Home-Lab Hosts Fighting Remote Access
Individuals managing self-hosted applications in home labs are experiencing significant frustration with complex networking configurations. They're grappling with issues like reverse proxy errors, VPN connectivity problems, file upload limitations, and unreliable network performance, hindering their ability to reliably access and share their services.
SOURCES (60)
“It's really not that bad on a VPS lol, I run two instances od Technitium, one on my home server and one on my vps, they both just go through pangolin, my domain points to the tailscale ip of my vps so nothing outside my…”
In case anyone else runs into this, I spent quite a bit of time tracking it down. My Home Assistant server is on a different VLAN than my Envisalink EVL4. Symptoms TCP…
If every Nextcloud user and device can use the VPN reliably, then putting Nextcloud behind the VPN too is the safer and simpler design. I only separated it because Nextcloud is often…
“Currently, all my devices can freely connect to any service on the network. I also often connect from public Wi-Fi or unsecured networks; for this reason, I'd like to improve the security of my infrastructure by limiting device access to only the services they actually use. For example, my Fire Stick should only access Jellyfin, as I'll never use it to connect to my router or Proxmox. To summarize, these are the main services on my server: - Jellyfin: IP 192.168.1.5 - Nextcloud: IP 192.1”
“But often reverse proxy is a separate VM/LXC, restricting network access means that reverse proxy also cannot reach docker. Would the FW rules would be the other option I presume?”
“Hi all, early in the network research phase, so looking for some advice from this thread. What are you using to connect multiple sites without ending up with a complex or burdensome VPN set up? I'm looking at options for a business with several locations, a small IT team, and a mix of NBN and 4G/5G connections. Traditional site-to-site VPNs seem straightforward initially, but I keep reading that they become difficult to manage as more sites are added. If you've been down this path, what”
“- Anyone running NetBird's reverse proxy (still beta) for browser-only guest access? How has it held up? Fairly good for me. I deploy via compose point a the netbird-proxy service to a host and port and everything just works. Only issues ive had is how its configured is a bit of a headache but I worked those out and maybe dont update this as often as anything else. Netbird is pumping out updates, that breaks things sometimes. - Anything obviously missing from the threat model for "frien”
“Cloudflared needs a DNS, and one that can be hosted by them. I dont have it. IPv64 is DDNS, doesnt solve CGNAT.”
“Uh. Traefik is for some complex words like docker. If i read it right, then it needs a VPS you own to make it. Duckdns does not bypass CGNAT.”
[ I found a few DNS-related posts, but they were years old already…and unresolved. ] Home Assistant lost its ability to connect to reach external servers and even my other main too,…
Hello, I’m facing a problem and I can’t find a good way to handle this question right now. I have HA and few esphome on a secondary house where I’m not all…
“So tailscale is running on all my machines and devices. I have seafile installed and working through docker as well as webdav working and can access it by going to http://MY.TAILSCALE.IP:8000/seafdav/Joplin/ on Windows and iPhone safari. You can see the files got synced there with the desktop version of Joplin. I pointed the iPhone app of Joplin to the ip and input my username and password but it does not appear to be syncing according to notes I've made on the desktop, they don't go to”
“Current setup: Proxmox host with 2 LXCs: one running my Docker containers (*arr apps, Immich, Plex, etc.), and one dedicated to Tailscale with subnet routes advertised (so I can reach the other LXC and the host itself over VPN). Works well for my own devices. I now want to share my Plex library with friends, but I'm behind CGNAT, which makes it significantly more of a PITA. Two options I'm considering: Run Tailscale as a sidecar container on Plex Have Plex on its own LXC and run Tailscal”
“I have recently installed docker (Coming from Proxmox) and have dabbled with in my spare time. I currently have dockhand & Grocy installed on it. I plan to install many more containers like nginx, adguard, jellyfin, etc. I currently have a static public IP from hosting steam game servers for my friends and I. I also recently purchased a domain that I have not done anything with yet. I'm getting ready to make Grocy accessible beyond my LAN so my wife can use the app at the grocery store a”
“localhost In a docker container, localhost resolves to the container loopback, not the Host's loopback. What you want to use is host.docker.internal Also, you could try using Jellyfin actual IP, instead of its domain name.”
“Hi everyone, I plan to host many client websites on my account (AI-developed websites), and it has to be as low friction as possible. Cloudflare requires nameserver change, so that's a no go. I basically want my clients to just point their DNS and call it a day, and not worry about account creation, sharing passwords or anything. I definitely also want to leverage the auto deply features, as well as their CDNs (and maybe edge functions). Between netlify and vercel, do you have a preference o”
“Basically, what I'm asking is how would one get around this? Here's the links to how this is set up: https://docs.palworldgame.com/getting-started/deploy-dedicated-server/ https://docs.palworldgame.com/getting-started/deploy-community-server/ I am fairly new to this so please do explain thoroughly submitted by /u/ThyPannyx [link] [comments]”
“VPN works fine for this use case and there are several reputable ways to accomplish this without relying on some random app promoted on Reddit.”
“I use Tailscale for this and it works great! I am on vacation as we speak and i have been using all my services via my telnet.”
“I have been self hosting apps for quite some time. BTW, thank you to this community for your many insights and helpful pointers. One of the challenges I have had is around SSH access to my servers. Having terminal access makes all the difference in being able to (or not) support my family while I travel. I was turned on to this by a colleague. https://pigeons.computer/ Apologizes if this was posted and I missed it. I loaded this up yesterday and it seems legit. I have been able able shutdown my”
“You should have default firewall rules that you apply to any VM you put on the internet. You configure this separately in DO's admin panel, and apply the same rules to any VM you create. You can then make copies of this configuration if you have some VMs with specific rules. There is no reason for the internet to see any ports you don't want them to see.”
“If you use tailscale ssh, you rely on ACLs, and anyone else in your tailnet you should update as soon as possible. Even if you're alone in your tailscale don't write off the possibility of chained vulnerabilities. Generally, when it comes to something as important as ssh, consider using openssh instead. submitted by /u/williambobbins [link] [comments]”
“I keep my main wg peer for all of my devices on the main router (it's OpenWrt, also if that one goes down, then the rest is also dead for remote access, it's a single point of failure anyway), and with some routing magic, I can access all my sites (locations) over any wireguard peer I'm connected to. voilà, so bare metal for me here.”
“Yeah this guy is being way to beg. I have not once heard of tailscale ssh having vulnerability. I dont see how it would ? Like if ssh is bound to the tailscale IP and you have proper ACLs then how could it exploited unless your main account got compromised.”
“Sure this is probably fine. Worst case scenario (unless the tailscale daemon has a vulnerability) is that it's only as bad as running ssh on a public IP (which, as long as you don't have a weak password, is fine). I'm not talking about ssh over tailscale, I'm talking about the tailscale ssh service which replaces the default ssh.”
“Wireguard. I know a lot of people use Tailscale but I didn't want to be platform dependent and setting up Wireguard was not that difficult. I also only need to connect to my own server and not to a spread out (over the internet) configuration so didn't need any of the other things they offer.”
“cf tunnel is http(s) only, so it wont carry your torrent seeding at all (wrong protocol), and streaming jellyfin over it breaks their tos. cleanest split is tailscale or wireguard for jellyfin + seeding, and keep the cf tunnel just for the plain web servers.”
“I use Tailscale to access my home as a vpn and it works great. I just use its core offering for vpn access, which I do use predominantly for web access, but I could ssh if I felt like it using the tailscale hostname or ip address. I can ssh via tailscale, but I'm not familiar with any of their other services. My admin console has nothing special listed under the services tab.”
“I have a domain with Cloudflare so I am thinking of using Cloudflare Tunnel but I'm not sure if there are better options? One of my concerns is that some of my containers do not have auth so I need something with built in auth management. submitted by /u/imthenachoman [link] [comments]”
“Hello, I have a mini PC that I run as a server for primarily Jellyfin, host a few web servers and for torrent seeding. But I need to setup a tunnel and I heard Cloudflare tunnel is pretty good but I don't know if it has limits regarding bandwith and consumption. Does anybody use cloudflare for such use cases? submitted by /u/varlikip [link] [comments]”
“Just wondering. I am looking at ways to keep my little network ticking away. submitted by /u/TotallyNotACorpAcct [link] [comments]”
Some time ago, dovecot released a new version with a breaking change. Arrogant and ignorant me decided to upgrade anyway, thinking it would be easy to make it work with everything else.…
“In my setup, Jellyfin currently runs on Docker, and I need remote access to my media server, which I would like to do with WireGuard. On the same Docker stack as Jellyfin I have a Navidrome install for music streaming, so I would need to use some other tools like Fail2Ban along with WireGuard since Navidrome does not have an inbuilt penalty for entering the wrong user credentials, unlike Jellyfin. The only communication I want to happen between WireGuard, Docker, and my clients is for WireGuard”
“I find tailscale quite unreliable with credentials on a headless server. I had to physically access a remote server because just initial setup isnt enough to maintain connectivity for some weird reason. I dont want to open any ports. Any suggestions? submitted by /u/edabiedaba [link] [comments]”
“I have limited internet speed at home 9MB/s down and 4 MB/s Up and run a homelab (Linux mint). As an example I want to give qbittorrent full upload speed for seeding but in the case that I'm accessing my server externally over reverse proxy, I want that traffic to be prioritized. Afaik there's no built in way to do this in Any torrent client. I have seen that you can mark packages and let the kernel prioritize certain traffic that way, so I wanted to ask here if anyone did something like”
“Part 3 of my 4 part series on private network meshes is finally up. The last post covered surviving hostile internet environments and NATs. Today we move past the theory of mesh networks and start implementing one! In this post, I took a highly opinionated approach to building this mesh. The core design feature is physically air-gapping our control plane. Typically, running a coordination server on a public VPS means a single compromise hands over the 'keys to your entire network'. This”
“Hi everyone, I have a home server running various Docker containers (including Immich, Nextcloud, jellyfin, qbittorrent and other storage services). Where I live, getting a static/public IPv4 is extremely expensive, and I am stuck behind a CGNAT . Fortunately, high-speed fiber is quite cheap, so I have a 1 Gbps symmetrical line at home. To make my services accessible from the outside, I’ve been using Cloudflare Tunnels . It works incredibly well for basic web apps, but I’ve hit a major roadblock”
“Manual port forwards are more ideal, but upnp still has a place if done correctly/safely. Game consoles & games are a good example of where it's still useful (especially if you have multiple of the same console on your network) I limit upnp to only be used by the multiple Xbox consoles on my network.”
Have you tried it without the vpn? You don't need one with usenet.
“You could just have split tunnelling on the VPN and never turn it off, that way things work normally but you are always connected to home.”
“Trying to set up an *arr stack and am struggling to get it to work. I have a vpn I have Usenet and they work and everything is on docker on my nas but I can’t index anything without it getting blocked. If anyone knows how to fix this pls lmk or if interested I would be willing to hire someone as a “consultant” that can help me with all of my set up. submitted by /u/Due-Tart6260 [link] [comments]”
“Trying to set up an *arr stack and am struggling to get it to work. I have a vpn I have Usenet and they work and everything is on docker on my nas but I can’t index anything without it getting blocked. If anyone knows how to fix this pls lmk or if interested I would be willing to hire someone as a “consultant” that can help me with all of my set up. submitted by /u/Due-Tart6260 [link] [comments]”
“Hi, I'm looking for a self-hosted solution that can automatically discover and inventory devices connected to my local network. Ideally, I'm looking for something that can: Automatically scan my LAN on a schedule Detect new devices as they connect Show IP address, MAC address, hostname, vendor, and operating system (if possible) Keep a history of devices that have been seen Alert me when new or unknown devices appear Run in Docker if possible submitted by /u/Extra-Citron-7630”
“Fresh install, added to domain, added to OU... can't get RDP to be allowed through. Doesn't seem different than any other computer I've ever configured but for the life of me can't figure this one out. All relevant policies are the "winning policy" from GPresult, etc. In the meantime I'm just going to wipe this thing and try again - but it's really irking and confusing the hell out of me. submitted by /u/mustang__1 [link] [comments]”
“I want to prevent as much lateral movement as I can from compromised containers and I think I've been using traefik wrong. I have been putting all the services I've been wanting to expose on one big docker network called proxy. I use docker labels to handle the routes for traefik. Since I'm doing it this way, does this mean that if an exposed container gets compromised, it can communicate with anything on the proxy network? Should I be making individual proxy networks for each stack”
“I would isolate cluster traffic. The hosts only need to see each other. The network doesn't need to be routed.”
“I've been troubleshooting NetBird's reverse proxy feature (cloud version) and I have a frustrating issue that I'd like some clarity on. My Setup: Local server (192.168.1.5) Debian + Docker (Caddy reverse proxy + Adguardhome DNS) example.com as my domain with SSL managed by Caddy-cloudflare DNS challenge everythig works locally (e.x: https://nextcloud.example.com ) and through Tailscale, Now I want Netbird: Netbird (cloud) with NetBird routing peer running on the same local server (19”
“Sophos firewalls are is fine for SMB customers but don’t scale to enterprise needs. In particular the ASIC and SDWAN functionality is significantly more powerful on FortiOS. That’s not to deny your point on central management and integration though. I’m not saying Sophos is no good for small and medium businesses, but there are plenty of important things that Fortigate wipes the floor with Sophos on at an enterprise level. Here’s what seems to be a fair comparison: https://www.thenetworkdna.com/”
“Just demote the DC and configure a DNS forwarder to another DC.. enable logging, and start playing whack-a-mole on whatever is coming in. When done, proceed with decomm.”
“And, just because you want it to be static or DHCP, doesn’t mean you shouldn’t try the other option and see if you can get it to work there. Never underestimate the simplicity of directly connecting a crossover cable”
“I'm working on a networking appliance that connects directly to my network router. The appliance has haproxy, crowdsec, certbot, wireguard and dnsmasq, which together handle all the routing for all the things inside and outside my network. So, I can configure different scenarios, for example this image shows the control panel that set up split dns and is routing external traffic through nftables and crowdsec, then into haproxy where it terminates the wildcard TLS cert and finally sends to th”