I have a wireguard tunnel set up between my home server and the VPS, with persistent keepalive. The public domain name points to the VPS, then I have it set up (simply using iptables) so that any traffic there in port 80 and 443 is sent back to my honeserver and there it’s handled by caddy, and sent to the actual service.

The only ports I need to open are 80 and 443 on my VPS to make this setup work. So, no open ports on my local machine. This does however require you to pay for VPS. Since you aren’t doing much on it though, you can get away with a cheap one. I have a $12/year VPS from Rack nerd that I use for this job.

For completely free options, you can do one of three things. (That I can think of. There are probably more ways.)

1. Either open up some ports on your machine. You’ll need to make sure that you aren’t behind a CGNat for this. I simply don’t like opening ports to the internet, though.
2. You can use a VPN. Tailscale works great for this. I use it personally for sshing remotely into my machines.
3. You can use cloudflare-tunnels. Potentially bad privacy-wise since they can technically access the data. So don’t use it for sensitive stuff. Also, their policy doesn’t allow traffic that’s not mostly HTML. So something like a Jellyfin server would violate this. But you do get to use their firewall which is great for protection against DDOS attacks.

P.S. If you need help setting any of these up, lmk.

Try to scout opening ports on your modem. CloudFlare tunnel plus traefik reverse proxy is an option you can go.

There are many how-to guides like Jim’s Garage that walk you through setting it up.

Acronyms, initialisms, abbreviations, contractions, and other phrases which expand to something larger, that I’ve seen in this thread:

[Thread #695 for this sub, first seen 21st Apr 2024, 07:55] [FAQ] [Full list] [Contact] [Source code]

I used to open and NAT porte on my modem. Got put behind CG NAT, so now I run Wireguard tunnel to free VPS.

It’s easiest to just register a domain name and use Couldflare Tunnels. No need to worry about dynamic DNS, port forwarding etc. Plus, you have the security advantages of DDoS protection and firewall (WAF). Finally, you get portability - you can change your ISP, router or even move your entire lab into the cloud if you wanted to, and you won’t need to change a single thing.

I have a lab set up on my mini PC that I often take to work with me, and it works the same regardless of whether it’s going thru my work’s restricted proxy or the NAT at home. Zero config required on the network side.

My advice is to just use Tailscale. It’s a 5 minute setup and you get access to your stuff from anywhere, securely, without opening ports to the public internet. It will give your server a second IP address, which you will be able to access from any other device which is also registered to your Tailscale account.

My personal setup:

• Tailscale installed on all devices that need access to my home lab
• Custom domain with root A record set to server’s Tailscale IP
• caddyserver reverse proxy on server, with DNS https authentication configured (regular http with won’t work because it’s not on the public internet)
• services all on subdomains

I used to use Wireguard with Authelia, then I switched to Tailscale (with a self-hosted Headscale server), and now I’m trying out Netbird (which is open source btw)

Mhh I don’t know if I can help you too much. I initially followed spaceinvader ones tutorials for my unraid machine. But with time I changed from swag to nginx proxy manager. And I changed from using a duckdns docker to a router based dyndns tracker. But honestly I don’t remember too much from the process I currently try to switch domain but just can’t get them to work :D so I am in a smilar spot like you.

If you are the only one using the services, then go for a VPN instead of port forwarding or sth. This way, your stuff isn’t openly accessible from the internet to anyone poking around

My IPv4 connection uses CGNAT, so I use a VPN to access my server. I also have IPv6, so I have a couple of things directly accessible over it in case the VPN drops for some reason. I do have dynamic DNS set up, although it’s not really necessary. My IPv6 prefix doesn’t seem to change unless I change the DUID on my firewall.

I assume you want to access a self hosted service on your local server from the Internet.

To make the service accessible from the Internet multiple things are required:

• the router can be accessed from the outside. Find your public IP in the router or use a find-my-ip website. Better: do both. This is the address you can use to access your router (or whatever service you choose to expose through it). Side note: If the Ip-adresses of your router and the one of the find- my- ip- site are different it could mean that your provider uses CG-NAT (because ipv4- addresses are scarce, the provider doesn’t give you a real publicly accessible address). This means you can’t access your router from the Internet. Try IPv6 or contact your provider to get a publicly accessible ipv4- address.
• because the above mentioned IP- address of your router might change, dyndns is used. Configure it in your router and test it. Test if the DNS- name you have set up resolves to your ip- address (nslookup or ping it).
• to make your service available to the Internet you need to configure port forwarding in your router (or add your server as exposed host - means all ports are forwarded to the Internet). This means the router passes request to itself on to your internal server. Careful: everybody can access whatever services you expose. Advice: it’s a good idea to use a VPN. Setup a VPN-server in your Lan and only port-forward its port in the router. Connect to the VPN from the outside - Afterwards use the internal services through the vpn- connection.
• scripts and the internal ip: the dyndns name needs to be used instead of the IP. Find a way to make the scripts use that name to resolve it to your external IP.

Im using wireguard VPN. You have to setup VPN server (using your DynDNS address, but duckdns in my case), open wireguard port in your router and configure each device that needs access. Reverse proxy is not needed, but I have it so I can use jellyfin.example.com instead of 192.168.100.40:8096. I use NPM (nginx proxy manager) with awesome GUI that can create lets encrypt certificates. I also use piHole for local DNS server

If it’s only you (or your household) that is accessing the services then something like hosting a tailscale VPN is a relatively user friendly and safe way to set-up remote access.

If not, then you’d probably want to either use the aforementioned Cloudflare tunnels, or set up a reverse proxy container (nginx proxy manager is quite nice for this as it also handles certs and stuff for you). Then port forward ports 80 and 443 to the server (or container if you give it a separate IP). This can be done in your router.

In terms of domain set-up. I’ve always found subdomains (homeassistant.domain.com) to be way less of a hassle compared to directories (domain.com/homeassistant) since the latter may need additional config on the application end.

Get a cheap domain at like Cloudflare and use CNAME records that point domain.com and *.domain.com to your dyndns host. Iirc there’s also some routers/containers that can do ddns with Cloudflare directly, so that might be worth a quick check too.

I do it the simple way. I just stick nginx in front of everything. If I don’t want it to be publicly accessible I stick nginx basic auth in front of it.

The advantages is that I can easily access the services from anywhere on any device with just the password. I only need to trust nginx’s basic auth to keep me protected, not various different service’s authentication.

The downside is that some services don’t work great when you have basic auth in the front. This is often due to things like public links or APIs that need to be accessed with other auth.

I just use nginx because I’ve always used it. I’ve heard that there are newer reverse proxies that are a bit easier to configure.

Wireguard, simply connect to it whenever I’m out somewhere and boom, instant access to everything on my local network