I’m in the process of setting up homelab stuff and i’ve been doing some reading. It seems the consensus is to put everything behind a reverse proxy and use a vpn or cloudflare tunnel.
I plan to use a VPN for accessing my internal network from outside and to protect less battle tested foss software. But I feel like if I cant open a port to the internet to host a webserver then the internet is no longer a free place and we’re cooked.
So my question is, Can I expose webserver, SSH, WireGuard to the internet with reasonable safety? What precautions and common mistakes do I need to watchout for.
You can. I recommend making sure you have logging in place so you know what’s going on. This could include not just service logs but firewall logs as well. You might want to rate limit the connection attempts for SSH and WireGuard and consider Fail2Ban or something similar.
Fail2ban is useless for a wireguard endpoint. Wireguard never sends a response unless there’s a valid signed handshake request. It’s basically a blackhole.
So, hate to break this to you but it’s been almost 20 years since you shouldn’t just open ports directly to your computer from your home router AND it’s been about that long since ISPs just don’t allow traffic to customers on standard ports like 80, 443, 21, 22, etc.
The way to do this is actually to have multiple computers, with the first computer acting as your firewall, IDS, and IPS. That computer should run no other services and should be heavily locked down after it’s setup, as in most things should be made read-only except the few variable files that are required for operations.
That computer should then route traffic to computers behind it that provide services like https, ssh, etc. This setup makes everything much safer.
But you’ll still have to contend with your ISP and they don’t usually budge, so you’ll have to run services on non-standard ports.