Selfhosted

61021 readers

225 users here now

A place to share alternatives to popular online services that can be self-hosted without giving up privacy or locking you into a service you don't control.

Rules:

Detailed Rules Post

Be civil.
No spam.
Posts are to be related to self-hosting.
Don't duplicate the full text of your blog or readme if you're providing a link.
Submission headline should match the article title.
No trolling.
Promotion posts require active participation, with an account that is at least 30 days old. F/LOSS without a paywall has exceptions, with requirements. See the rules link for details. Tags [CBH] or [AIP] are required, see the links in Rule 8 for details.
AI-related discussions and AI-involved promotional posts have additional requirements for tagging, as noted in Rule 7 and the AI & Promotional Post Expanded Rules post, and find example disclosures here.

Resources:

selfh.st Newsletter and index of selfhosted software and apps
awesome-selfhosted software
awesome-sysadmin resources
Self-Hosted Podcast from Jupiter Broadcasting

Any issues on the community? Report it using the report flag.

Questions? DM the mods!

founded 3 years ago

MODERATORS

curbstickle@anarchist.nexus

curbstickle_lw@lemmy.world

134

Replacing Tailscale with a 2-VPS WireGuard setup (No port forwarding) (the.unknown-universe.co.uk)

submitted 2 months ago by TheIPW@lemmy.ml to c/selfhosted@lemmy.world

24 comments fedilink hide all child comments

I wanted to move away from Tailscale but found Headscale a bit too convoluted for what I actually needed.

Ended up with a simple WireGuard setup using two VPSes: one as a VPN hub, the other acting as a reverse proxy back into my home lab.

It lets me expose services publicly without any inbound port forwarding on my home connection.

you are viewing a single comment's thread
view the rest of the comments

[–] electric_nan@lemmy.ml 4 points 2 months ago (1 children)

I'm rusty since it's been awhile, but I don't understand why you need two VPSs. I have a similar setup just using one. It was mainly to get around the ISP NAT. My DNS points to the VPS, and it forwards traffic to/from my home server over the WG connection with IPtables rules.

[–] TheIPW@lemmy.ml 4 points 2 months ago (1 children)

You're right, and for a lot of people, one VPS is the sensible choice. I actually addressed this in the post:

"VPS1 is my web-facing server. It handles the public side of things. VPS2 is the VPN hub. At first glance, that probably looks unnecessary. Strictly speaking, it is unnecessary. I could have crammed WireGuard onto VPS1 and called it done. But splitting the roles makes the whole thing cleaner.

One machine serves public traffic. The other handles VPN duties. That means fewer networking compromises, fewer chances of Docker or firewall rules becoming annoying, and a clearer separation between the public-facing stack and the private tunnel. It also means I can change one side without poking the other with a stick and hoping nothing catches fire."

[–] electric_nan@lemmy.ml 4 points 2 months ago

Gotcha, didn't realize it was a blog post haha. As far as my personal experience, I never have to touch it. Once I did a dist-upgrade and broke it, but fixed it with a backup.