this post was submitted on 15 Sep 2025
59 points (98.4% liked)

Selfhosted

51506 readers
286 users here now

A place to share alternatives to popular online services that can be self-hosted without giving up privacy or locking you into a service you don't control.

Rules:

  1. Be civil: we're here to support and learn from one another. Insults won't be tolerated. Flame wars are frowned upon.

  2. No spam posting.

  3. Posts have to be centered around self-hosting. There are other communities for discussing hardware or home computing. If it's not obvious why your post topic revolves around selfhosting, please include details to make it clear.

  4. Don't duplicate the full text of your blog or github here. Just post the link for folks to click.

  5. Submission headline should match the article title (don’t cherry-pick information from the title to fit your agenda).

  6. No trolling.

Resources:

Any issues on the community? Report it using the report flag.

Questions? DM the mods!

founded 2 years ago
MODERATORS
ruud@lemmy.world
Loki@lemmy.world
CannaVet@lemmy.world
devve@lemmy.world
HybridSarcasm@lemmy.world
HybridSarcasm@lemmy.hybridsarcasm.xyz
59
Share single service via WireGuard (feddit.it)
submitted 1 day ago by syaochan@feddit.it to c/selfhosted@lemmy.world
14 comments fedilink hide all child comments
 

I wanted to share a service I'm hosting, but didn't feel comfortable just leaving publicly accessible, even behind a reverse proxy. In the meantime I did not want to give access to my whole lan with a VPN, or redirect all internet traffic from a client thru my network. So the idea is to run a WireGuard instance on my OpenWRT router in a completely isolated zone (input, output and forward set to reject on firewall) and then forward a single port from the service host's. Client is android, so using WG Tunnel and split tunnel just for the relevant app should not impair client's network access. Initial tests seems to be ok, is there anything I may have overlooked? Please feel free to comment.

top 14 comments
sorted by: hot top controversial new old
[–] phase@lemmy.8th.world 1 points 16 minutes ago* (last edited 15 minutes ago)

You don't really need forwarding as you don't need NAT here.

A part of the filtering can be done by wireguard by setting the allowed IPs correctly. Just check if only one service is listening on the server port you'll allow.

Now a question: all without tls right? ;)

[–] signalsayge 7 points 1 day ago* (last edited 1 day ago) (1 children)

Tailscale would probably be easier for this. Install tailscale on the server and configure only that service available in the tailscale dashboard. I've used this method for ssh access to family members devices.

I'm sure you could run the same setup using headscale (tailscale self hosted), it would require a bit more setup though and dynamic dns would probably have to be working.

[–] syaochan@feddit.it 2 points 21 hours ago* (last edited 21 hours ago)

I know about Tailscale, but since it's a commercial service I'm not keen to adopt it and then maybe they stop having a free tier. I'll look into Headscale instead, I did not know about that before.

[–] bmcgonag@lemmy.world 1 points 20 hours ago (1 children)

I think this is exactly what Pangolin was designed for and does.

[–] syaochan@feddit.it 2 points 19 hours ago (1 children)

Isn't Pangolin just a reverse proxy?

[–] ChogChog@lemmy.world 1 points 17 hours ago

The connection between your Pangolin service (hosted outside your network) and your LAN is through a VPN. Essentially you’re creating a proxy that you can point your domain address at which isn’t your house's IP address. Plus then everything inside your network is still secure behind your VPN.

So you connect to Pangolin, and Pangolin routes the traffic to your network.

[–] stratself@lemdro.id 2 points 1 day ago (2 children)

Is there a way for a Wireguard peer to advertise AllowedIPs similar to Tailscale's subnet routings? If that's right, perhaps you can configure your host's address as one of the AllowedIPs on the OpenWRT peer, and skip port forwarding too

[–] syaochan@feddit.it 1 points 21 hours ago

I'm not sure if I understood, but on the host there are other services I do not want to share outside my LAN. My goal was to share a single service.

[–] non_burglar@lemmy.world 1 points 1 day ago

Yes, since Tailscale is based on wireguard.

Probably not the best practice, though, since any device that connects will be allowed to use the service if there is no authentication on the cert.

[–] Lemmchen@feddit.org 3 points 1 day ago* (last edited 1 day ago) (1 children)

OpenZiti allows to only allow predefined ports/services via VPN: https://netfoundry.io/docs/openziti

[–] syaochan@feddit.it 1 points 22 hours ago

Thanks for the link, I did not know this service. I'm still a bit reluctant to use commercial solutions which may do a rug pull in the future.

[–] litchralee@sh.itjust.works 8 points 1 day ago (1 children)

Let me make sure I understand everything correctly. You have an OpenWRT router which terminates a Wireguard tunnel, which your phone will connect to from somewhere on the Internet. When the Wireguard tunnel lands within the router in the new subnet 192.168.2 0/24, you have iptable rules that will:

  • Reject all packets on the INPUT chain (from subnet to OpenWRT)
  • Reject all packets on the OUTPUT chain (from OpenWRT to subnet)
  • Route packets from phone to service on TCP port 8080, on the FORWARD chain
  • Allow established connections, on the FORWARD chain
  • Reject all other packets on the FORWARD chain

So far, this seems alright. But where does the service run? Is it on your LAN subnet or the isolated 192.168.2.0/24 subnet? The diagram you included suggests that the service runs on an existing machine on your LAN, so that would imply that the router must also do address translation from the isolated subnet to your LAN subnet.

That's doable, but ideally the service would be homed onto the isolated subnet. But perhaps I misunderstood part of the configuration.

[–] syaochan@feddit.it 1 points 22 hours ago* (last edited 21 hours ago)

The service runs on another machine with address 192.168.1.10, so a different subnet than the WireGuard one, hence the port forward. I confirmed that this works, I can reach the service from phone on mobile data connected to WireGuard endpoint. wg1 is in zone dmz this is the port forward

[–] frankhe78@feddit.it 3 points 1 day ago

Seems fine with me. I have been playing around with some MikroTik devices doing exactly this. It should also be possible to achieve the same using OpenWRT. You do indeed have to isolate things using different subnets and route certain IP-adresses between those IPv4 subnets. Nothing too complicated.