Blog

Homelab enthusiasts often face the challenge of securely exposing their services to the internet. Whether it’s a self-hosted website, a personal media server, or an automation system, making these services accessible from outside your local network requires careful consideration. Two popular solutions for this are Reverse Proxies and Cloudflare Tunnels. Each has its own advantages and drawbacks, making it essential to understand their differences to choose the most suitable one for your homelab setup.

Introduction to Reverse Proxy

A reverse proxy is a server that sits between the client and your web server, forwarding client requests to the appropriate server and returning the server’s response to the client. This setup is commonly used to balance the load across multiple servers, provide caching, enhance security, and simplify access to internal resources.

When setting up a homelab, reverse proxies play a crucial role in managing and securing web traffic. Several popular reverse proxies are widely used in the homelab community due to their versatility and powerful features:

1. NGINX: Known for its performance and scalability, NGINX is a popular choice for both web servers and reverse proxies. It’s highly configurable, supports load balancing, SSL termination, and caching, making it ideal for complex homelab setups.
2. Apache HTTP Server: As one of the oldest and most reliable web servers, Apache also functions as a robust reverse proxy. It offers extensive modules for various functionalities, including security, URL rewriting, and content delivery, making it a flexible option.
3. Traefik: Traefik is a modern reverse proxy designed specifically for dynamic environments. It integrates seamlessly with containerized services, such as Docker and Kubernetes, automatically managing routes and SSL certificates, making it perfect for homelabs that rely on microservices.
4. Caddy: Caddy is known for its simplicity and automatic HTTPS management. It’s a user-friendly reverse proxy that requires minimal configuration, making it an excellent choice for beginners or those looking for a straightforward setup with secure defaults.

These reverse proxies cater to different needs, offering a range of features that can enhance the performance, security, and manageability of your homelab services.

Pros of Reverse Proxy

• Increased Control: With a reverse proxy, you have complete control over your configuration, including SSL certificates, access rules, and load balancing.
• Flexibility: Reverse proxies can handle complex setups, allowing you to route different subdomains or paths to specific services.
• Performance Optimization: By caching content and compressing data, reverse proxies can improve performance and reduce bandwidth usage.

Cons of Reverse Proxy

• Complex Setup: Configuring a reverse proxy requires knowledge of networking and server management. You’ll need to manage DNS records, SSL certificates, and firewall settings.
• Security Risks: Exposing a reverse proxy to the internet can introduce security vulnerabilities if not properly configured and maintained.
• Maintenance: Regular updates and monitoring are required to keep the reverse proxy secure and functional.
• Can not expose your services if your network is behind Carrier-Grade NAT (CGNAT).

Introduction to Cloudflare Tunnel

Cloudflare Tunnel is a service provided by Cloudflare that creates a secure tunnel between your local network and Cloudflare’s network, allowing you to expose your services to the internet without opening any ports on your router. This is achieved by installing a small client on your local machine that maintains a persistent connection to Cloudflare, which then routes incoming traffic to your services.

Pros of Cloudflare Tunnel

• Simplicity: Cloudflare Tunnel requires minimal setup. There’s no need to configure DNS, manage SSL certificates, or open ports on your router.
• Security: Since the tunnel is initiated from within your network, there’s no need to expose your network to the internet, reducing potential attack vectors.
• Global CDN and DDoS Protection: Cloudflare provides additional benefits like DDoS protection and content delivery network (CDN) integration, which can enhance the security and performance of your services.
• When your network is behind Carrier-Grade NAT (CGNAT), Cloudflare Tunnel offers a significant advantage over a reverse proxy. With CGNAT, it’s often impossible to directly expose your services to the internet because you don’t have a public IP address. Cloudflare Tunnel bypasses this limitation by establishing an outbound connection from your network to Cloudflare’s servers, allowing you to securely expose your services without needing to configure port forwarding or deal with the complexities of CGNAT. This makes Cloudflare Tunnel a seamless and hassle-free solution for users in CGNAT environments.

Cons of Cloudflare Tunnel

• Limited Control: While Cloudflare simplifies setup, it also limits the amount of control you have over your configuration. Custom routing and advanced features may require a higher-tier plan or may not be available at all.
• Dependency on Cloudflare: Your service’s availability becomes dependent on Cloudflare’s infrastructure. If Cloudflare experiences downtime or issues, your services may be affected.
• Potential Costs: While Cloudflare Tunnel is free for many use cases, certain features or high-traffic scenarios may incur costs, especially if you need advanced functionality.

How to Choose the Right Solution for Your Homelab

When deciding between a reverse proxy and Cloudflare Tunnel for your homelab, consider the following factors:

1. Technical Expertise:
   • If you have experience with server management, networking, and DNS, a reverse proxy might be the better option for you. It offers more control and flexibility but requires more hands-on work.
   • If you prefer a simpler solution that requires minimal configuration, Cloudflare Tunnel is a great choice. It’s easier to set up and manage, especially if you’re not comfortable with advanced networking concepts.
2. Security Considerations:
   • If security is a top priority and you want to avoid exposing your network to the internet, Cloudflare Tunnel is the safer option. It minimizes the attack surface by not requiring open ports.
   • However, if you’re confident in your ability to secure a reverse proxy (e.g., through regular updates, SSL certificates, and strict firewall rules), a reverse proxy can be just as secure, with the added benefit of more granular control.
3. Cost and Resources:
   • Cloudflare Tunnel is cost-effective for most small-scale homelab projects, but if your usage scales up or you need premium features, costs can add up.
   • A reverse proxy, on the other hand, typically only involves the cost of running your server (e.g., electricity, domain name, etc.), but you’ll need to invest more time and effort in maintenance.
4. Performance Needs:
   • If you need global CDN support and DDoS protection, Cloudflare Tunnel provides these out of the box, which can be beneficial for publicly accessible services.
   • A reverse proxy can also be optimized for performance, but it requires more manual configuration and management.

My Personal Setup: Combining Cloudflare Tunnel and Wireguard VPN

In my homelab, I use a combination of Cloudflare Tunnel and Wireguard VPN to manage access to my services. Cloudflare Tunnel handles the public-facing web services, offering a simple and secure way to expose these services without opening any ports on my router. This setup leverages Cloudflare’s global network for performance and security, making it a robust choice for web services.

For accessing my local network services that I prefer to keep private, I use Wireguard VPN. This allows me to connect securely to my internal network from anywhere, accessing services like file shares, automation systems, and other resources that I don’t want exposed to the broader internet. This hybrid approach provides both the security and simplicity I need while maintaining control over how my services are accessed.

Conclusion

Choosing between a reverse proxy and Cloudflare Tunnel depends largely on your technical skill level, security needs, and the scale of your homelab project. A reverse proxy offers greater control and flexibility, making it ideal for those with technical expertise who want to customize their setup. In contrast, Cloudflare Tunnel provides simplicity and robust security features with minimal effort, making it a perfect fit for those who prefer a hassle-free solution.

Ultimately, both solutions are viable for exposing homelab services to the internet, and your choice should align with your specific requirements and comfort level. For those looking to balance security and ease of use, combining Cloudflare Tunnel for public services with a VPN like Wireguard for private network access could be the ideal approach.

AdGuard Home is a powerful tool for blocking ads and tracking across your network. If you manage multiple instances of AdGuard Home, keeping their settings synchronized can be challenging. Using Portainer and AdGuardHome-Sync, you can automate this process efficiently. In this blog post, we’ll guide you through the steps to sync your AdGuard Home settings using a Portainer stack.

Prerequisites

Before we start, ensure you have the following:

• Multiple instances of AdGuard Home running.
• Docker and Portainer installed on your system.
• Basic understanding of Docker, Portainer, and YAML configuration files.

Step-by-Step Guide

Step 1: Create a Portainer Stack for AdGuardHome-Sync

AdGuardHome-Sync is a tool designed to synchronize settings between multiple AdGuard Home instances. To deploy it using a Portainer stack, follow these steps:

1. • Open Portainer and navigate to the Stacks section.
   • Click on Add stack and name it adguardhome-sync.

Step 2: Paste the docker-compose content to the Web Editor form, as below. Remember to change origin and destination IP, port, username and password accordingly to your actual system.

---version: "2.1"services:  adguardhome-sync:    image: quay.io/bakito/adguardhome-sync    container_name: adguardhome-sync    command: run    environment:      - ORIGIN_URL=http://192.168.1.26:3000 #Your origin Adguard Home instance -> change as necessary      - ORIGIN_USERNAME=username #change as necessary      - ORIGIN_PASSWORD=password #change as necessary      - REPLICA_URL=http://192.168.1.27 #Your destination Adguard Home instance change as necessary      - REPLICA_USERNAME=dbtech #change as necessary      - REPLICA_PASSWORD=password #change as necessary      # Replicate to other instances if needed      - REPLICA1_URL=http://192.168.1.4 #change as necessary      - REPLICA1_USERNAME=username #change as necessary      - REPLICA1_PASSWORD=password #change as necessary      - CRON=*/1 * * * * # run every 1 minute      - RUNONSTART=true    ports:      - 9876:8080 #change as necessary    restart: unless-stopped    

Step 3: Deploy the Stack

1. • Click on Deploy the stack in Portainer.
   • This will start the AdGuardHome-Sync container with the specified configuration.

Step 4: Verify Synchronization

Check the container logs to ensure that the synchronization is working correctly.

Tips and Tricks

• Security: Ensure that your AdGuard Home instances are secured with strong passwords.
• Monitoring: Regularly check the logs to monitor the synchronization process.
• Updates: Keep your Docker images up to date to benefit from the latest features and security patches.

By following these steps, you can easily keep your AdGuard Home instances synchronized, ensuring consistent ad-blocking and DNS filtering across your network. Happy syncing!

WireGuard Easy is a popular, user-friendly solution for setting up a WireGuard VPN. Combined with the power of Portainer, a container management platform, you can effortlessly deploy and manage your VPN. This guide will walk you through the process.

Prerequisites

• A server running Docker and Portainer.
• Basic understanding of Docker and Portainer.
• A domain name (optional, but recommended for easy access).

Step-by-Step Guide to install Wireguard VPN using Portainer

Step 1: Log in to your Portainer instance.

Step 2: Create a New Stack:

1. • Navigate to the “Stacks” section.
   • Click “Add stack”.
   • Give your stack a name (e.g., “wireguard-easy”).
   • Paste the Docker Compose file content to the Web editor form, using the content as below:

volumes:  etc_wireguard:services:  wg-easy:    environment:      # Change Language:      # (Supports: en, ua, ru, tr, no, pl, fr, de, ca, es, ko, vi, nl, is, pt, chs, cht, it, th, hi)      - LANG=de      # ⚠️ Required:      # Change this to your host's public address      - WG_HOST=raspberrypi.local      # Optional:      # - PASSWORD_HASH=$$2y$$10$$hBCoykrB95WSzuV4fafBzOHWKu9sbyVa34GJr8VV5R/pIelfEMYyG (needs double $$, hash of 'foobar123'; see "How_to_generate_an_bcrypt_hash.md" for generate the hash)      # - PORT=51821      # - WG_PORT=51820      # - WG_CONFIG_PORT=92820      # - WG_DEFAULT_ADDRESS=10.8.0.x      # - WG_DEFAULT_DNS=1.1.1.1      # - WG_MTU=1420      # - WG_ALLOWED_IPS=192.168.15.0/24, 10.0.1.0/24      # - WG_PERSISTENT_KEEPALIVE=25      # - WG_PRE_UP=echo "Pre Up" > /etc/wireguard/pre-up.txt      # - WG_POST_UP=echo "Post Up" > /etc/wireguard/post-up.txt      # - WG_PRE_DOWN=echo "Pre Down" > /etc/wireguard/pre-down.txt      # - WG_POST_DOWN=echo "Post Down" > /etc/wireguard/post-down.txt      # - UI_TRAFFIC_STATS=true      # - UI_CHART_TYPE=0 # (0 Charts disabled, 1 # Line chart, 2 # Area chart, 3 # Bar chart)      # - UI_SHOW_LINKS=true      # - UI_ENABLE_SORT_CLIENTS=true    image: ghcr.io/wg-easy/wg-easy    container_name: wg-easy    volumes:      - etc_wireguard:/etc/wireguard    ports:      - "51820:51820/udp"      - "51821:51821/tcp"    restart: unless-stopped    cap_add:      - NET_ADMIN      - SYS_MODULE      # - NET_RAW # ⚠️ Uncomment if using Podman    sysctls:      - net.ipv4.ip_forward=1      - net.ipv4.conf.all.src_valid_mark=1

• Change WG_HOST to your server’s public IP address or domain name.
• For the PASSWORD_HASH, run this command in terminal to get yours. Remember to replace foobar123 with your own password

sudo docker run ghcr.io/wg-easy/wg-easy wgpw foobar123

After this command, your will receive password hash.

Important : Please don’t wrap the generated hash password in single quotes when you use docker-compose.yml. Instead, replace each $ symbol with two $$ symbols. For example:

- PASSWORD_HASH=$$2y$$10$$hBCoykrB95WSzuV4fafBzOHWKu9sbyVa34GJr8VV5R/pIelfEMYyG

Step 3: Click Deploy the Stack and wait for the deployment complete.

Access WireGuard Easy:

Once the deployment is complete and the container’s State change to healthy, you can access the WireGuard Easy web interface at http://your_server_ip:51821. Use the password you have set before to login.

Add new Wireguard Client

The Web UI for managing WireGuard is extremely user-friendly and easy to use.

• Click ‘New’ to create a client.
• Click the QR code icon to view the QR code used for setting up the WireGuard client on a phone.
• Click the ‘Download’ icon to download the configuration file, which is used to set up the WireGuard client on a computer.
• Click the ‘Trash’ icon to delete a client.

Configuring NAT Port for WireGuard

To connect to the WireGuard VPN Server from outside, you need to configure port forwarding on your network router (if WireGuard is installed on a server at home) or configure the firewall if it’s installed on a Cloud virtual machine. Configure port forwarding on the router with the following details:

• Protocol: UDP
• Port: 51820
• Address: IP of the machine running wg-easy

Additional Tips

• For enhanced security, consider using a strong password for the web UI.
• Adjust WG_ALLOWED_IPS to control which traffic is allowed through the VPN.
• Use a dynamic DNS service if your IP address changes frequently.
• Refer to the WireGuard Easy documentation for more advanced configuration options.

Conclusion

By following these steps, you’ve successfully set up WireGuard Easy using Portainer. You can now manage your VPN and create client configurations with ease. Enjoy the benefits of secure and private internet access!

Would you like to add more details to this blog post, such as configuring WireGuard clients or troubleshooting common issues?