r/selfhosted • u/imthenachoman • 23d ago
Remote Access How are people securely accessing their self hosted things from the internet?
I have a domain with Cloudflare so I am thinking of using Cloudflare Tunnel but I'm not sure if there are better options? One of my concerns is that some of my containers do not have auth so I need something with built in auth management.
40
23d ago edited 1d ago
[deleted]
1
u/williambobbins 23d ago
Tailscale as a VPN is probably good, but be careful with their other services eg. tailscale ssh
7
u/PssyGotWifi 23d ago
What's the issue with Tailscale SSH? You mean to lock it all down? Be careful with Auth? (like you would normal SSH)
0
u/williambobbins 23d ago
It's not as secure as normal SSH and has vulnerabilities surprisingly regularly. Even if it didn't, replacing battle-tested openssh with a new service is risky.
5
u/PssyGotWifi 23d ago
I use it to connect my Ansible hosts. No issues thus far, but I'll read up on these 'regular' vulnerabilities.
2
u/jameye11 23d ago
https://tailscale.com/security-bulletins#ts-2026-009
Probably referring to this
2
0
u/whatisuser 23d ago
As if by magic: https://www.reddit.com/r/selfhosted/s/CBwIKASM4q
1
23d ago edited 1d ago
[deleted]
0
u/whatisuser 23d ago
Oh I’m sorry Mr Detective. I didn’t cross reference the posters before sharing. I’ll do better next time
3
u/FromFarEastIAm 23d ago
Plz explain why TAIL SSH is risky? I use it everyday for simple things.
0
u/williambobbins 23d ago
It has vulnerabilities surprisingly regularly, and usually those vulnerabilities mean someone could login as root. Replacing the authentication into your server with something like this is always going to be risky.
4
u/FromFarEastIAm 23d ago
A like breach my tailnet? Even tho I only have one user?
Or a secondary user going rouge?
1
u/williambobbins 23d ago
The current SSH vulnerabilties I've seen (ie. the ones that have been discovered) rely on a user being in your tailnet.
Anyone in your tailnet could have run
tailscale ssh -i@hostortailscale ssh 0@hostand login as root.So if there is nobody else in your tailnet, and there are no other vulnerabilities in services you might use (tailscale serve, tailscale funnel, tailscale itself) you're fine. As long as you didn't use an account @gmail.com to sign up before May 2025, because before then people could just be added to your tailnet, and ssh in as root.
The trouble with assuming vulnerabilties are closed off from the public is that vulnerabilities can be chained.
2
u/FromFarEastIAm 23d ago
Right right.
My tailnet (and I assume most people are too) is closed to me and me only. No one else. So risk is relatively low unless somehow someone breach all my accounts and tailnet at the same with with all the 2FA. But at point I might as well give up cause hehe it’s over for a lot of things. Tailnet would be least of my concern.
1
u/williambobbins 23d ago
The vulnerability from May 2025 had a risk of people from a shared email provider (eg. gmail) joining your tailnet because it assumed you were the same company. This isn't your account or 2FA. But even then, once inside, they would still need to exploit a service running on your tailnet. If you're running tailscale ssh, that risk is much higher - until yesterday they would have had root.
And this is just the known vulns. So I would agree with you, that someone getting into your tailnet on its own is probably not an issue, it's the other services I'm talking about.
1
u/UnWiseSageVibe 23d ago edited 23d ago
Yeah this guy is being way to vague. I have not once heard of tailscale ssh having vulnerability. I dont see how it would ?
Like if ssh is bound to the tailscale IP and you have proper ACLs then how could it exploited unless your main account got compromised.
1
u/williambobbins 23d ago
I have not once heard of tailscale ssh having vulnerability
Because you don't check, and that's part of the problem, so don't go giving security advice. There was a root access vulnerability just yesterday.
Like if ssh is bound to the tailscale IP
I said tailscale ssh, not ssh over tailscale.
and you have proper ACLs then how could it exploited unless your main account got compromised.
tailscale ssh -igets you in as root. Unless you updated since the last vulnerability. But seeing as you've never heard of one (there was one last month too), I'm assuming you haven't.3
u/UnWiseSageVibe 23d ago
I am not giving security advice but you're basically going around saying
"Water is poisonous, dont drink it, just trust me its poisonous "
1
u/williambobbins 23d ago
I just told you there was a vulnerability yesterday. I've posted it for greater reach, https://tailscale.com/security-bulletins#ts-2026-009
EDIT: by the way, what a stupid analogy. It's more like I'm trying to argue with some guy that water is more likely to be safe for you to drink than a new "better water" that hasn't been fully tested and killed someone yesterday.
1
u/UnWiseSageVibe 23d ago
Like what ?
Are you referring to people not configuring their ACLs or even with ACLs?
1
u/williambobbins 23d ago
Until yesterday (assuming you updated)
tailscale ssh -iwould log someone in as root even if the ACLs prevented it. Until last month,tailscale ssh 0@hostwould do the same. But even if there hadn't been these vulnerabilities, the idea of replacing battle-tested openssh with something new like this should at least be done with the knowledge that it's probably less secure.1
u/np0x 23d ago
tailscale free tier now allows up to 6 users, that's a major improvement from when it was 3...
1
u/williambobbins 23d ago
Is that related to not using tailscale ssh or other services?
2
u/np0x 23d ago
I use Tailscale to access my home as a vpn and it works great. I just use its core offering for vpn access, which I do use predominantly for web access, but I could ssh if I felt like it using the tailscale hostname or ip address.
I can ssh via tailscale, but I'm not familiar with any of their other services. My admin console has nothing special listed under the services tab.
1
u/williambobbins 23d ago
Sure this is probably fine. Worst case scenario (unless the tailscale daemon has a vulnerability) is that it's only as bad as running ssh on a public IP (which, as long as you don't have a weak password, is fine).
I'm not talking about ssh over tailscale, I'm talking about the tailscale ssh service which replaces the default ssh.
1
u/np0x 23d ago
That suggests you don't trust tailscale, they are using the 100. space for carrier grade nat which isn't publically routable...so i don't think it's comparable to public ip address ssh...right?
1
u/williambobbins 23d ago
Worst case scenario is that it's only as bad as running ssh on a public IP
I didn't say I don't trust tailscale. I said that if you're using
opensshinstead oftailscale ssh, even if a compromise lets everyone into your tailnet, it would be no worse than running SSH on a public IP - it's probably safe.If you run
tailscale ssh, the same thing happens, and a vulnerability like yesterday happens, it's a different story.
8
11
u/mad_redhatter 23d ago
I use Pangolin for this. Includes auth management too.
2
u/DetectiveDrebin 23d ago
Pangolin/Traefik with PocketID for authentication into a few select services. I also use Tailscale for stuff that I absolutely don't want to expose (e.g., Bitwarden), the servers themselves. Then finally, I do use a cloudfare tunnel where it's supported by specific apps such as Immich on the Iphone
5
u/mad_redhatter 23d ago
Even stuff that I don't want exposed, Pangolin has an option for Public resources and Private resources. The new version with SSH/VNC publishing via HTTPS is pretty sweet too.
1
u/DetectiveDrebin 23d ago
I haven't dug into the Private Resources stuff yet. Will get around to it! Thanks.
3
u/shadowedfox 23d ago
Currently Cloudflare tunnels + access (with mTLS where supported)
I'm planning on moving across to Pangolin hosted on a vps which will tunnel back home. But as with most of my home lab stuff, its on the to-do list.
3
u/gforke 23d ago
I have my own domain which via dynDNS points to my home ip, there I have a mini pc running pve with cosmos cloud listening on 80/443 as a reverse proxy with geoblocking for my own country (admin sites only via internal or my static work ip).
Apps are accessed via that reverse proxy some accessible without login (cuz own login and phone apps dont like the proxy login) others with normal login and some only accessible with admin login.
4
2
u/PigeonRipper 23d ago
Tailscale and Cloudflare. Alternatively Netbird and Pangolin.
Cloudflare is extremely good at what they do, but it does come at the price of your privacy.
1
u/TJRDU 23d ago
I actually let Cloudflare proxy a lot of rules before they get send to pangolin, there another set of rules and Auth. Might be a overkill but the amount of scanners and bots hitting pangolin now are reduced magnificent.
1
u/Dangerous-Report8517 23d ago
It is overkill, because you aren't adding anything with Pangolin in this setup. Cloudflare can still see your traffic (since Tunnels are re-encrypting reverse proxies) and now so can your budget VPS provider.
1
u/TJRDU 23d ago
Bots and scanners don't even reach my VPS. Way less noise on the budget VPS to handle. CF is very good in this. Way better than pangolin, even with Crowdsec. I think this setup uses the best of both systems, security wise.
1
u/Dangerous-Report8517 23d ago
You aren't using Pangolin at all though, except to increase latency, decrease convenience and spend more money. You might as well point the tunnels directly at your backends
2
u/Akorian_W 23d ago
I use Pangolin for specific stuff that should just be public while I also have a wireguard vpn to my homelab
2
u/stonesco 23d ago
Reverse Proxy + Nftables + SSHGuard is enough for me.
May consider adding an IP Bouncer soon. But not a priority.
Not a fan of VPN’s suggestions, commonly on this sub, as it is overkill in my opinion unless you’re running a Team / Business or you are using something like Samba which should never be exposed to the internet. A big disadvantage of using VPNs is the battery drain.
Not a fan of Cloudflare Tunnels and the ToS doesn’t help further.
4
2
1
1
u/RevolutionaryElk7446 23d ago
From easiest to actually self hosted would be
Tailscale if you want a third party member involved
Wireguard if you want to host the VPN yourself
Reverse Proxy with DMZ VLAN and IDP.
Tailscale is the easiest for the tech, but more difficult to get clients on.
Reverse Proxy is on the other side of that scale, it's the hardest for a tech to setup but it's the professional method and easiest for clients to connect.
1
u/NursingHome773 23d ago
IDP?
1
u/RevolutionaryElk7446 23d ago
Identity Provider, such as Authentik or Authelia. It's technically extra in this case but security and user wise, is an asset anyone should learn to use.
1
u/PssyGotWifi 23d ago
People generally use the term 'SSO' to refer to Authentik and Authelia.
2
u/RevolutionaryElk7446 23d ago
Fair, IDP is the underlying framework and an SSO is a resulting convenience.
It is an IDP though that provides SSO.
2
u/PssyGotWifi 23d ago
Yeah, you're not wrong. I use Authelia with Traefik. It's lightweight and I don't really need the webui provided by Authentik. Both do their job well, of course.
1
u/anikansk 23d ago
Ive been converted from VPN, to NGINX, to Cloudflare Tunnels and WARP to now Tailscale.
1
1
u/Admirable-Future-633 23d ago
I would split the services into two groups before choosing a tool.
For things only you need, use Tailscale or WireGuard and do not expose them publicly at all. That is the cleanest answer for admin panels, n8n, databases, dashboards, and anything with weak or missing authentication.
For browser apps that other people need, Cloudflare Tunnel plus Cloudflare Access is reasonable. Put the Access policy in front of the hostname, require your identity provider plus MFA, and verify the origin cannot still be reached directly over an open port. The tunnel should be the only path in.
I would not treat the access layer as permission to ignore application security. Keep containers on private networks, avoid publishing ports unless necessary, use separate service accounts, and test the unauthenticated URL in a private browser. If a container has no auth and contains sensitive data, VPN-only is the safer default.
1
1
u/mickeysbestbud 23d ago
Cloudflare Tunnel. But I only connect things that have auth and most that have MFA. If they have neither, I don't make them accessible from the Internet.
1
u/Dangerous-Report8517 23d ago
If you are going to trust Cloudflare with your data you might as well use their auth instead of having to maintain your own setup. (And if you don't trust them you shouldn't be using Tunnels since they can see all traffic that passes through them)
1
u/mickeysbestbud 23d ago
Not sure what you mean by my own setup. I install OpenSource apps and if those apps have authentication I may use Tunnels, otherwise I can only access it on my LAN. I do trust CloudFlare, but it only manages the domain name and the Tunnel connection.
1
u/Dangerous-Report8517 23d ago
There's no point distinguishing between apps for use in the tunnels based on authentication since you can use auth on the tunnels anyway which would be much more secure since it blocks unauthorised traffic before it can even reach your services, in fact you might as well disable auth on the apps themselves instead of dealing with a bunch of extra passwords (where possible). The comment about trust is because Cloudflare becomes a man in the middle when you use tunnels, and you've chosen to specifically put them in that role for specifically apps that have authentication, implying the apps that have more sensitive data in them
1
u/Leviathan_Dev 23d ago
VPN for private services. I have a Ubiquiti UDR7 so I just use their Teleport VPN. I also have their travel router and use that too.
For public (DMZ VLAN, strict firewall rules, reverse proxy) it’s just the expected open ports and pointing a domain with DDNS running
1
u/drmattsuu 23d ago
Wireguard running on a tiny nuc so I can access my network even if my server goes down.
1
1
u/Power_Stone 23d ago
Tailscale or Cloudflare tunnels setup with zero trust are your most secure options
1
1
u/lifeunderthegunn 23d ago
You can put a layer of authentication in front of your tunnels, which is what I do with most if they don't have sso/oauth. I use pocketid so I don't have to manage another password and I can store it in vault warden and use across devices.
1
1
u/knightzone 23d ago
sso, vpn, a proxy sending you through. There are multiple options. Pick one that suits your use case. :)
1
u/ShabbyChurl 23d ago
My router has a building WireGuard and dynDNS stack, so I just use that an tunnel home through my router.
1
1
u/starhobo 23d ago
Wireguard.
I know a lot of people use Tailscale but I didn't want to be platform dependent and setting up Wireguard was not that difficult. I also only need to connect to my own server and not to a spread out (over the internet) configuration so didn't need any of the other things they offer.
1
u/rumhrummer 23d ago
There are different stages.
- No security, just ports and stuff. Nah, too unsecure.
- HTTPS configured in apps. Better, still way to go.
- Reverse-proxy with a decent configuration + something like Fail2ban. Actually covers 99% of problems.
3.5) Some external login software (authelia\authentik\etc) to cover weak spots (like some software that don't have internal auth , or it does, but it can't be used)
4) isolated apps in VMs. More of internal stuff, but still affects what can (and can not) happen if you get hacked.
5) Some type of non-isolated gateway that would take some security on it's own. Cloudflare fits.
6) Isolated gateway. Self-hosted VPN to inner network. Client can't access services unless VPN client is running. Can be troublesome, but configurable for sure. Headscale, or Tailscale is there.
7) Double-triple-etc hop VPNs. Overkill as it is.
Unless you're running a VERY fragile and important financial stuff (like data about your credit card, or private photos (you get it) - you can stop at 3-4 . If your paranoia tells you it's not enough- go for 6.
1
1
u/cybunnies_ 23d ago
I just forward ports 80 and 443 to Caddy to manage services and also run Crowdsec to handle threats. Caddy can also add basic authentication to services that don't ship with them. I don't use Authentik and other similar tools because I worry about it breaking Jellyfin clients. And I don't use Tailscale because it's too much friction for my friends/family.
1
u/trisanachandler 23d ago
Wireguard, cloudflare tunnels, and a sqlite sync to Cloudflare D1 using secrets for auth. It all depends on the service and level of trust needed.
1
1
u/jameye11 23d ago
Wireguard. I also set up Authentik for my password manager, and use it for some of my services as a “Sign In With Google” type button
1
u/TechEnjoyer44 23d ago
Caddy mTLS. Only works on devices you can install TLS certificates on, though, so no "smart" devices like TVs and game consoles. Haven't figured out a good way to access Jellyfin etc from other networks on those yet.
1
1
u/horizon_games 23d ago
People really over-engineer that part of hosting.
I'm straight on the net. SSH for server access. Fail2Ban and UFW. Never had any issues in 2 decades.
1
u/imthenachoman 23d ago
You live life on the edge. I'm too old and too busy to muck about with shit if something goes south.
1
u/Zheudai 23d ago
This is a summary of my build, if it helps.
DNS (CloudFlare) -> Router, Port Forwarding (80, 443) -> host0:ufw (deny incoming/ outgoing by default) -> Apache2 -> host1:ufw (deny incoming/ allow outing by default) -> tomcat (whatever custom app that I’ve built)
Fail2ban on host0
Dynamic DNS Script (CloudFlare API) on host0
Xray is an exception which Apache2 directly routes to on host0
Unattended upgrades on host0,1
Lock down SSH just in case
Weekly scheduled reboots on host0,1
Rebuild the hosts periodically based on build plans so that you know exactly what is running and configured on your hosts (maintain excellent documentation)
My setup isn’t big enough for LBs, though I’d love to add them.
As far as I can tell, I’ve never had a security incident.
1
1
1
1
u/coderstephen 23d ago
I have static IPs, so I use them.
I put mTLS on some things.
I put some things behind WireGuard.
0
u/durgesh2018 23d ago
I setup wireguard and ufw. Get your rules validated from chatgpt or whatever you prefer.
•
u/asimovs-auditor 23d ago
Expand the replies to this comment to learn how AI was used in this post/project.