4 ms·

You can create a tunnel from a cheap VM (or appropriately sized set of VMs) in a cloud. It's a different, new calculus. The result is still that you have the s

You can create a tunnel from a cheap VM (or appropriately sized set of VMs) in a cloud. It's a different, new calculus. The result is still that you have the same server power in your home, if that's what you want.

wkat4242 10mo ago
I prefer mesh vpn because it's an extra authentication layer that Cloudflare tunnels don't have. But if you need to offer services publicly it's a good option true.
- vercaemert 10mo ago
  Interestingly, you say this. During my AI-driven research that led me toward tunnels, I found that VPN was the less secure approach. For SSH/Mosh, for example, I chose a WARP tunnel. I set it up with a certificate that expires immediately after each connection. My MFA was explicitly limited to password and Duo SSO Push. As I mentioned, though, my decision was primarily based on an Agent Mode prompt to ChatGPT, so I'm far from an expert.
  - wkat4242 10mo ago
    Why would a VPN be less secure? It's an extra hurdle for attackers to take. You can still use whatever authentication you can on the service. And with a mesh VPN you also don't need to open any ports. However when I look into it it seems like WARP is also a vpn-like service, just a cloud one. Also, I do self-hosting so a "cloud native" solution as cloudflare calls it is explicitly not what I want. If your homelab is all about cloud then of course you would want something like this.
    - vercaemert 10mo ago
      My concern was specifically about other devices on the same home network, outside the homelab, becoming vulnerable. I don't remember the details. Not relevant to you if you don't want to use cloud-native services. Personally, I like proprietary security-oriented code where possible, cloud-native or not. That factored into the decision.
  - GauntletWizard 10mo ago
    AI driven research tells you everything you need to know about your conclusions; there's a hint of truth that's hiding an incredible web of misconceptions. Mesh VPNs as a security mechanism replacing having secure server to server communication is just replacing one soft-center security mechanism with another. Mesh VPNs as the gateway to services that are themselves well secured is well over doubly secure over just having publicly accessible services; now you need the security holes to line up.
commandersaki 10mo ago
Yep I access my raspberry pis using rathole via vm. Easy enough.

wkat4242 10mo ago

I prefer mesh vpn because it's an extra authentication layer that Cloudflare tunnels don't have. But if you need to offer services publicly it's a good option true.

vercaemert 10mo ago
Interestingly, you say this. During my AI-driven research that led me toward tunnels, I found that VPN was the less secure approach. For SSH/Mosh, for example, I chose a WARP tunnel. I set it up with a certificate that expires immediately after each connection. My MFA was explicitly limited to password and Duo SSO Push. As I mentioned, though, my decision was primarily based on an Agent Mode prompt to ChatGPT, so I'm far from an expert.
- wkat4242 10mo ago
  Why would a VPN be less secure? It's an extra hurdle for attackers to take. You can still use whatever authentication you can on the service. And with a mesh VPN you also don't need to open any ports. However when I look into it it seems like WARP is also a vpn-like service, just a cloud one. Also, I do self-hosting so a "cloud native" solution as cloudflare calls it is explicitly not what I want. If your homelab is all about cloud then of course you would want something like this.
  - vercaemert 10mo ago
    My concern was specifically about other devices on the same home network, outside the homelab, becoming vulnerable. I don't remember the details. Not relevant to you if you don't want to use cloud-native services. Personally, I like proprietary security-oriented code where possible, cloud-native or not. That factored into the decision.
- GauntletWizard 10mo ago
  AI driven research tells you everything you need to know about your conclusions; there's a hint of truth that's hiding an incredible web of misconceptions. Mesh VPNs as a security mechanism replacing having secure server to server communication is just replacing one soft-center security mechanism with another. Mesh VPNs as the gateway to services that are themselves well secured is well over doubly secure over just having publicly accessible services; now you need the security holes to line up.

commandersaki 10mo ago

Yep I access my raspberry pis using rathole via vm. Easy enough.