How much do you secure a home server that's only accessible with VPN?

2026-07-05 22:40 UTC

I have a VPS that I secure as much as possible since the IP is public, but does a wireguard-access-only homelab warrant the same efforts? Those with homelabs like this, what do you do?

Replies (3)

@Brkdncr@lemmy.world 2026-07-06 00:42

I run a weekly vuln scan against my ip ranges. If anything comes up I deal with it.

Open ##3776500
@hoshikarakitaridia@lemmy.world 2026-07-06 07:55

After installing tailscale with my Headscale server, I just left it as is. Maybe people in the comments can chime in but if you expose only your VPN server or broker (Headscale), you kinda narrowed down your attack vectors and a VPN itself is really solid. From my basic knowledge, it’s the server and client which are the bottleneck at that point, but there’s only so much you can do and if you continuously update both and maybe stay on stable / ltsc branches, you kinda did everything. I guess there’s something to say about the encryption algorithms used. What I remember from back in the day is everything elliptic curves that’s common is quite good so if you see “ECDSA” / “ECDH” you should be fine. RSA unfortunately is not that great anymore.

Open ##3796742
@muusemuuse@sh.itjust.works 2026-07-08 06:18

As much as practical. Modern security relies on layers of protection to mitigate failures in methodology. Your strategy isn’t makes a single perfect defense. It’s mitigating risk. If one method fails, then what happens?

Open ##3841508