Replacing Tailscale with a 2-VPS WireGuard setup (No port forwarding)
2026-05-12 10:59 UTC
Replies (14)
-
@slazer2au@lemmy.world 2026-05-12 11:05
Might want to have a look at your mobile site, it seems to cut stuff off on Firefox for Android. 
-
@spaghettiwestern@sh.itjust.works 2026-05-12 18:51
An excerpt from the [Wireguard Whitepaper:](https://www.wireguard.com/papers/wireguard.pdf) >One design goal of WireGuard is to avoid storing any state prior to authentication and to not send any responses to unauthenticated packets. With no state stored for unauthenticated packets, and with no response generated, WireGuard is invisible to illegitimate peers and network scanners. Several classes of attacks are avoided by not allowing unauthenticated packets to influence any state. After opening an SSH port and watching the number of attacks I understand the concern about opening any port on a router, but it seems the worry about opening a port for WG is way overblown. As of now I can find zero reports of a properly configured open WG port ever being successfully used by attackers to access a network. Anyone have better/more recent info?
-
@kwarg@mander.xyz 2026-05-12 13:44
> None of this is especially complicated It is for an absolute noob like me... i need vacation so i can start learning all this networking jargon. Thank you for sharing though!
-
@brewery@feddit.uk 2026-05-12 13:18
Just to clarify for my simple brain - vps1 has just 80/443 open, vps2 just has a wireguard port open (51825 or whichever). Vps2 has no domain pointing to it's public IP, vps has your domain pointing to it. Vps1 and home server have wireguard configs pointing to the vps2 public IP, so punch through automatically. Is that all correct? I think I have the same setup but with vps1 + 2 combined but that means it's public IP is easily found by the domain (one includes a public business website) and has WG ports open (although my understanding is this in itself is not an issue as WG gives no reply) Have you opened an SSH port on both vps1 and vps2 for backup or happy to rely on wireguard? Thinking about it, you could open up the port on the vps but use the providers firewall to block the port - if needed can login to their site, open the port and then SSH in - would this work? They have KVMs for emergencies but just trying to think of worst case scenarios.
-
@AcornTickler@sh.itjust.works 2026-05-12 15:25
What did you not like about Headscale? I started using it recently and it seems fine so far. Works identically to Tailscale.
-
@carrylex@lemmy.world 2026-05-12 21:34
https://github.com/wg-easy/wg-easy Needs like 100MB RAM to run, so it can basically run on almost anything. If you like some extra security: Do another layer of authentication in the reverse proxy that faces the internet.
-
@electric_nan@lemmy.ml 2026-05-13 03:07
I'm rusty since it's been awhile, but I don't understand why you need two VPSs. I have a similar setup just using one. It was mainly to get around the ISP NAT. My DNS points to the VPS, and it forwards traffic to/from my home server over the WG connection with IPtables rules.
-
@in_my_honest_opinion@piefed.social 2026-05-12 14:16
Netbird could be a nice alternative. https://github.com/netbirdio/netbird
-
@Croquette@sh.itjust.works 2026-05-13 11:03
This is an interesting article, but the crux of the setup isn't described : what is the configuration on your home server? Creating a wireguard tunnel is pretty simple, but managing how everything is handled behind the VPN is more challenging.
-
@Decronym@lemmy.decronym.xyz 2026-05-12 13:20
Acronyms, initialisms, abbreviations, contractions, and other phrases which expand to something larger, that I've seen in this thread: Fewer Letters | More Letters ---|--- DNS | Domain Name Service/System IP | Internet Protocol ISP | Internet Service Provider NAT | Network Address Translation SSH | Secure Shell for remote terminal access TCP | Transmission Control Protocol, most often over IP VPN | Virtual Private Network VPS | Virtual Private Server (opposed to shared hosting) ---------------- 8 acronyms in this thread; the most compressed thread commented on today has 12 acronyms. [Thread #286 for this comm, first seen 12th May 2026, 13:20] [[FAQ](http://decronym.xyz/)] [[Full list](http://decronym.xyz/acronyms/selfhosted@lemmy_world)] [[Contact](https://hachyderm.io/@Two9A)] [[Source code](https://gist.github.com/Two9A/1d976f9b7441694162c8)]
-
@stratself@lemdro.id 2026-05-12 15:19
The article makes sense. I think it's good to note that if the services you're running makes **outbound requests** (e.g. a Matrix homeserver), you could also tunnel outbound traffic to the same VPS as your inbound, so your residential IPs won't be leaked. I've written about a similar setup, but for Tailscale nodes, [here](https://muoi.me/~stratself/articles/tailscale-notes).
-
@krolden@lemmy.ml 2026-05-12 13:32
https://netbird.io/
-
@pedroapero@lemmy.ml 2026-05-17 20:54
It's not clear to my why you absolutely don't wan't to expose your home port. From a security standpoint, you are still exposing your services to the public anyway (only the TCP stack is not, which is likely the smallest attack surface). If you had a simpler reverse-proxy VPS, it would still hide your home server IP from clients. Your ISP would still only see encrypted traffic (https). Since you use adguard already, you can target dns-over-https upstreams to hide all DNS traffic too (eventually have a firewall rule to block outgoing dns queries if you don't trust your application).
-
@SeductiveTortoise@piefed.social 2026-05-12 18:40
I thought about setting tail scale up for my home server but then I realized I've got no one I want to open myself up to and just use the VPN to connect to my stuff. Good setup, I like 💖