Home-Lab Hosts Fighting Remote Access

“Problem Orpheus has no way to see or switch a VPN. The store's VPN plugin (neur0map) does this well, but it only mounts on QS Bar ( topbarGlyph ) or as a desktop widget, so anyone on Orpheus loses it. Ryoku's own bars only have RailVpn , which shows a shield while a WireGuard tunnel is up. NetworkManager VPN profiles (OpenVPN, OpenConnect, …) and Tailscale are not covered at all. Proposal An Orpheus vpn module plus a vpn card. They follow the plugin's design, but go through the daemon instead of”

大佬你好，我就想问问这个CubeX对于ipv6的支持怎么样

“Hi! I have several services hosted on two mini-PCs at home, plus Home Assistant on a Raspberry Pi, a NAS, and a cloud VM that acts as a reverse proxy for internet "clients" (using Nginx + mTLS). Every home host have a NGINX that reverse request only for services that hosted on that server. Everything works great, but... how do you manage wildcard SSL certificates for services across multiple hosts? Back when I had just one host and a couple of services, the HTTP-01 challenge worked per”

“Weird question, but I struggle to find the answer. I am tired of using VPN providers, but I am fortunate enough to have some houses in different countries, or at least, know people from different countries that would be up for this, so I was thinking, can I connect a device to each house, and be able to connect from another place through that internet? If this is possible, how? submitted by /u/Important-Action-998 [link] [comments]”

“Steps: 1. Fresh install, first launch: the "Choose network" sheet offers Mainnet / Testnet. 2. Choose a network, then try to connect (e.g. via a community Dojo) and have it fail (Tor won't start, Dojo unreachable, wrong pairing). 3. Dismiss or back out of the failure. Expected: the user can return to the network and Dojo choice from the error screen, or from Settings, and try again or pick the other network. Actual: the "Choose network" sheet never shows again. The only way to bring it back is S”

“So I tried setting up the app but I keep getting the error "HTTP unavailable on port 8080". You are providing a way to change the port but that's pretty difficult without having a keyboard : ) Maybe add some plus/minus buttons so I can change it quickly to a port that is unused?”

“classic fritzbox dns rebind problem, had this exact headache with my 7490. the router itself blocks the response when your domain resolves to a local ip, that's why you're seeing the router login page in the fritzbox under home network > network settings there's a dns rebind protection setting, add your domain `mydomain.ipv64.de` as an exception and it should stop redirecting you. the cert error is separate, nginx proxy manager should be handling that fine once the rebind issue is”

“Using Tailscale 24/7 plus Traefik (reverse proxy), so ports are closed. [re: Cheapest way to access Navidrome remotely without exposing my home IP?]”

“Just set up a split horizon dns so the same hostnames resolve to the netbird ip when youre remote and the lan ip when youre home, thats how i handled a similar mess with my wireguard setup [re: How to Access Caddy Reverse-Proxied Services Over NetBird Without Exposing Them]”

“I’ve been working on my navidrone from cloudflare tunnel for a year and a half without problems [re: Cheapest way to access Navidrome remotely without exposing my home IP?]”

“Simple one: blocked the IP of a major integration partner in our firewall. Egg on my face when I worked that one out. In my defence they had added all of our ~25 domains to some internal tool which tried to index all the content, they pretty much DDoS'd us. [re: What's the dumbest outage you've had? I could use the company.]”

“Sure sure… 🫡 [re: A quick reminder on why exposing RDP (Port 3389) directly to the internet is still a terrible idea]”

“Anecdotally (across the couple of thousand networks I've seen), I can recall 3 that were direct external IP. That was back in 2005 [re: A quick reminder on why exposing RDP (Port 3389) directly to the internet is still a terrible idea]”

“I stream using a domain I own, pointed to a Pangolin stack on a $10/year VPS for streaming through music.domain.tld and it works perfectly. Was using Cloudflare zero trust before switching over to self hosted that works too [re: Cheapest way to access Navidrome remotely without exposing my home IP?]”

“If you are insistent on not running a VPN on your phone and are not comfortable using Cloudflare Tunnel, Pangolin seems like your best bet. The architecture you describe is basically Pangolin with extra steps, anyway. That said, I personally believe you should just install Tailscale on your phone. Try it for a week, and if for some reason it doesn't work for you then you can look into alternatives like Pangolin, but right now I'm not convinced you aren't seriously overcomplicating th”

“keep the host on nftables, you already found out the hard way that docker on bookworm depends on it. two things worth trying. first, load the modules on the host itself with sudo modprobe ip_tables and ip6_tables. mounting /lib/modules into the container only lets it see the module files, the kernel still has to load them and that happens on the host side. second, check which wg-easy image tag you're pulling, because the older ones shell out to legacy iptables no matter what and the newer re”

“I’ve been using Home Assistant for over a month now and using Tailscale to get me a remotely. I don’t have much of a problem with it but there are some instances in which Tailscale disconnects and it doesn’t Auto-reconne…”

“Checklist [x] I have searched the issue tracker and was unable to find an open or closed issue matching what I'm seeing. [x] I have verified that the issue is happening in the latest nightly build , or the latest commit, if building from source. What happened? On Linux, there is currently no reasonable or straightforward way to bridge an 86Box virtual machine directly to the local network as its own machine. Official Linux distributions of 86Box are limited to Flatpak or AppImage (excluding Wind”

“I do the same. Tailscale. However if OP wants a cheap VPS I can suggest mikr.us - they even have a free version called Frog. [re: Cheapest way to access Navidrome remotely without exposing my home IP?]”

“Opening it up to any instance seems like the obvious move, locking it to one service kills the whole point of self-hosting. I run my own Forgejo instance on a raspberry pi and I'd use a native app in a heartbeat if it meant I could quickly approve a PR or check on CI builds without squinting at the mobile web view. The biggest thing for me would be push notifications for issue comments and PR reviews, the web interface doesn't do that obviously and I miss stuff for hours sometimes. A cle”

“Cloudflare tunnel is the way ! [re: Cheapest way to access Navidrome remotely without exposing my home IP?]”

“Not my experience so far, but wondering what yours was to say this? [re: Cheapest way to access Navidrome remotely without exposing my home IP?]”

“I use Tailscale for my Navidrome. I just leave it switched on permanently. Works flawlessly [re: Cheapest way to access Navidrome remotely without exposing my home IP?]”

“No free 'twurn's available, so I'm guessing it's limited by everyone and not a singular IP address. I was going to see how it would handle a 3D sculpture - specifically https://pixabay.com/photos/king-artus-metal-sculpture-bronze-1507392/ which is in the public domain [CC0-License] - and I tried 2 minutes after midnight in my time zone too :( [re: An app that instantly turns a photo into 360° view you can rotate & zoom into]”

“I use tailscale [re: Cheapest way to access Navidrome remotely without exposing my home IP?]”

“Sounds way to complex to me. Pc already has tailscale, so just connect to tailscale with your phone and you can access it over http, it is secure tunel between just those devices. If you use docker, you can use scaletail (using tailscale docker sidecar to add navidrome as a machine) or docktail (container that watches docker socket and adds navidrome as service) with both resulting in https://navidrome.tail-net.ts.net Won't be using your own domain but the tailnet domain, but is definitely e”

“I got a cheap VPS and use pangolin either crowdsec. Works amazing! [re: Cheapest way to access Navidrome remotely without exposing my home IP?]”

“Before you suggest [x] I have searched the existing issues and none already asks for this. Blocking method concerned Does not matter What feature would you like? in current version 6.6.1 c (same as in the last version of original project) the adaway is shipped with these 3 lists: Hosts AdAway official https://adaway.org/hosts.txt Hosts Pete Lowe blocklist https://pgl.yoyo.org/adservers/serverlist.php?hostformat=hosts&showintro=0&mimetype=plaintext Hosts StevenBlack Unified https://raw.githubuser”

“Labels: security , area: relayer , good first issue · Priority: P1 · Difficulty: easy Problem: The relayer is deployed behind a reverse proxy (Render), but app.set('trust proxy', …) is never set. express rate limit@8 then either keys every request on the proxy's IP (all users share one 100 req/min bucket, so one active user rate limits everyone) or raises ERR ERL UNEXPECTED X FORWARDED FOR validation errors. There is also no per user limit on expensive endpoints ( /accounts/prepare , /payments/s”

“Local working and the domain hanging usually means the request never reaches Nginx from the internet, not a Jellyfin problem. "Filtered" on yougetsignal is a strong hint that something upstream is dropping the packets before they hit your Windows box. Walk through these in order: CGNAT / double NAT. On the ASUS, check the WAN IP. Then open a site like whatismyip from a device on that network. If they don't match, you're behind another NAT (ISP modem/router or CGNAT). Port forwa”

“So my app's Network Map WAN IP matches whatismyip.com. So that's a plus, I suppose. I realized you're right that the network was set to public, so I changed it to Private. Doesn't seem to have made an impact, but that's that. I tried to do LocalIP:8096 just now from my phone, and it doesn't connect. I tried forwarding 8443 to 443 and checked it again, but it still says the port is Filtered. [re: Help with Suspected Port Forwarding Issue?]”

“You said the router changed. Do your domain resolve to a local address or your public ip? Since you mention port forwarding I assume they resolve to your public ip. If you are trying to reach these from the local network. What you need is hairpin NAT. Some router won't do this, others might require additional rules. Are you able to reach these services remotely but not when on your lan. Then it's probably hairpin NAT issue. [re: Help with Suspected Port Forwarding Issue?]”

“I'm at the end of my rope (and my Googling). I've had a server for years, and it's been fine. I've moved with it twice and only needed to update the IP addresses and add in the port forwarding. Again, always fine. I moved this third time, and now I can't connect to my domains. I can use my localIP:8096 and it connects to Jellyfin fine. Likewise, localhost:8096 connects fine. But when I go to my actual domain, it stalls out. The only thing I can think of is that it must be the”

“A forward to the gateway on 443 is refused by the bastion ( PermitOpen lists 6443, 50000 and 8200 on legacy egress). The docs now say so. Decide between an explicit opt in variable for extra permitted ports (default none) and moving the documented path to kubectl port forward . Not run on a cloud. Found during the 0.3.0 hardening work.”

“Since swapping the forwarders didn’t help, the FortiGate is the likely cause. The dns-udp session helper is optional, and removing it is a known fix for DNS traffic issues. Find its ID with show system session-helper and delete it. Keep in mind that wildcard FQDN objects rely on it. As a quicker workaround, run dnscmd /config /enableednsprobes 0 on each DNS server and restart the DNS service. Once it’s fixed, keeping an eye on it across several DNS servers can get tedious. EventLog Analyzer can”

“With FWH HOST set the wizard never opens, and compose falls back to 192.0.2.110 when it is empty. With that host unreachable, /api/setup hung for more than 60 s, the UI showed Connection Lost and the wizard stalled. Compose also defaults MQTT ENABLED=true with the dev broker host.docker.internal:1884 . Its header says to build with tools/build image.sh , while INSTALL.md says docker build . Workaround used: a docker compose.override.yml with FWH HOST= and MQTT ENABLED=false . Fix: compose works”

“I use a free playit.gg tunnel, and then I have a redirect in my DNS records that points my personal domain to the URL generated by playit [re: Deploying Pterodactyl with Cloudflare Tunnels]”

“[ Removed by Reddit ] [re: Octelium v0.29 - A Modern, Self-Hosted, FOSS Unified Alternative to Teleport, ngrok, Tailscale, Cloudflare Zero Trust/Access/Tunnel and remote access VPNs, now with Web Console for Management and Real-Time Monitoring, SIEM, DNS/TLS Management, SCIM, Encryption at Rest.]”

“Tailscale back to my own machine works until the power drops or i am on a bad connection. A VPS seemed cleaner. I wanted it up whether or not the laptop was. I started from price. The cheapest VPS for Claude Code that I could find was about $6 a month. On paper that was the whole answer. In 30 days I still had 3 mornings where it was just down, about 40 minutes each before it was usable. I have also read that some cheap provider IP ranges get blocked, so the $6 box may not even be allowed to sig”

“I successfully installed HA 12.4 on a Thin Client and I got the IP address page and everything. When trying to access the IP address + “:8123” on my desktop, it gives me a “site cannot be reached” page. Same when I try …”

“Sup, Is something like this possible in a secure way? Is there reliable enough, already made software out there to achieve this? Would you recommend this path, or do you have a better idea ? Background / Resoning: I currently use Tailscale to connect to my services, but I can't share my pictures this way with friends or family. A Cloudflare tunnel is also not ideal, since all the media would need to be streamed through them (usage limits and privacy). Finally, I don't want to expose any”

“No VPS. Pangolin runs in a VM on my own colo server with a public IP. No Newt tunnels, Traefik talks to the backends directly. Second instance at home behind DDNS. The VPS + Newt setup only really matters if you're behind CGNAT. Why not Caddy/nginx? They're reverse proxies, nothing more. Out of the box you don't get: - Auth. With Caddy/nginx you need Authelia/Authentik + forward auth. In Pangolin it's a toggle per resource. - ASN/country rules. nginx needs the GeoIP2 module, Cadd”

“On the note of Dynamic DNS, I'm a big fan of Tailscale. Super not the same thing, but the UX ends up being the same - ie on a private VPN i have custom domains with normal https. It all feels like a real domain, just not exposed to the internet - which is a selling point for me. You may have a reason why Dynamic DNS is important to you - i just wanted to list alternatives if you don't actually want public facing domains. Security is hard these days heh. [re: NameCheap Price Increases]”

“I am trying to get pterodactyl setup on my server but cannot get past setting up the actual node. I'm having issues with the remote url, if I put in my subdomain it sends a 302 html response instead of the expected json response. If i try to put in localhost I can get the "tls: failed to verify certificate | doesnt contain any IP SANs". I followed the pterodactyl documentation but could't get letsencrypt to work with cloudflare, so I found this tutorial which sets up the certs”

“Before Submitting [x] I searched open and closed issues and discussions for an existing request. [x] I checked whether this already exists on the dev branch or latest source. [x] I understand that maintainers want a well written issue or discussion before any code pull request. [x] This request is not a security vulnerability. Problem Direct Connections require CORS to be allowed from the open webui domain to work with external OpenAI providers. Some providers do not allow CORS from any webpage,”

“Hi everyone. On my home lab (Proxmox) I am running Caddy reverse proxy with ACME certificates for internal services. Right now the only open port on the OPNsense firewall is for WireGuard. I would like to also expose my Jellyfin instance to a friend (for a hassle-free use on LG OLED TV), but keep it as secure as possible without getting a separate VPS. Jellyfin now is on a trusted VLAN (but not on a management VLAN). My current ideas are as follows: Expose uncommon TCP port to the internet, and”

“Hello! I'm not the best at networking, but my dreams were crushed tonight by the multiple layers of routing from my apartment building and the CGNAT from my ISP. I purchased a VPN that supports port forwarding, and have been given a public port to use. I'm not privy to the exact security ramifications, but seeing as the launcher features matchmaking and already attempts to punch though, would it be possible to specify this port in the launcher so that other people could connect to me using this”

“That registry tip is a good call, saved me once when DNS service just refused to bind. Already tried the netstat and port 53 is free, but the service itself won't start, just crashes with that 1067 error and points at 127.0.0.1 in event viewer. I think the interface binding got messed up after the network service permission fixes, maybe I missed something in the ListenAddresses key anyway. I'm still leaning towards S1 being main problem cause it for sure decommissioned 10/3, agent was of”

“I’m leaning towards booting up a new server and migrating. this, that server is serioulsy fucked, i am fairly certain its not a DNS or DNS service issue [re: Please help; I have no idea what to do an I know it’s DNS]”

“I'm quite familiar with what you said about developing on docker and only tunneling the hostname dedicated for user only. I would try to learn about tailscale becaused its seem more flexible (last time i only make it closed to public for admin page). Anw thanks! [re: How to safely Create Local Computer act like VPS for alternatives of Cloud VPS server.]”

“That's putting it audit mode, so it's working again. But what are the negatives? That's legacy, right? Was it still being used with an enterprise PEAP wifi set up? There's the BlockNtlmv1SSO 0 registry fix but what's that leaving vulnerable by doing that? And KB5127648 is putting that in enforced mode? Is that correct? But it's breaking something with PEAP? I would think Microsoft will have some fix coming out soon. That's thinking more on the client/user side. BlockN”

“For me the server side setting didn't help. My NPS for WiFi is set up with PEAP - EAP-MSCHAP v2 on Server 2022 (yeah yeah it's planned to change it to EAP-TLS). On the server I just set the Enable NTLMv2 Compatibility DWORD to 1 in HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\RemoteAccess\Policy. Then restarted the NPS service. Then set BlockNtlmv1SSO to 1 on my Win11 client. Got the same auth error in system events. ID 5632 - Explicit Eap failure received (0x50005) [re: Patch Tu”

“to back up what u/squarecmb said in their comment, the issue with qbittorrent is specifically documented in the gluetun wiki: https://github.com/qdm12/gluetun-wiki/blob/main/setup/advanced/vpn-port-forwarding.md [re: Super slow torrents when using qBittorrent + Gluetun.]”

“I recently started a home server (HA, Jellyfin, and Pihole) using an old laptop with a broken screen and a faulty battery. I removed the screen and battery, so I do not have power backup (core information to my question). Since it is a laptop, the BIOS does not have the option to turn on when power is detected. In the case of a power outage, how do I force a startup? Additional information: I'm planning to 3D print a case and move the motherboard, and it won't have the keyboard after tha”

“Acceptance criteria [ ] bp cloud instance env get|set|unset <instance <KEY [value] goes through the control plane to the box, with an allow list of tunable keys [ ] Changing a key restarts the box with zero downtime the way a deploy does, and the change is recorded in the instance's history Task: task 8ad230d0b1503edf”

“The "Not yet verified" callout under Internal VCF components must bypass the proxy says that after excluding the License Server, a plain curl v should connect directly "with no localhost:1082 CONNECT ". That contradicts the section's own explanation of the 9.x local proxy service: the shell's https proxy always points at localhost:1082 , and no proxy exclusions are applied inside vmware envoy system proxy , after curl has handed the request over. Field observed 2026 10 13: with the License Serve”

“I am my own ISP, so IXPManager helps a load with managing my peerings to other networks. Overkill? Yes. Useful? Yes [re: Which small self-hosted service has stayed useful after the novelty wore off?]”

“Dear all, Thank you so much for this great piece of software. I host this behind haproxy. Currently it requires a subdomain (e.g. llamaswap.example.com), because folders like /ui are hard coded. In order to simplify my setup and certificate management, I would like to host it in a subfolder (e.g. example.com/llamaswap) instead of a dedicated subdomain. Llama server already allows this using the prefix option. Could you kindly consider doing this for llama swap? Thank you so much! Alex”

“Is there an existing issue for this? [X] I have searched the existing issues OS/Web Information N/A Steps to Reproduce You can simulate with this NGINX config: Expected If your origin is https://domain.tld and your host is domain.tld:443 the check should pass. Same for http://domain.tld and domain.tld:80 . Also I think NGINX's $host actually does not include ports so it will fail if your config only has $host and if you host on a port other than 443 and 80 since you would get an origin like http”