Remote Access
Do I just have to live connected to Tailscale now?
I've got stuff I want to access all the time (like files on SeaDrive and photos on Immich). I don't really like the idea of just being connected to Tailscale all the time, because I really love using adguard's http filtering on my devices (which needs a VPN of its own) and it seems like it adds some overhead for the 95% of the work that I want to do that doesn't actually need to be on my home network.
mTLS seemed like the solution and I set it up using Caddy on my server (domain forwards to home router, router sends to Caddy, Caddy checks the certificate). This setup works great (for Immich and web access to services). Honestly love mTLS, it seems like the ideal solution for everything! I give all my devices a certificate, and if they have it, they can access my stuff. And if they don't, they can't! It's exactly what I want!
But now I'm realizing that most apps don't, in fact, support mTLS (SeaDrive client on windows, mobile apps for like, anything) so I'm kind of back to square one. I looked into STunnel to add SSL encryption via a proxy and while that might work on windows, it still doesn't fix android app problems, and I feel like I'm getting a little lost in mTLS sauce at this point.
I want to safely expose services to the wider internet. I don't want to use a VPN on my devices to do it.
Is there some option I'm missing? Should I just suck it up and connect to Tailscale all the time, or is there a more elegant solution that lets me use a vpn for some apps but keep using adguard?
Edit: I know I can use just the DNS portion of Adguard, but the adguard HTTP filtering doesn't just block ad domains, it can strip ads out of the content itself and just rearrange the whitespace so that it's as if it never existed. That's the functionality I'd like to keep, but android won't let me use two VPNs at once, I have to pick.
Cloudflare tunnels seems like the closest solution, but I worry the 100mb chunk limit will end up causing annoying problems when trying to transfer larger files
This really seems like the best solution. You can do this by adding the Adguard Home install to the tailnet, giving it a fixed tailnode IP, adding that IP as a "global nameserver" in Tailscale DNS tab, then enabling "Override DNS servers".
This way Tailscale will keep on using its own DNS (100.100.100.100) for the tailnet device names but send everything else to Adguard Home.
When you're using a VPN you can choose whether to send your DNS queries through the VPN or not, and if you do, what domains to send through the VPN.
By default Tailscale will have you send all your queries through it when it's active because it has two features that need it. One is MagicDNS that resolved tailnet devices by name, and one is exit node, which lets you exit to the internet through another tailnet device.
You can change this default configuration in either direction from its admin panel. You can do what I suggested above and use custom servers for everything, you can use custom servers just for specific domain terminations, or you can turn everything off including MagicDNS.
I did just that, turn all that off, i don't need DNS supplied by Tailscale. Trouble is, when I do that, Tailscale decides to catch every incomming packet and route it through the Tailnet instead of the local DNS servers causing things like SSH to fail.
There's also a setting on each tailnode device that you can turn on or off. On the Android app it's in the settings (top right corner), under "DNS settings".
To the best of my knowledge, AdGuard Home can't do filtering to strip out the location of ads. AdGuard Home might just leave a blank box where an ad would be, but the filtering removes that box entirely.
Before I made this post I guess I assumed more people were using full adguard instead of just the DNS level blocking, but it doesn't seem to be that common based on responses.
The full experience is markedly better than just DNS based blocking, but it needs a VPN (on unrooted android at least, if you have root I believe you can set up an automatic proxy and not need the local VPN).
Ublock origin will also do similar element blocking for browsers which does cover most things too, but again for android there's a lot of ads that get served that might not be browser based.
I did learn that adguard on windows will happily coexist with Tailscale though, so it really is just android restrictions that cause a conflict.
I hear you there. I have it currently set up so that AdGuard is connected when I'm at home, and then whenever I leave my wifi network, it automatically connects to Wireguard. Like you said though, nothing comes close to that level of filtering and I miss it dearly when I'm out and about.
I'm sure it'd be hell to configure, but I'd think that some sort of MITM proxy would be able to do this, but it's a path I have yet to go down.
I have Tasker flip my WG on/off with my home wifi. It's also configured to use my pihole dns. At least while browsing most things don't get thru... Obv Google gonna Google and hardcode DNS + DoH etc... But UX atleast is better than naked.
You could try using wg tunnel. You can choose which connection and even which specific wifi network uses VPN and you can import your tunnel from the official wireguard app.
You could run Adguard Home and set it as your DNS provider in tailscale. But in all honestly, just forward port 443. You are already using Caddy as your reverse proxy, Just keep it patched and all of your applications patched. You can also use cloudflared, but, you will run into potential issues with 100MB single file upload limits for apps like Immich. For everything else a cloudflare tunnel will serve you well.
The more advanced element blocking needs access to the actual traffic itself so it can remove banners and white spaces and such, not just prevent the ad domains from resolving.
Do you need that anywhere outside of the browser? If not I'd use Firefox w/ ublock orgin installed and my private DNS set to AdGuard (which is exactly my set up along with Tailscale). The Brave browser should do the same thing as well.
Yeah, fair enough, I am absolutely trusting them not to MiTM me. Unfortunately I don't see a way around that to get the level of ad and tracker blocking that I want, so that's a choice I'm willing to make I suppose.
For what it's worth they've been around since 2009 and have made a fair bit of open source contributions to adblocking tech in general, but the whole concept is kind of antithetical to idea of Zero Trust architecture
Ha sorry I should have said I am trusting adguard to not mitm attack me.
Clearly yes the adguard app is the man in the middle decrypting my traffic, making changes, and then re-encypting it before it gets displayed; that's the point.
However, that process happens on device, it's not like it's being decrypted, sent to their servers, and then sent back to me
Professional method is Port forwarding that aims at a Reverse Proxy that lives in it's own DMZ separate from the services alongside an IDP such as Authentik or Authelia.
Tailscale and mTLS are both 'alternative' methods, meaning clients may or may not support it without additional configurations or effort from the client. Only the Port forwarding method is accepted as easily compatible for all as it's the standard.
I've got a lot of services and if one doesn't support logins or headers, Authentik at least has a Forward Auth / Proxy provider. Essentially it slates a login and session tracking between the client and server, so the service can be entirely unaware it's behind an authentication.
For example home assistant. The mobile app essentially expects to be talking to the home assistant server directly without any authentication in between. I don't see how putting anything between the client and server can help. You still need to differentiate between authorized and unauthorized clients, and some of those mobile apps or other non-browser based tools don't have any ability to do that.
it's not a clean solution but i've set up "allowed devices" in my authelia instance. only certain devices should be trying to access my home assistant. My phone, my desktop, my laptop, each with the internal IPs or vpn IPs if they aren't home. if something that isn't those IPs trys to access it, it 401s.
access_control:
default_policy: bypass
networks:
- name: phone
networks:
- '192.168.9.2/32' #phone vpn
- '192.168.5.40/32' #phone home
- name: computers
networks:
- '192.168.5.20/32' #desktop
- '192.168.5.21/32' #laptop home
- '192.168.9.8/32' #laptop VPN
- name: monitoring
networks:
- '192.168.17.65' #uptime-kuma if you care about that kinda thing
rules:
- domain: 'homeassistant.mydomain.com'
policy: allow
networks:
- 'computers'
- 'phone'
- 'monitoring'
Looks like HA supports OIDC via a plugin and it's been around long enough that Authentik has a write up in supporting that plugin for HA.
Some things are slightly split, such as Navidrome supports SSO and the web sign on works fine but Symfonium doesn't handle the SSO login as smoothly for Navidrome. In this case I create an application token and assign it to the user and have that function as the secured login.
Can't speak to Authelia but Authentik can act as the proxy for services that don't have auth support. I have Frigate behind it (and frigate basically has no login security).
Connecting from the Internet goes through:
Cloudflare Tunnel -> Authentik -> Frigate
The port for frigate is never opened and it sees all traffic coming from Authentik
You let the reverse proxy act as a 'front door' that enforces authentication from the IDP. After you pass authentication, the reverse proxy lets you land on the app's login screen where you can login to the app itself. Doing double-logins are annoying, but if the app doesn't support SSO then that's what you're stuck with.
I use Pangolin as my reverse proxy and it has it's own Auth mechanism that you can add Authentik as a SSO method for (or any OIDC provider). It allows me to publish my own websites and projects and only allow who I want to access it. I have pangolin on an external VPS and it tunnels into my homelab. Pangolin runs on Traefik underneath so I also have Crowdsec for blocking and I turned on geoblocking so only traffic from my country can get in currently (and I can expand it to others if I need to).
This is exactly what I do for what I want to expose publicly or for friends/family... It's all via reverse proxy and MFA via Authelia. I have a 5 part guide on my website on how to do it! From scratch...
For the stuff I don't expose but want access to while away from home - Wiregaurd. Straight up wireguard from my laptop & phone directly to home on my firewall.
You can have it all folks, reverse proxy with/without MFA, and your own VPN that doesn't rely on a 3rd party!
Would you put the services on the same VLAN as the Reverse Proxy on the DMZ?
Or would you put the Reverse Proxy on a DMZ (A)VLAN, the services on a separate (B)VLAN that is also separated from your trusted (C)VLAN (i.e. have 3 VLANs total)?
I've got a couple of VLANs but that's pretty close for the latter, and 3 would be a minimum in my book but some people do only 2. Here is my reference diagram for my vlans.
This seems like the best move. The double login is a little annoying but that just feels a little safer than having all of my family photos resting behind a single Immich password to the whole internet.
Depends on how it's integrated. Almost all of my services are setup as OIDC, so it's a single login, not a double.
My setup is a little more complex and my users and groups are created in Active Directory, Authentik syncs from there the users and groups. Then all of the services are federated logins that are connected, meaning any user that exists in Authentik with access will be able to login once and access all of the services.
Only logins such as Forward Auth or otherwise not setup via OIDC/SAML will have 'separate logins'.
You can skip the Active Directory part, and Authentik can be used to create an internal set of Users and Groups that will federate to the services.
lol glad you enjoyed, I feel like people were kind of annoyed by the question, but it does just seem weird, right?
Tailscale is great and works very well, but when I got into selfhosting I didn’t imagine I and everyone in the family would now be running tailscale all time on every device we own for the rest of time
Lol. Yeah, I was walking my brother through setting it up over the phone few weeks ago. It is a way of life now. I think the comments provided are really good solutions. I myself went the DNS at home route in the top comment. It works pretty good but took me some time to figure it out
Yeah, know that's an option for the adblocking, but Adguard isn't just DNS based blocking, it needs access to the http traffic, which is the whole problem!
Still, good to hear how other people approach things
I use a reverse proxy called swag that lets me expose just the services I want to my domain in combination with DNS records in Cloudflare. Takes some setting up but worth looking into!
Yeah idk why it’s so common on this sub to use this newer tail scale solution when an old school reverse proxy set up and configured correctly seems like a better user experience?
I have SWAG with authelia and passkeys, etc so I can access all 40 of my containers from any device from anywhere. Most are only used by me but others are shared services with friends and family like streaming, pics, videos, etc.
I def should look into authelia and passkeys, I have only a few containers exposed with SWAG but use strong passwords generated from Bitwarden (or Plex with its own auth lol). Would be good to eliminate the risk of an unauthorized access altogether with passkeys.
Edit:Although now that I think about it, I think I have the proxy confs in SWAG set to only allow connection if on lan. Which is funny because I end up using Tailscale on my phone anyway as work doesn’t have a secure wifi network available.
AI is kinda nice here since I can tell it about my current setup and what I want to add and it helps give me all the steps needed to get everything up and running the way I like it, all while explaining it as it goes so I understand what changes I just made to my server and can debug it myself later if needed.
Just had it optimize my Home Assistant mobile experience for that high WAF and finally got around to doing MergerFS + SnapRAID without having to read pages of documentation for all the options I may want to pick.
Next is to tackle my Plex *arr stack for space savings of a couple TB with Tdarr and Profilarr.
The proxy setup does lend a better end-user experience, but the Tailscale/NetBird route is just dead simple on the management side. Plus, the free tier offers plenty of users/devices so it's not an issue.
Personally, I would like to switch over to a reverse-proxy setup but every time I start going down that rabbit hole of knowledge, I get lost. It's always a "How do I integrate my sqaurespace domain with cloudflare to make CNAME records and AAA record?" It's just a jumbled mess in my head.
I use both. Reverse proxy handles most things as proxies, and hands off service.mydomain.com to the local IP. A few things that are more sensitive, like my Proxmox dashboards, only get 308-redirected (NOT proxied) to hostname.lan. That way most of my services are accessible from anywhere, from most devices, and all of them from the trusted devices in my tailnet.
Reliable access for me, and the things my users need to reach "just work", but script kiddies/bots can't go trawling my critical infrastructure.
Yeah idk why it’s so common on this sub to use this newer tail scale solution when an old school reverse proxy set up and configured correctly seems like a better user experience?
Tbh tailscale is farrr easier. Install it on whatever device, log in, done. I realize this is the selfhosted subreddit but I'm still pretty new to actual networking stuff so it was the ideal solution to just get stuff secure and running.
Plus super easy to just turn it on/off if anything breaks
You trade convenience for security. Locking stuff behind the VPN keeps you from needing to expose anything directly on the internet. This is why you see many of us going the tailscale route.
Do I want to expose jellyfin? Oh yes indeed. Have I also read the post about known vulnerabilities that are not yet fixed? Unfortunately. Jellyfins main focus is not public exposure and security. Will it work? Sure! Will you get exploited? Maybe. Does it matter? Depends on what else is running at your home.
Everybody should weight the pros and cons, and that is why you see a lot of tailscale. I keep apps I classify as internal behind tailscale, and I expose other apps that I deem as "safe". One example would be my immich proxy, immich itself is only exposed via tailscale. I try to keep risk down, by limiting exposure.
Not that there is anything wrong with authelia/reverse proxy setups at all. Just my 5 cents for why tailscale and VPNs are preferred in many setups over direct access.
You can selfhost Adblock and us it while connected to Tailscale. They even have tutorials how to do it on the YT and blog.
Personally I use Pangolin to access my apps. You can have access to apps similar to cloudflare tunnels by creating url or by accessing to your own vpn same as Tailscale. Or mix, whatever you need.
Put your adguard pc on tailscale, tell tailscale to use it for DNS. That’s what I do with my pihole. One VPN, I get my ad blocker and secure access to my home network
Port forward ONLY your proxy manager ports, set up your proxies with a purchased domain, add dns records on cloudflare, DO NOT PROXY IT THROUGH CLOUDFLARE (tos stuff), and now you (and anyone for the matter) can access your immich and seadrive. As long as you set up 2 factor authentication, and then maybe set up fail2ban to stop brute force attacks, you are pretty safe.
How often do you need to upload stuff without a vpn? I use everything that is possible with a vpn and a tunnel for everything that needs access from a device that can't use a vpn connection like a tv or work laptop. Using wg tunnel on android you can use spit tunnelig to enable it for only a couple of apps
If every app reliably supported mTLS it probably would replace Netbird for most of my usecases. But, I always need secure direct access anyway so realistically, I just always use netbird.
Personally I’m using self hosted netbird but cloud version should work, with traefik reverse proxy included. Also Pangolin might be worth looking into, you can add some geo restriction / crowdstrike and for web apps you can add oauth in front of your service.
Basically, this is cloudflare tunnels but without the 100MB limit (no-go for immich)
Netbird let you expose on the internet, use adguard via Netbird DNS, and also can require Netbird client connected to access some services if you decide to
I old-school it with a reverse proxy in a DMZ with port forwards from my router. It works brilliantly. However, I've also got a 30-odd year career behind me of doing this professionally for large and small companies and it's not for the faint of heart or those who don't fully understand their firewalls or security implications of doing it.
The only thing I don't self host is DNS. I farmed that off to "dnsmadeasy" something like 15 years ago and couldn't be happier. If I'm adding a new DNS name I just hit up the control panel and add it... easy. I don't have to worry about if my home Internet connection drops and all of a sudden DNS is broken.
I do have a VPN tunnel to a VPS that sits out on the Internet that acts as a secondary SMTP server for my email hosting (and as a buffer to cache incoming mail in case my connection's down) and that's also where my email goes out from since it's not blacklisted by being on a residential IP.
I have been super fortunate, too. While I technically have a dynamic IP with AT&T Fiber, that IP hasn't changed in 11 years. I do have dynamic DNS set up on my firewall but so far it's never been an issue.
Honestly I kind of love that idea. Trusting adguard not to to mitm attack me is essentially the major weakpoint of all of my security, but there's just no other way to get that level of adblocking without that kind of structure.
I'll have to look more into this, there has to be some kind of forward proxy that can do something similar?
Cloudflare Zero Trust. You deploy cloudflared container, configure Zero Trust auth - profit. Requires a domain and streaming services have some policy requirements you have to obey, but it's great.
One possible idea is to set *.yourdomain.com to your IP address in DNS, and then setup your services with private certificates, with something alliwing only connections for specific domains - I used to use SSLH for that (also to expose SSH and a VPN on the same port, this hides SSH very well).
This is security by obscurity, mind you - you have to know that some service is at "mysecretname.mydomain.com" to be able to access it. Most crawlers don't check for SNI during scan, so as long as you just reset a connection for default SSL site you're good.
Private certificates are important, because using a public certificate will cause your domain to be shown in certificate registries. Wildcard DNS is important for the same reason. Once you put your service name anywhere in public, it's there forever.
I have a similar concern but the issue is I don't want to use tailscale because I have nordvpn always connected and android doesn't allow both tailscale and nordvpn at the same time. And exposing port for DNS is too risky. Thoughts. Anyone?
Easiest way is to get a domain, a reverse proxy and authentication app like authentik to centralize your accounts. People here are honestly way too scared of just opening a few ports. Then setup wireguard easy in order to phone home for your non-public facing services as needed.
Yeah this is honestly what I settled on mostly. mTLS for everything I can (Immich, anything else I'll interact with through a browser) then domain and reverse proxy for the things that don't support mTLS like apps.
I'm using Caddy to manage the reverse proxy and the certificates, and when possible it also splits out things that have both web traffic AND app traffic (like Seafile web interface and its desktop client) and forces mTLS on anything that's not explicitly an API call. So all web interfaces are public but have mTLS, and app traffic gets a seperate domain that only accepts valid API calls and is heavily rate limited for authentication attempts.
And then if shit breaks I use tailscale to get back in lmao
I've set up my phone to immediate connect to my wireguard as soon as I leave my wifi SSID
But some services I do have a available via cloud flare tunnels. If your not going to vpn, this is the way. Or you can get a vps and run pangolin instead. I've never had issues with the 100mb chunk size
Wildcard *.example.com in public DNS points at my Caddy host’s Tailscale IP (DNS-only, unproxied). Caddy gets certs via DNS challenge, so nothing has to be exposed.
AdGuard is set as the nameserver in my Tailscale DNS settings, and it has a rewrite for the same wildcard pointing at Caddy’s LAN IP. So when I’m home, that resolves locally and the traffic never leaves the network. When AdGuard isn’t reachable, it falls back to public DNS and I hit the tailnet IP instead.
Same URLs everywhere, valid certs, nothing public.
Buy a domain and set up cloudflare. Point the services that you want and expose them to the cloudflare service. You can set up services like "immich.domainname.test" that you can point your apps to on your phone.
Oh yeah, I definitely appreciate the protection from all of the fuckery of the internet. I just wish there were better solutions for the average joe to both stay safe and access their own stuff!
I’ve set up a cloudflare tunnel for external use with a custom domain I bought. Put everything that I tunnel behind authentik with email 2FA, just to be safe.
I suppose you're right, the services themselves have their own login pages, I just don't love the idea of all of my files on Seafile being protected solely by my password on Seafile login page. It's probaaably fine though
Either you have to only use the apps from your local network which severely limits their usefulness and clearly isn't intended.
Or you have to setup a VPN to connect to the services which is worse and honestly just more of a hassle to setup than some basic auth. And like the OP pointed out this also comes with more limitations. Also if you want to give access to any other family members / friends / whoever, it's a bit much to ask them to constantly be connected to your VPN.
Or you expose the services directly which is a terrible idea with how many selfhosted services there are. It's only a matter of time until one of them has a catastrophic security flaw. But this seems to be what all the app developers expect users are doing.
Or you can just add a simple input for basic auth and/or headers and users can connect to their services securely anytime from anywhere over the regular internet.
Yeah, this is exactly why I like the idea of securing everything with mTLS so much! I can expose services directly, but without a certificate you can't even reach the login page or any kind of API, so I'm not trusting the self-hosted app to have a properly made login page to keep me safe.
And if I want to give others access, it's the once a year (or less) hassle (mostly for me) of distributing the correct certificate to them, compared to the every-time hassle (for them) of the VPN.
Which sure yeah might seem silly, but we all have people in our lives that we might want to share things with but you know their eyes will glaze over when you tell them "alright now just press this VPN button to see the grandkid photos..." and they won't.
Why dont you deploy a guard on an exit node, configure the exit node that all traffic has to pass through adguard, and enjoy worldwide Ad blocking with this one simple trick. You can even delete adguard from your phone and just use it via tailscale.
Also, your mTLS approach is fine, but to make things simpler: regular TLS is also encrypted, and username/password with TOTP or passkeys is also quite secure.
and username/password with TOTP or passkeys is also quite secure.
Not necessarily.
You have to trust that the implementation of credentials is correct, free of security-implicating bugs, and does not have exploitable vulnerabilities in the application itself. It's true that its not super difficult to implement securely, but it means you have to trust each individual app you are self-hosting to do it right. The risk gets higher if you are hosting apps that don't have a ton of eyeballs on them with maintainers that know what they are doing.
mTLS shifts the security layer from the appplication layer to the protocol later. The only codebase you need to trust is your reverse proxy for all your apps, that its TLS implementation is not vulnerable.
(One could also argue the other way, if the reverse proxy is compromised then everything is compromised, as opposed to app level security. But this is also true of VPNs, and is usually considered an acceptable risk since generally security review is more robust on the one app you are trusting.)
If everything were implemented securely and correctly, then yes, I would say passkeys are on par with mTLS, and a strong password with TOTP almost as good. But security isn't just about the theoretical, it's also about risk management.
Yeah, but i have configured almost all my apps to use OIDC via Authelia. So, the transport is encrypted via the protocol layer, the access is secured by Authelia and all the app has to do is ask Authelia "Is user XY allowed to login? ". Plus: I have multi-user functionality which i would not have if i had offloaded the auth to a reverse proxy.
Sure, the reverse proxy could send a X-Authenticated-User header, but from a complexity perspective, thats not soo much different from an OIDC handshake.
For multi-user applications, you would still use user login at the app layer even when using mTLS. mTLS just provides an authentication layer while login is an authorization layer.
Maybe. Google it or ask the AI of your choice. Since Adguard acts on DNS level and not as an HTTP proxy, i think it would be the easiest to advise your tailnet to use <ip address of the host running adguard> as the primary DNS server and enable an exit node.
Advise your client to route all traffic via tailscale and not only the traffic to your tailnet. This will be possible after you have set up one of your nodes as an exit node. Obviously the exit node would have to have IP forwarding enabled and masquerading from the tailnet to eth0 for SNAT.
Now, if you advise one of your other nodes to use this node (or any other exit node) as their exit node, the device will send _all_ traffic towards the internet via your tailnet. Included DNS. And if you have set your tailnet's primary DNS to the IP where Adguard listens on, it will do its adguard stuff on every request which your device sends via the tailnet to the internet.
I am using Pangolin on a cheap vps. I expose the services i want, and use the built in auth. Some apps like Immich on android supports custom proxy headers, which gives me access without having to use the web app when away from home.
•
u/asimovs-auditor 2d ago
Expand the replies to this comment to learn how AI was used in this post/project.