I have a VPS sitting and doing nothing | Home Assistant | Page 1

hollow beacon May 9, 2023, 10:38 AM

#

You need to be sure you trust the VPS and VPS provider, since it'll have access to your network

obsidian spade May 9, 2023, 10:39 AM

#

Ahh that's a good point

#

Wouldn't I have to port forward, and set firewall rules just to connect to the "proxy" / VPN bridge 🤷

hollow beacon May 9, 2023, 10:40 AM

#

Depends on how you set it all up

#

You said:

I need full lan access on the go as if I'm at the network

#

which would point to a bridged VPN so that you're "on" the network

obsidian spade May 9, 2023, 10:42 AM

#

Like when I setup WireGuard earlier on my OPNsense I needed to pass a ruel on my Wan that allowed incoming traffic into port 51820...

Yet people say that WireGuard just punches out, didn't I just had to port forward?

obsidian spade May 9, 2023, 10:43 AM

#

hollow beacon which would point to a bridged VPN so that you're "on" the network

Makes sense

hollow beacon May 9, 2023, 10:44 AM

#

Yet people say that WireGuard just punches out, didn't I just had to port forward?
Depends on what you're reading when you read that

#

"people say" is:

Vague
subject to people not being an idiot

obsidian spade May 9, 2023, 10:46 AM

#

https://homenetworkguy.com/how-to/configure-wireguard-opnsense/?utm_content=cmp-true

This and the official opnsense road warrior guide is what I've followed.

How to Configure the WireGuard VPN Server in OPNsense

WireGuard is a modern designed VPN that uses the latest cryptography for stronger security, is very lightweight, and is relatively easy to set up once you understand how it functions in OPNsense. I found setting up WireGuard in OPNsense to be more difficult than I anticipated when I was first learning how to properly configure the service. It se...

hollow beacon May 9, 2023, 10:48 AM

#

Where in there does it talk about punching out?

obsidian spade May 9, 2023, 10:50 AM

#

Ohh that part is just something I've picked up from others, one person says it can punch out others say it can't and you gotta port forward which means cloudflare is the one and only only solution.

hollow beacon May 9, 2023, 10:50 AM

#

shrug

obsidian spade May 9, 2023, 10:51 AM

#

What's true, can WireGuard punch out similar to cloudflare tunnels?

hollow beacon May 9, 2023, 10:51 AM

#

Not as far as I know, it needs a server the client can connect to

#

Now, you can run that server somewhere accessible

#

which is what was being discussed above

obsidian spade May 9, 2023, 10:52 AM

#

Via a vps

hollow beacon May 9, 2023, 10:52 AM

#

Or anything else

obsidian spade May 9, 2023, 10:52 AM

#

Indeed, But I would need to open ports on both the main network and the bridged network.

hollow beacon May 9, 2023, 10:53 AM

#

Not sure what you mean

#

Any VPN can reach out unless you block it

#

It's just packets

#

You can't however run a VPN server on the main network and access it without either hole punching support, or port forwarding

obsidian spade May 9, 2023, 10:55 AM

#

Which I can't do anyways because I'm behind CGNAT

hollow beacon May 9, 2023, 10:55 AM

#

So, you need a VPN solution that supports hole punching, something like Tailscale/ZeroTier, or a VPS to run your own server

#

https://github.com/slackhq/nebula too

obsidian spade May 9, 2023, 10:59 AM

#

What's hole punching compared to port forwarding?

To my understanding OPNsense on the main network would be running a WireGuard client, and then the VPS would act as the server, the Host handling the port forwarding for me?

Or I would need to go with a hole punching solution, like tailscale/zerotier?

So hole punching is basically where the client on the main network establishes a connection to the servers on the other end.. kinda like a reverse VPN similar to what marty mentioned?

hollow beacon May 9, 2023, 11:00 AM

#

https://en.wikipedia.org/wiki/Hole_punching_(networking)

obsidian spade May 9, 2023, 11:02 AM

#

It's starting to make more sense

#

So why would one consider cloudflare over a VPN solution like tailscale or WireGuard with a bridge running on a VPS?

hollow beacon May 9, 2023, 11:04 AM

#

For when you want to expose a service or services

#

Want to expose a web service? Want SSH access? Those are simple things that CF tunnels work well for

obsidian spade May 9, 2023, 11:06 AM

#

Hmm could I just tunnel my whole lan over cloudflare?

#

Or would I have to setup a tunnel per service

hollow beacon May 9, 2023, 11:07 AM

#

https://developers.cloudflare.com/cloudflare-one/connections/connect-apps/

#

One tunnel to the network, multiple services in the tunnel

obsidian spade May 9, 2023, 11:10 AM

#

So let's say I spin up a VM on my Network with a Cloudflare tunnel.

Will it automatically just route everything to Cloudflares servers?

Everything being hosted in separate VM's are bare metal on the lan

hollow beacon May 9, 2023, 11:11 AM

#

No

#

You have to set up the tunnels/routes

obsidian spade May 9, 2023, 11:11 AM

#

For everything

#

One service at a time

hollow beacon May 9, 2023, 11:11 AM

#

Well, it'd be a pretty shit design to automatically find every web service on your network and expose them to the Internet

obsidian spade May 9, 2023, 11:12 AM

#

True now that I think about it 😅

hollow beacon May 9, 2023, 11:12 AM

#

It's not like it's hard to set up though

#

Personally, I'd set up a proxy for all the services you want to expose. Point the tunnels at the proxy, and let the proxy handle it

#

I say that, because that's what I do 😉

#

https://blog.ceard.tech/2023/04/cloudflare-tunnels-with-auth

#

Now your CF tunnel host only has to reach the proxy, and the proxy is the only thing that needs to access the services

obsidian spade May 9, 2023, 11:16 AM

#

But what if I'm creating a new service (perhaps a new vm) away from the network, how would I add that service to a tunnel?

hollow beacon May 9, 2023, 11:16 AM

#

"away from the network"

#

what does that mean?

#

Do you understand what the tunnel is?

#

There's nothing stopping you running multiple tunnels

#

A tunnel is just a fancy VPN link

obsidian spade May 9, 2023, 11:18 AM

#

hollow beacon "away from the network"

Remote, away from the lan

hollow beacon May 9, 2023, 11:18 AM

#

So set up another fecking tunnel?

#

https://developers.cloudflare.com/cloudflare-one/connections/connect-apps/

#

You should read that

#

I bet it answers most of your questions

obsidian spade May 9, 2023, 6:15 PM

#

Yea it answers most of my questions.. Basically I have to setup an individual Cloudflare tunnel for each service/resource on my network...

hollow beacon May 9, 2023, 6:15 PM

#

No

#

You need to set up a tunnel for each network you want to access

#

I have one tunnel, for 5 services/resources

obsidian spade May 9, 2023, 6:17 PM

#

obsidian spade So let's say I spin up a VM on my Network with a Cloudflare tunnel. Will it aut...

Ahh so this applies except I have to route those services

hollow beacon May 9, 2023, 6:18 PM

#

Or set up a proxy server and let that handle it

#

Depends on whether you want the CF tunnel host to have access to everything for a simpler setup, or to limit access and add some complexity

obsidian spade May 9, 2023, 6:19 PM

#

The proxy server being the method that limits access

hollow beacon May 9, 2023, 6:20 PM

#

Yeah

#

Tunnel terminates at the CF tunnel host, which then only has access to the proxy (DMZ)

#

Depends on whether you're doing this for work or home, and what your risk model is

obsidian spade May 9, 2023, 6:22 PM

#

I'm doing it for both so I should probably setup the proxy

hollow beacon May 9, 2023, 6:23 PM

#

A little bit of network security now reduces the risks 😄

obsidian spade May 9, 2023, 6:24 PM

#

Exactly, With the WireGuard plus Proxy/Bridge on a VPS method, what risks am I looking at other than trusting the VPS?

hollow beacon May 9, 2023, 6:25 PM

#

That's the biggest one, but you have to trust something to be able to VPN in

#

The other option would be Nebula VPN with a VPS to host the "lighthouse"

#

https://arstechnica.com/gadgets/2019/12/how-to-set-up-your-own-nebula-mesh-vpn-step-by-step/ is old, there's likely better guides now, but it's in my bookmarks

obsidian spade May 9, 2023, 6:44 PM

#

Nebula looks like a smarter option over WireGuard

#

That mesh feature is interesting

obsidian spade May 9, 2023, 6:51 PM

#

hollow beacon Now your CF tunnel host only has to reach the proxy, and the proxy is the only t...

So your using traefik as the proxy and authentik for authentication?

#

When it comes to Cloudflare

hollow beacon May 9, 2023, 7:18 PM

#

Yes, and no

#

I'm using CF's auth as the first pass to get to the services
Then the tunnel hands the connection to Traefik
That then either uses Authentik (if the web app has no auth) or the web app's auth

obsidian spade May 9, 2023, 9:06 PM

#

Why not I setup both solutions for redundancy 🤷

#

Users can access specific services through cloudflare connected to a proxy, and I can connect through either WireGuard or Cloudflare for remote management.

obsidian spade May 12, 2023, 4:32 AM

#

hollow beacon <https://blog.ceard.tech/2023/04/cloudflare-tunnels-with-auth>

Hey quick question, is this the guide you wrote for using traefik with cloudflare tunnels?

hollow beacon May 12, 2023, 7:10 AM

#

Yes

obsidian spade May 12, 2023, 9:15 AM

#

hollow beacon Yes

I just got cloudflare tunnels running, you were right, creating routes is easy

#

my only concern is that I would like additional authentication, is that what you've achieved with authentic (also apologize for the pings, I keep forgetting to disable it, not trying to be annoying)

hollow beacon May 12, 2023, 9:17 AM

#

Just don't use reply and the problem is solved 😉

#

I mean, there's only two of us in this thread

#

And yes, you can put auth in front of the connection (Cloudflare's auth) or you can use Authentik either as middleware or integrated with the app (where supported)

#

https://www.reddit.com/r/selfhosted/comments/wjh326/authentik_and_traefik_forwardauth_guide/

obsidian spade May 12, 2023, 9:20 AM

#

gotcha, I tried Cloudflare's auth, wasn't too pleased with it, at least the way I set it up.

the best I could do was have it send a code to any email, not sure if there's a white list or not

hollow beacon May 12, 2023, 9:20 AM

#

Then you didn't read my guide

#

https://developers.cloudflare.com/cloudflare-one/identity/idp-integration/

#

And yes, there's whitelists, but SSO is so much easier

obsidian spade May 12, 2023, 9:25 AM

#

hollow beacon Then you didn't read my guide

I skimmed through it, hehe

#

I'll read everything and see what I can do with it

sharp martenBOT May 12, 2023, 9:27 AM

#

@obsidian spade When using Discord's Reply feature it defaults to pinging the person you reply to, which can get frustrating for the target. Use Shift + click on the Reply option, or click @ ON to @ OFF to stop this - on the right side of the compose bar.

You have to change this every time (thank the Discord devs for that).

obsidian spade May 13, 2023, 1:50 AM

#

hollow beacon And yes, there's whitelists, but SSO is so much easier

Do you suggest I follow this guide to get traefik up and running? https://www.smarthomebeginner.com/traefik-docker-compose-guide-2022/

#I have a VPS sitting and doing nothing