OpenVPN), this wasn't possible.
I self-host various applications and have been really happy with Wireguard. After watching just how hard my firewall gets hammered when I have any detectable open ports I finally shut down everything else. The WG protocol is designed to be as silent as possible and doesn't respond to remote traffic unless it receives the correct key, and the open WG port is difficult to detect when the firewall is configured correctly.
Everything - SSH, HTTP, VNC and any other protocol it must first go through my WG tunnel and running it on an OpenWRT router instead of a server means if the router is working, WG is working. Using Tasker on Android automatically brings the tunnel up whenever I leave my house and makes everything in my home instantly accessible no matter what I'm doing.
Another thing to consider is there's no corporation involved with WG use. So many companies have suddenly decided to start charging for "free for personal use" products and services, IMO it has made anything requiring an account worth avoiding.
Can I ask how you have this setup? Do you also have a reverse proxy setup or just WG on your router and everything gets routed via your router?
I have everything route through the tunnel and my router. Along with allowing instant access to everything I self-host and my home server through VNC, it allows me to use Adguard Home for phone DNS lookups no matter where I am. Theoretically my cell carrier should no longer be able to see any of my Internet traffic which I consider an added bonus. I've found no downside except some weirdness from Google if I'm out of the country for an extended period.
If you use Tasker only as VPN switch you could have a look at WG Tunnel from zaneschepke on Github. It has a built in function to switch to the tunnel when your local WIFI is not connected.
Tailscale. You don't need to open up ports + you can set up exit nodes, which are useful if you're sailing the seven seas.
The only downside of Tailscale is a few years back they moved their data servers from Canada to the USA...so with the current administration this could become a privacy issue at some point
Tailscale. You can make a free account and they have clients for most things. If you want to self host, Headscale.
Run WireGuard on some home machine. (Does not need to be the machine the app you want to access is hosted on.)
Run WireGuard on your road warrior system.
There is no step 3.
I'm doing this right now from halfway around the world from my house and it's been great. Been using iPhone, iPad, and macOS clients connected to linuxserver/WireGuard docker container. Been doing this on many WiFi networks and 5G, no difference.
I use Wireguard via PiVPN and it's pretty much foolproof. I don't bother with Dynamic DNS but have in the past
I use a mixture of tailscale and zerotier. Both are pretty powerful.
I use OpenVPN. It’s pretty easy. You set it up with docker, download the client.ovpn file, then turn off port 80 (only needed for downloading that file). Now you can take that file and use it all of your devices to connect.
If your traffic is pretty low, rent a VPS for $5/month or whatever and set up a Wireguard server on it, have your devices maintain a connection to it (search keepalive for Wireguard), and set up HAProxy to do SNI-based routing for your various subdomains to the appropriate device.
Benefits:
Downsides:
If you only need access on devices you control, something like Tailscale could work.
Benefits:
Downsides:
I did the first and it works well.
I would not recommend relying on Tailscale. They have been soliciting a lot of venture capital lately and are probably going to go for an IPO sooner or later. I would not put a lot of trust in that company. The investors are going to want their money.
Yeah, that's the "you don't control it" angle here. There are alternatives, but you'll have to do a fair amount of work to switch vs something you do control (i.e. to switch to a different VPS, just copy configs and change the host config on each client, everything else is the same).
Not running anything myself but am part of a self hosting discord that swears by Netbird because its basically Tailscale but with a bunch more ease of use features apparently
Wireguard is the way to go. I like using wg-easy to use wireguard because its easy to set up in a docker container.
Also a beginner here, I use Tailscale, and it's been a very easy setup!
I rarely if ever see ZeroTier mentioned as a solution, but it's a self-hostable encrypted virtual mesh network (with a small free tier for corp-hosted), super secure, and really easy to setup. I use ZTnet instead of the free-tier corp-hosted controller
I used wireguard self hosted for a bit but my work network is pretty locked down and I couldn't find a UDP port that wasn't blocked. How are you guys setting up wireguard in your home network? Or is it better to host it on a cloud VM?
I'm using tailscale right now because it punches through every firewall but I don't like using external providers and I'm worried it will eventually enshittify. I have a cloudflare domain but I can't really use any UDP port for my VPN as it's blocked.
I got a VPS because I'm behind CGNAT, and then configured WireGuard on the server and HAProxy to proxy requests to my devices.
It works well for me.
Tailscale is easier than Wireguard but if you're running OPNsense or OpenWRT it's not hard to do a wireguard infra of your own and avoid having to use an outside service. I ended up having to revert to wireguard anyway because Tailscale's android app wasn't reliable on my new phone, it would drop out every few hours which messed up my monitor/alert system.
But Tailscale is still the easier of the two solutions.
Wireguard with WG Tunnel on my phone so it automatically connects when I leave my WiFi. Some Apps excluded to use it like Android Auto because it doesn't work with an active vpn.
Managing Wireguard is just one of Tailscale's features.
It uses some UDP black magic fuckery to get through NAT and firewalls without having to open ports on the edge. Very useful if you're behind CGNAT and/or your ISP is a dickhead and locks down the firewall on your router (this is why I use it; eat a dick, Vodafone). If the UDP fuckery is not available, it reverts to simple relay servers. The client can also advertise subnets and route to hosts on it. You could install the Tailscale client on OPNSense/pfSense/OpenWRT and access your entire home network through that one device.
Zero tier. I went tailscale originally, and they're good, but their mdns support doesn't exist and several services rely on it. (For me, the showstopper was time machine backups)
Simple and fast solution is tailscale. tailscale is a business, but it works well
Personally i use opnsense and wireguard
WireGuard is the fastest method, it’s free, there is no reason not to use it.
There's no magic bullet here. If you want good defense against bots you should use fail2ban and/or crowdsec. Geoblocking is also worth looking into. You will always have to open a port if you are selfhosting a VPN and will need to take aforementioned steps (or alternatives) to secure it. I believe Tailscale is a very good alternative for people who don't have time to do this as it does not (to the best of my knowledge) require you to expose a port.
I use Netbird (open source networking software from a German company) as it integrates well with Authentik and allows me to use the same SSO for VPN and most of my other services. Setting it up with Authentik and Nginx is a bit complicated but very well documented in my opinion. I do not have a positive experience of the official Android client but Jetbird is a nice alternative. Setting up DNS servers and network routes through peers is quite easy. Enrollment is also a breeze due to the Authentik integration.
Netbird is very nice and easy to use. Only downside is that the iOS app drains battery like crazy :(
In that case, wireguard. I only occasionally need to access a service that's not exposed to the internet, so I use ssh -L, but that would be quite inconvenient for your own use case.
I know tailscale exists but I've never used it, only tried wireguard on its own. Maybe there's some huge benefit to using it but wireguard worked fine for me.
1 pangolin 2 whatever is already on your router 3 wireguard
Pangolin also does RP with traefik so it's a win win