5 ms·

I have a similar setup but instead of SSH Tunnels i use wireguard. In my case some services are not routed to the public internet and only accessible from with

by lhoff 6y ago

I have a similar setup but instead of SSH Tunnels i use wireguard. In my case some services are not routed to the public internet and only accessible from within my privat wireguard network. E.g my smart home hub. I really like the flexibility to decide whats available for who.

allthingsequal 6y ago
Could you please elaborate on your setup? I haven't had the opportunity to play with Wireguard yet, that could be a useful first project to me :-)
- hakeberio 6y ago
  Pivpn is beginner-friendly and you can always branch off from there. https://www.pivpn.io https://www.pivpn.io
- vsajip 6y ago
  I've started playing around with Tailscale [1], which is based on WireGuard. Free to use for a single user, and I've tried it out on Raspberry Pi, Linux x86_64, Windows and Android. Seems to work well, except there appears to be some issue with accessing Windows via the secure IP (neither ping nor Remote Desktop appear to get through the Windows firewall, despite having a specific firewall rule for Tailscale) [2]. Can SSH into e.g. Linux hosts using PuTTY from Windows without issues. [1] https://tailscale.com/ https://tailscale.com/ [2] https://github.com/tailscale/tailscale/issues/854 https://github.com/tailscale/tailscale/issues/854
- 8K832d7tNmiQ 6y ago
  the idea is that your hetzner server acts as a gateway and you can communicate with your pi through the virtual private network, therefore removing any need to access through public ip.
twicetwice 6y ago
I did the same. It works really well for hole-punching through my stupid Comcast router! And I anticipate it will continue to work really well as I add more devices on my parent's, sibings', etc networks. It's cool to not have to think at all about where my devices are, since they're just all directly accessible through their dedicated IP on the wireguard VPN. I also have my phone, laptop, etc all on the wireguard VPN, so I can ssh to anything from anywhere. I also have my laptop open to password-based ssh only from my wireguard VPN, so I can ssh (via termux) into my laptop, which has been extremely convenient in addition to being just plain cool. I can't speak highly enough of wireguard!

by lhoff 6y ago

allthingsequal 6y ago

Could you please elaborate on your setup? I haven't had the opportunity to play with Wireguard yet, that could be a useful first project to me :-)

hakeberio 6y ago
Pivpn is beginner-friendly and you can always branch off from there. https://www.pivpn.io https://www.pivpn.io
vsajip 6y ago
I've started playing around with Tailscale [1], which is based on WireGuard. Free to use for a single user, and I've tried it out on Raspberry Pi, Linux x86_64, Windows and Android. Seems to work well, except there appears to be some issue with accessing Windows via the secure IP (neither ping nor Remote Desktop appear to get through the Windows firewall, despite having a specific firewall rule for Tailscale) [2]. Can SSH into e.g. Linux hosts using PuTTY from Windows without issues. [1] https://tailscale.com/ https://tailscale.com/ [2] https://github.com/tailscale/tailscale/issues/854 https://github.com/tailscale/tailscale/issues/854
8K832d7tNmiQ 6y ago
the idea is that your hetzner server acts as a gateway and you can communicate with your pi through the virtual private network, therefore removing any need to access through public ip.

twicetwice 6y ago

I did the same. It works really well for hole-punching through my stupid Comcast router! And I anticipate it will continue to work really well as I add more devices on my parent's, sibings', etc networks. It's cool to not have to think at all about where my devices are, since they're just all directly accessible through their dedicated IP on the wireguard VPN. I also have my phone, laptop, etc all on the wireguard VPN, so I can ssh to anything from anywhere. I also have my laptop open to password-based ssh only from my wireguard VPN, so I can ssh (via termux) into my laptop, which has been extremely convenient in addition to being just plain cool. I can't speak highly enough of wireguard!