Selfhosted

39435 readers

3 users here now

A place to share alternatives to popular online services that can be self-hosted without giving up privacy or locking you into a service you don't control.

Rules:

Be civil: we're here to support and learn from one another. Insults won't be tolerated. Flame wars are frowned upon.
No spam posting.
Posts have to be centered around self-hosting. There are other communities for discussing hardware or home computing. If it's not obvious why your post topic revolves around selfhosting, please include details to make it clear.
Don't duplicate the full text of your blog or github here. Just post the link for folks to click.
Submission headline should match the article title (don’t cherry-pick information from the title to fit your agenda).
No trolling.

Resources:

Any issues on the community? Report it using the report flag.

Questions? DM the mods!

founded 1 year ago

MODERATORS

[email protected]

Why VPN tunnels are safer than opening a port on my router? (self.selfhosted)

submitted 5 months ago* (last edited 5 months ago) by cheddar to c/[email protected]

34 comments fedilink hide all child comments

Hi!

I often read suggestions to use something like Tailscale to create a tunnel between a home server and a VPS because it is allegedly safer than opening a port for WireGuard (WG) or Nginx on my router and connecting to my home network that way.

However, if my VPS is compromised, wouldn't the attacker still be able to access my local network? How does using an extra layer (the VPS) make it safer?

you are viewing a single comment's thread
view the rest of the comments

[–] Netrunner 9 points 5 months ago* (last edited 5 months ago) (1 children)

Wireguard doesn't send anything back if the key is not correct.

Because of this, Tailscale port swapping is inconsequential vs wireguard here.

Tailscale transfers trust of your VPN subnet to a third party, which is a real security concern.

I agree SSH service will be attacked if they are plainly exposed, out of date and allow login challenges.

Also agree that under or misconfiguration is a massive cause for security issues.

[–] [email protected] 2 points 5 months ago* (last edited 5 months ago)

Yes, WireGuard was designed to fix a lot of these issues. It does change the equation quite a bit. I agree with you on that (I kind of hinted at it but didn't spell that out I suppose).

That said, WireGuard AFAIK still only works well with static IPs/becomes a PITA once dynamic IPs are in play. I think some of that is mitigated if the device being connected to has a static IP (even if the device being connected from doesn't). However, that doesn't cover a lot of self hosting use cases.

Tailscale/ZeroTier/Nebula etc do transfer some control (Nebula can actually be used with fully internal control and ZeroTier can also be used that way as well though you're going to have to put more work in with ZeroTier ... I don't know about TailScale's offering here).

Though doing things yourself also (in most cases) means transferring some level of control to a cloud/traditional server hosting provider anyways (e.g, AWS, DigitalOcean, NFO, etc).

Using something like ZeroTier can cutout a cloud provider/VPS entirely in favor of a professionally managed SAS for a lot of folks.

A lot of this just depends on who you trust -- yourself or the team running the service(s) you're relying on -- more and how much time you have to practically devote to maintenance. There's not a "one size fits all answer" but ... I think most people are better off doing SAS to form an internal mesh network and running whatever services they're interested in running inside of that network. It's a nice tradeoff.

You can still setup device firewalls, SSH key-only authorization, fail2ban, and things of that ilk as a precaution in case their networks do get compromised. These are all things you should do if you're self hosting ... but hobbyist/novices will probably stumble through them/get it wrong, which IMO is more okay in the SAS case because you've got a professional security team keeping an eye on things.