Selfhosted

39171 readers

512 users here now

A place to share alternatives to popular online services that can be self-hosted without giving up privacy or locking you into a service you don't control.

Rules:

Be civil: we're here to support and learn from one another. Insults won't be tolerated. Flame wars are frowned upon.
No spam posting.
Posts have to be centered around self-hosting. There are other communities for discussing hardware or home computing. If it's not obvious why your post topic revolves around selfhosting, please include details to make it clear.
Don't duplicate the full text of your blog or github here. Just post the link for folks to click.
Submission headline should match the article title (don’t cherry-pick information from the title to fit your agenda).
No trolling.

Resources:

Any issues on the community? Report it using the report flag.

Questions? DM the mods!

founded 1 year ago

MODERATORS

VPNs, self hosting and security (programming.dev)

submitted 9 months ago* (last edited 9 months ago) by [email protected] to c/selfhosted

23 comments fedilink hide all child comments

I run a load of containers on a NAS, and reverse proxy them through synology's inbuilt reverse proxy settings.

Essentially, I'd like to harden my security, and not really sure how best to do it.

Seeing people recommend nginx proxy manager, I've tried to set this up but never managed to get the certificates to work from letsencrypt ("internal server error" when trying to get one). When I finally got it working a while ago (I think I imported a cert), any proxy I tried to setup just sent me to the Synology login page.

I've tried to setup the VPN that comes with Synology (DSM 7+), but I must have set it up using the local IP address. It only works when I'm on my LAN, and not from an external network. Which is kind of the point, lol. I would like to use VPN to access the home network when out and about.

I've set random, long, unique passwords for everything I want to access, but I am guessing this is not the most secure, after seeing so many people use and recommend vpns.

I have tailscale, which is great for ssh-ing onto my Nas from the outside world. But to access my services, is a VPN the best way to do it? And can it be done entirely myself, or does it require paying for a service?

I've looked at authentic - pretty confusing at the outset, and Isee few evenings of reading guides ahead of me before I get that working. Is that worth setting up?

Does anyone have any advice/guides/resources that might help?

you are viewing a single comment's thread
view the rest of the comments

[–] [email protected] 2 points 9 months ago (5 children)

Tailscale is (like) a VPN, but traffic will go through their servers. If you setup your own VPN server then traffic will remain between your client and your own server.

Did you setup port forwarding and routing tables when you installed your VPN server?.

The Synology VPN package is lacking behind a lot, so you could be missing some security updates.

If you use a VPN to hide your services, you reduce your attack/risk. Since there is only one package/software suite which could've vulnerabilties. And VPN's are focussed on security. If you expose all your hosted stuff, all those programs need to be secure to prevent abuse. And not everybody is as skilled to build it securily.

I would recommend, for you, to use something like tailscale. Since you seem like someone at the beginning of their safety journey. With setting up a VPN server, you need to know a little bit what your doing to make it secure and work. And you could invest time to learn it all, or you could use something that does it for you. Another, not so wise, advise could be to use a docker container to host the VPN. Most containers have all settings correctly setup and have guides to make it secure. But that means you don't know what you installed and that could be a bad thing as well. Furthermore, docker adds to the complexity of making it work.

[–] [email protected] 2 points 8 months ago* (last edited 8 months ago)

Tailscale is (like) a VPN, but traffic will go through their servers.

That's wrong. In a peer to peer VPN the traffic should not pass Tailscale infrastructure.

See their docs: https://tailscale.com/kb/1094/is-all-traffic-routed-through-tailscale

load more comments (4 replies)