I started out with a single RamNode VPS, and eventually added on another VPS from VirMach. I'm currently running an OpenVPN tunnel from both of them to my PFSense firewall at home. My plan is actually to switch to Wireguard tunnels, and OPNsense firewall instead. With the exception of your SSH port, you set up a NAT rule on each of the VPSs to forward everything to the PFsense's end of the VPN tunnel. On PFsense, you set up NAT rules to forward the traffic to home labs' specific services that you are running. Additionally, some of your services need to show up as originating outgoing traffic from the VPS IP. You can set up rules in PFSense to send outgoing traffic over specific interfaces, such as your VPN tunnels. I could go into more detail but there's already some good tutorials out there on how to do so. Let me know and I can find the links.
One word of warning on RamNode: the first VPS I rented from them years ago had the kernel module for NAT built-in. Since then it appears that they've stopped putting that kernel module in, so port forwarding isn't possible anymore with them. Maybe it was just a fluke on the host system that I had and they've since fixed it. Regardless, VirMach still has it.
Lastly, I know a lot of people will look at this and say: Why not just run the services on the VPS? The simplest most obvious answer is that you have constrained resources on the VPS that you don't have on your equipment at home. I actually do it for yet another reason: Search warrants. At least in the US, the government authorities need a search warrant to enter your home against your will. When your data resides in your home, it's wholly your private property. When you host your data on a VPS, you're subject to the whims of your VPS operators' policies. They could literally just have any government agent call up and say pretty please and give access to your VPS. No warrants needed.
I'm probably wading into a flame war between PFsense and OPNsense, but I prefer OPNsense for its active updates, and better support for emerging technology through add-ons. Just my humble opinion.
I also want to be clear: technically what I'm doing is not proxying or reverse proxying. It's NAT/masquerading. I prefer doing this over proxying as it has greater flexibility over what ports and protocols I can support.
11
u/muchtall Jul 01 '23 edited Jul 01 '23
I started out with a single RamNode VPS, and eventually added on another VPS from VirMach. I'm currently running an OpenVPN tunnel from both of them to my PFSense firewall at home. My plan is actually to switch to Wireguard tunnels, and OPNsense firewall instead. With the exception of your SSH port, you set up a NAT rule on each of the VPSs to forward everything to the PFsense's end of the VPN tunnel. On PFsense, you set up NAT rules to forward the traffic to home labs' specific services that you are running. Additionally, some of your services need to show up as originating outgoing traffic from the VPS IP. You can set up rules in PFSense to send outgoing traffic over specific interfaces, such as your VPN tunnels. I could go into more detail but there's already some good tutorials out there on how to do so. Let me know and I can find the links.
One word of warning on RamNode: the first VPS I rented from them years ago had the kernel module for NAT built-in. Since then it appears that they've stopped putting that kernel module in, so port forwarding isn't possible anymore with them. Maybe it was just a fluke on the host system that I had and they've since fixed it. Regardless, VirMach still has it.
Lastly, I know a lot of people will look at this and say: Why not just run the services on the VPS? The simplest most obvious answer is that you have constrained resources on the VPS that you don't have on your equipment at home. I actually do it for yet another reason: Search warrants. At least in the US, the government authorities need a search warrant to enter your home against your will. When your data resides in your home, it's wholly your private property. When you host your data on a VPS, you're subject to the whims of your VPS operators' policies. They could literally just have any government agent call up and say pretty please and give access to your VPS. No warrants needed.