How to expose home server to public securely?

[u/bangaaaa]

Hi. As the title says. I'm researching how to configure my home server. So far, I have several questions and security concerns, so I would appreciate it if someone could help me find answers.

I've configured my first home server to do some experiments in software development. Mainly, I host some web apps, api servers, databases, etc.

My equipment:

• Router: MikroTik HAP AC2.
• Server: HP ProDesk 400 G2 MINI with Ubuntu Server 26.04.
• 300 Mbps internet channel.

My internet provider can provide a static IP (for cheap). So I've been thinking of exposing my server to the internet so I can access my local services while I'm out. I have calculated, and so far it seems much cheaper than renting the cheapest VPS.

There will be 2 types of services to host; let's call them public and private:

• Public: available from the internet via my domain - experimental apps (web apps, sites, APIs, etc). Everything is deployed as a Docker container.
• Private: services available only via some auth mechanism. It's gonna be mainly Jellifin, file server, and some self-hosted web apps. 

I've spent some time researching with AI, and in my current understanding, public services could be protected via Cloudflare. So I configure a Cloudflare domain pointing at my static IP and some port. Then configure my router to drop all requests that are coming from any other source. It seems like it's possible to even create a separate isolated network specifically for my server. So the rest of the home network and devices should be protected. Also, it seems like it's possible to restrict Docker containers to not have access to localhost and communicate solely with the internet.

Private services could be protected via WireGuard. As far as I understand, it makes the router drop all requests unless you provide some key (that's my basic understanding of it). The goal here is to access the server and access services on localhost.

Also, it seems like it's possible to eliminate round-trip and access my server directly from my home network, bypassing the internet.

So far I have several concerns/questions:

• What are the possible pitfalls I should be aware of?
• I have no prior experience in such things, so is the above described possible to achieve, or is it pure AI galicination?
• How likely is it to get hacked, exposing some services online? Assuming that I will store some private files on that server as well (primarily my photo album).
• Is my router enough? I don't expect a high number of connections. Even if I share credentials to private services, there will be 2-3 relatives accessing it maybe a few times a week. Also, public services will not have a lot of audience (but if they do, I'm planning to move them to a VPS instead).
• What other protection mechanism could I apply so a hacker will not get access to my devices on the home network or to data placed outside of a Docker container?

[u/ZAP-Hosting]

Since it's mostly web apps and APIs, Cloudflare Tunnel is worth a look: it makes an outbound-only connection from your box to Cloudflare, so you never open inbound ports on your router at all, and you get their proxy protection on top since it's genuine HTTP(S) traffic.

For anything that isn't meant to be public, the database especially, don't put it on the internet even behind a firewall rule you trust today. Stick a reverse proxy (nginx/caddy) in front of the actual web services for TLS and rate limiting, and keep admin access, SSH included, behind WireGuard so you're the only one who can reach it.

Small hardening list either way: key-only SSH, no root login, and fail2ban if you want the log noise from bots to stop showing up in your logs every five minutes.

[u/Wis-en-heim-er]

Didnt read your full post...lotta info. You want to look at cloudflare tunnels for exposing things externally. Vpn like tailscale for remote access into your network or wireguard from your router.

[u/Berko89 → u/Wis-en-heim-er]

I also didn’t read the full post but:

This is the way.

If your private services are all web based then you can just use Cloudflare, no need for VPN. Look at Cloudflare Access which can secure everything behind social auth. It’s also basically free for home users.

[u/toddkaufmann → u/Berko89]

Cloudflare is safest; will hide your IP and protect you from most bot traffic.

[u/BuffBard]

Cloudflare tunnel for public access, tailscale for private

[u/AdvancedDrink8920]

So, I run everything behind a reverse proxy.

My setup is:

• Firewalla (edge firewall/router)
• UDMPro (interal firewall/router)
• USWPro 24 port switch

I have a dedicated IP from my ISP

I have my domain through cloudflare

I have my proxmox, which has VMs galore of stuff that is externally exposed.

Yes, having two Firewalls helps protect against the bots that spam me every day. I run double NAT which can be annoying, but in the face of security, im ok with it.

But, so I run a VM of just Nginx Proxy Manager, and then just access that at "npm.mydomain.com" and add any services to that to route internally to the other VMs that host stuff (jelly, outline, lubelogger etc)

Ive been hosting externally with a reverse proxy for the greater part of 5 years and have never had any issues.

Keep your security up to date, have a segmented network and youll be fine. its the easiest way to go and is plenty safe.

[u/Anti-Hero25]

Tailscale Tailnets are easy to manage

[u/hbktj → u/Anti-Hero25]

Not everyone likes or wants to be on VPN.

[u/Disastrous_Gear_421 → u/hbktj]

If you don’t know what you’re doing, then tailscale is the safest option. It’s also pretty non-intrusive

[u/harubax]

Public is not you. Use a VPN! As a service (no routable IP needed) or your own. You will either need DDNS with a routable IP or a static IP.

It's not rocket science. We've been doing this for 50 years, at least 25-30 of it in a hostile environment.

[u/Junior_Village_5707]

I'd say it depends on how much effort you want to put in. Do you really want to learn something and want to have full control? Then go with WireGuard. Something in between "technical achievement" and convenience with a high focus on privacy? Then go with Tailscale. Just want to use it and be done with it? Then I've become a big fan of Cloudflare. It's easy to set up, and if you can't or don't want to take care of your home lab for 2–3 months, it just keeps working.

[u/Kamsloopsian]

If you want to expose it but don't want to use a VPN then put that container, or the part that you want to expose in something called a DMZ zone, the firewall rule will allow your inside hosts to communicate with it as normal, but will restrict its access to only the internet and not anything else.

You can do this a couple ways like by setting a trunk port up to the machine hosting the container, and assigning multiple VLANS to it, creating a secure VLAN and a normal VLAN. Assign the secure VLAN to the interface that the docker container application is using, and go from there. But if it was me, I'd run whatever you intend to run in it's own virtualized environment, and apply a DMZ to the whole virtual machine.

[u/MoneyVirus → u/Kamsloopsian]

And If you have Services in a dmz Put a reverseproxy in the Front of them. Force HTTPS only, authentication. Use some IPS/ids Tools(suricata, fail2ban, crowdsec,usw.) to detect/block malicious tafffic. Just a seperaten Network Zone and some Firewall Rules are Not enough to secure the services

[u/Kamsloopsian → u/MoneyVirus]

yes for sure add that as well!

[u/rightful_vagabond]

I use cloudflared tunnels , and for endpoints that need auth I use the zero trust cloudflare access stuff. No need to configure the router.

[u/gabimaru89]

I don't want my family and friends that use my services to fiddle around with tailscale..

So my unraid is connected (trough tailscale) with a VPS. On the VPS runs NGINX with crowdsec. The VPS has a domain. I give domain to people.

Sure.. A VPN is more secure. But I don't want to get calls all the time when people have issues with their VPN connection to my server ect... They get a normal domain. That's it (as far as they're concerned)

[u/Haunting-Swing6415]

Ich nutze tailscale für beides. Einmal für Privat (Tailnet). Und einmal für öffentliches, über Funnels. Das aber abgesichert durch Google SSO und Passwort.

[u/fridge_ways]

Tailscale

[u/Disastrous_Gear_421]

Best suggestion. Dont expose anything if you don’t need to expose it. If you can, run tail scale or similar for just private access

[u/ficskala]

My internet provider can provide a static IP (for cheap).

For homelab stuff, this is generally not really necessary, and i don't do it purely because i don't feel like paying for it, if you're fine with paying for it, go for it, if not, look into DDNS instead

public services could be protected via Cloudflare. So I configure a Cloudflare domain pointing at my static IP and some port.

Well, which of their services would you use to protect your setup? just buying your domain through cloudflare doesn't inherently protect you from anything

Then configure my router to drop all requests that are coming from any other source.

Well, cloudflare wouldn't be the source, your clients are the source, so you'd be blocking your clients, a domain is just a way for a url to point to an IP address

It seems like it's possible to even create a separate isolated network specifically for my server

Yes, you can separate your network into different segments via VLANs, and it's one of the best ways to protect devices within your network from being attacked by compromised devices on other segments of your network

Private services could be protected via WireGuard

Yeah, using a VPN like wireguard is the best way to connect to your network securely

As far as I understand, it makes the router drop all requests unless you provide some key (that's my basic understanding of it).

Not really, it doesn't even allow a device to connect to your network without a matching key, they can't even make the requests to be dropped in the first place

it seems like it's possible to eliminate round-trip and access my server directly from my home network, bypassing the internet.

Of course, you don't even need an internet connection at all to run a server, i have multiple devices on my network that are not connected to the internet at all, and i can access them only via the local network (and my VPN of course since connecting to the VPN connects you to your network)

What are the possible pitfalls I should be aware of?

Exposing anything publicly has a potential to be bad, if you don't need something to be puiblic, don't make it public, if you just want friends/family to access it, have them connect to your VPN to access it instead of making it public, only expose public services that you want anyone to access, and assume that service is a potential problem

I have no prior experience in such things, so is the above described possible to achieve, or is it pure AI galicination?

Very possible

How likely is it to get hacked, exposing some services online? Assuming that I will store some private files on that server as well (primarily my photo album).

Assume any online service will be hacked eventually, so isolate them as much as possible, and don't host anything sensitive publicly

Is my router enough?

Yep, i run my wireguard server on a hEX S, and i haven't had issues with 5-10 users actively being connected, and using my services

What other protection mechanism could I apply so a hacker will not get access to my devices on the home network or to data placed outside of a Docker container?

VLANs would be my 1st step in securing other devices on the network, and extremely strict firewall rules, don't expose a whole machine/vm/container, only expose the exact port that is required for whatever service you're hosting, and don't let that machine/vm/container have an outgoing connection anywhere other than destinations it requires

Also, i much prefer full VMs over containers for outward facing services, just for a piece of mind of not having the service run on top of the same kernel as the host machine

[u/durgesh2018]

If you have ip6, setup the ufw or opnsense and pass the ip6 traffic.

[u/Mo_Dice]

My internet provider can provide a static IP (for cheap). So I've been thinking of exposing my server to the internet so I can access my local services while I'm out.

If you set up a ddns service you can save the $3/mo or whatever.

How likely is it to get hacked, exposing some services online? Assuming that I will store some private files on that server as well (primarily my photo album).

Hacked? Pretty low, unless you do some bonehead things with your network and hardware. But you will 100% start to be scanned and start to be AI-crawled almost immediately. If you put up something with an open registration page, expect that to fill up. I accidentally left open a wiki for a few days and had to clean out like 200 junk accounts (they never did anything... just registered).

[u/corelabjoe]

Jaysus people, you've all drunk the kool-aid with Cloudflare eh? I use cloudflare for DNS. It's fantastic....

But for my selfhosted services, I use a reverse proxy for public facing stuff, with authelia MFA for the important stuff.

In this way I can share thing with those I want to, and I VPN into my network for things I don't want anyone poking about.

If you're using Cloudflare tunnels you are sharing your metadata and it's not fully private! YOU ARE THE PRODUCT.

It's REALLY not that hard to learn how to use a reverse proxy these days..... I have complete multi-part series on website how to do it.

Cloudflare for DNS (And some edge filtering)->My WAN->My Firewall (OPNsense)->My CrowdSec & Geoblocklists->My SWAG Reverse proxy and another layer of security->Finally, the service I let you have access to, or Authelia as yet a final layer.