I have a VPS that I secure as much as possible since the IP is public, but does a wireguard-access-only homelab warrant the same efforts? Those with homelabs like this, what do you do?
I have a hammer hanging above the hard drive on a string, and every time I want to access it, I have to convince an AI it’s really me. If doubt level rises above 20%, the hammer drops.
If it’s just wireguard on a nonstandard port, then you are pretty much done. It’s UDP and won’t reply to incorrectly signed packets so it’s essentially invisible.
Putting it on a non standard port will change nothing
Security through obscurity is not sufficient. It’s also not nothing.
Wireguard doesn’t respond to port scans so it changes nothing
Assume a security researcher finds a bug in wireguard that, if sent a malformed packet, it can crash the service. Then it would be trivialy easy to send that packet to the default port on every IP address and just crash everything for fun.
It costs me nothing to increment the port by 1 and avoid all that drama.
And, to be fair, you’ll know more about your setup when you don’t use the defaults as you have to learn more…
It is going to make fingerprinting more annoying while evading default port scans. That isnt nothing but you do you boo
I agree that there is some value to obscurity generally, but Wireguard already evades port scans and fingerprinting. Unless a packet is signed with a known key, it gives no response to traffic, so scanners and fingerprinters see a closed port. You ISP can identify WG traffic while you are connected by inspecting your traffic, but random scanners won’t see anything. Look on shodan, you won’t see Wireguard.
Anything that I publicly expose, I have protected with multiple layers up and down my entire stack…
This is such a nice overview. Thank you for sharing!
No worries, hope it helps, let me know if you have questions =)
Actually, I was wondering:
I have used tailscale, and lately netbird, for remote access and it has worked well for Jellyfin streaming, ssh/rsync and accessing other WebUIs. All with non-default passwords of course.
However I have not set up any of the internal network hardening like OPNSense, VLANs or ReverseProxy. Is it safe to configure these remotely or am I risking locking myself out?
It can be done, just carefully. You can definitely accidentally block yourself out if you set a firewall rule up incorrectly, or in higher precedence of order for example. OPNsense (like almost every firewall known) processes rules in a “top down” order. So you put your blocks at the bottom!!!
Reverse proxy won’t lock you out, essentially that’s just slapping HTTPS on a webserver/service like Jellyfin, so you can access it without requiring a VPN.
Here’s a reverse proxy explainer, pt 2 is the actual setup!
Thank you very much for the pointers! There is so much info at different levels out there that it’s encouraging to get recommendations.
Gicen the risk of locking myself out (have been prone to do that even IRL) I may limit firewalling to times where I have physical access.
Reverse proxy sounds intriguing though. I’ve got a domain already, so just missing… well… the rest (:
I access my home server with Jellyfin exclusively via Tailscale. Until now, I thought I was safe, as I haven’t opened anything to “the open internet”. After reading your very nice guide, I feel like I forgot a lot. Supposed I trust Tailscale, is that enough?
To me, the question is ‘How much do you secure a home server
that’s only accessible with VPN?’ to which I would answer, secure everything, every last jot and tilde. Especially in a homelab environment where a nefarious actor could gain lateral movement. The data on my server, tho important to me, is not the prime concern as much as becoming a zombie in someone’s botnet. The very first Linux server I stood up got hacked overnight. Since then, I’m keen to lock everything down. I’ve been told I go overboard, but I’d rather that scenario.You’re kind of there but if you live the zero-trust life always be on the lookout for ways to improve security.
If something will make your setup more secure, is low effort, uses few resources and costs you nothing it would be madness not to use it.
As much as practical. Modern security relies on layers of protection to mitigate failures in methodology. Your strategy isn’t makes a single perfect defense. It’s mitigating risk. If one method fails, then what happens?
Acronyms, initialisms, abbreviations, contractions, and other phrases which expand to something larger, that I’ve seen in this thread:
Fewer Letters More Letters SSO Single Sign-On UDP User Datagram Protocol, for real-time communications VPN Virtual Private Network VPS Virtual Private Server (opposed to shared hosting)
4 acronyms in this thread; the most compressed thread commented on today has 5 acronyms.
[Thread #46 for this comm, first seen 7th Jul 2026, 20:50] [FAQ] [Full list] [Contact] [Source code]
VPS bad!
Can’t put your rings of garlic around it.
After installing tailscale with my Headscale server, I just left it as is. Maybe people in the comments can chime in but if you expose only your VPN server or broker (Headscale), you kinda narrowed down your attack vectors and a VPN itself is really solid. From my basic knowledge, it’s the server and client which are the bottleneck at that point, but there’s only so much you can do and if you continuously update both and maybe stay on stable / ltsc branches, you kinda did everything.
I guess there’s something to say about the encryption algorithms used. What I remember from back in the day is everything elliptic curves that’s common is quite good so if you see “ECDSA” / “ECDH” you should be fine. RSA unfortunately is not that great anymore.
I run a weekly vuln scan against my ip ranges. If anything comes up I deal with it.
Could you provide some more information on how you perform a vuln scan, or what services/softwares you use to perform the scan?
I use tenable but i get it from work for free. You could use Nessus.
Tenable owns Nessus. But they have a free tier.
The FOSS equivalent is Greenbone OpenVAS: https://greenbone.github.io/docs/latest/
