SelfHosted Gateway - WireGuard Tunnel for secure external access to all of your Self Hosted Apps!

[@draukuxan1081]

This is a handly application, thanks for sharing! Prospective users may need to consider what the bandwidth limitations are for your chosen VPS though. Depending on which app you decide to route through this Gateway, you may end up exceeding the data transfer limits for lower-cost droplets or vps offereings.

[@AwesomeOpenSource]

Yes, exactly. While this is handy, you want to be cautious about transfer limitations, particularly if serving up media content for when you're on the road, etc.

[@FloWmo619]

What bandwith would you say is necessary if I want to stream my media collection if I am on the go somewhere or at a friends house for example?

[@stevendonaldson1216]

More than halfway to 100k subs!

[@AwesomeOpenSource]

It's a bit unbelievable, but very cool that so many people like long-form content about Open Source!

[@yourpcmd]

Thanks for another installment. Just a FYI, Linode is cheaper and has a server in Dallas.😊

[@AwesomeOpenSource]

Thanks for the tip!

[@lightninify]

Hi there - and thanks for making this great video. However it's missing a "make docker" command, which is described in the selfhosted-gateway readme. I think it's likely you had done it before you made the tutorial, which is why everything worked. But for the new user starting from scratch, the make link command will fail because docker can't find the stuff it needs (which apparently gets built when one runs "Make docker" on the client before running Make link.)

[@AwesomeOpenSource]

I installed this on a fresh VPS on the server side, and just followed their instructions. Maybe I accidentally cut it during editing. I'm glad you found it, and thank you for sharing.

[@mistakek]

Nice. I was looking for a solution to this problem about 5 months ago to give my email server a static IP, and also to get around CGNAT for my 4G backup internet, so all my self hosted services have a connection if my main internet goes down. I went the route of installing pfsense in linode and then setting up a wireguard tunnel from my local pfsense to the linode pfsense. Been working perfectly for the last 139 days. It's been set and forget. All HA proxy settings are done on my local pfsense.

[@AwesomeOpenSource]

Very nice!

[@eyesontheworld_]

Great 👍👏👏, thanks for your time.

[@AwesomeOpenSource]

My pleasure.

[@the-MaZe]

The Lack of IPv6 support makes it unsutable for me. Speeking of which, why dont you make Videos about or using the, in all aspects superior (compared to IPv4), Internet Protocol version 6?

[@AwesomeOpenSource]

I'm learning about it, and I'm hoping to start making more on IPv6 soon. Scott over at the Scottibyte channel does a good bit on IPv6 stuff, and Marc over at @Onemarcfifity also has a great starter video on it. I feel like with IPv6 you wouldn't need a wireguard gateway as you can just route directly to your server's public IPV6 address, right? Maybe I'm not thinking of this correctly. But, if you want IPV6 on this project, then you could always make an update and do a pull request, or just make a request on their issues page to have it added.

[@mobalaa9995]

It supports IPv6 if the gateway has an IPv6 address

[@mrhevia]

Hi! I just found this video. I use a Synology NAS with a domain name and Cloudflare tunnel to expose the NAS to the internet without opening any ports on my router. Everything works perfect. However, there is a limitation of 100mb per files when working with Cloudflare tunnels. Therefore, if I share a file request link and the file the user is uploading is greater than 100mb, it won't work. I'm going to try this option to see if I can get the same results I have with Cloudflare but without the 100mb limitation. Thanks!

[@AwesomeOpenSource]

Hope it works. Let me knwo how it goes.

[@bencollinz]

​ @AwesomeOpenSource Does this only work with subdomains? I can't get beyond the nginx error message on the gateway side, even though everything in the logs says it's connected.

[@AwesomeOpenSource]

I only set it up myself with subdomains, but no reason it should work with a domain name too. May depend on which application you are trying to expose. You might ask the project team. I recall them being very helpful when I was going through and testing to get things setup initially.

[@glassguy8875]

At 20:42, I'm lost. I have no gateway directory under /selfhosted-gateway. Unfortunately you skip steps with your premade local server. Might be helpful to just take an ubuntu server and throw docker on it so we can follow along with actual steps to set this up. You did setup the VPS in this tutorial but your local machine was mostly setup before this tutorial. I don't need an answer because I didn't ask a question.

[@AwesomeOpenSource]

I appreciate the feedback. I'll try to keep this in mind for future content along these lines.

[@PetrVr]

I am wondering... What is the difference between this and having just local home-server connected to public VPS through the WireGuard connection and run something like NginxProxyManager on the public facing VPS and proxy the connection?

[@froid_san]

Was wondering the same as I use this exact same setup you mention and is also very easy to setup.

[@AwesomeOpenSource]

No real difference, except this sets up a docker container with wireguard, and does the nginx-setup for you through the scripts. Really no difference at all I imagine.

[@PetrVr]

I see. Thank you for making this clear! Also generally thanks for sharing all of these different ideas etc. I find them very inspiring. You're doing great job! 👍

[@mobalaa9995]

The difference is in the details. This approach adheres to ZeroTrust network architecture. Thanks to Docker (network namespaces) each service gets its own isolated network. While it may be easy to set this up manually for a single service the benefit with this approach is that you can add many isolated services quickly via the make link command demonstrated in the video. No changes to nginx or Wireguard configuration necessary. This simplifies the configuration hassle and makes your setup much more reproducible.

[@PetrVr]

@@mobalaa9995 Make sense. Thanks!

[@s.uboxone]

It's not working for me, I just keep getting http error 503 when I try to access my site

[@AwesomeOpenSource]

Best I can tell you is to check the logs with ‘docker compose logs’ and see if anything jumps out. If not, post an issue to their GitHub or chat space. They were super helpful with me when I did this setup. It definitely may have changed since then.

[@s.uboxone]

@@AwesomeOpenSource Oh hey, thanks for responding! Didn't expect that.. I actually got it to work shortly after commenting this! I can't seem to get it to work with seafile though.. Oddly enough nextcloud works. I run into issues adding the generated snippet to my seafile docker compose. Any suggestions?

[@ep7ta]

Unable to find image 'fractalnetworks/gateway-cli:latest' locally docker: Error response from daemon: pull access denied for fractalnetworks/gateway-cli, repository does not exist or may require 'docker login': denied: requested access to the resource is denied.

[@AwesomeOpenSource]

I don't see it there, so maybe they removed the repository. Not sure why it's not there. Post an issue on their github, in case they don't realize it's been removed.

[@ep7ta]

@@AwesomeOpenSource Thanks for the prompt reply. I'll see if it opens to continue. If it works it will be the best bro. I have set up pfsense behind a modem-router from my provider and I cannot make it just a modem and set pfsense to PPPoE because I won't have a phone. All phone settings are locked inside my provider's modem-router

[@Glatze603]

Hi Brian, I tried to test this selfhosted-gateway, but failed because I use a different ssh-port on the cloud-server.

[@AwesomeOpenSource]

Hmmm. Yes, if they have hardcoded the SSH, it may fail I suppose. Haven't tried that, but the team (at least at the time of the making of the video was quite responsive and helpful. You might shoot them a message and see if they can help.

[@Glatze603]

@@AwesomeOpenSource I opened an issue 2 weeks ago, unfortunately without reaction till now...

[@beauthompson5338]

Hi Brian would this work for a rusdesk or remotely or would a cloud flare tunnel work betterI do not have port access?

[@AwesomeOpenSource]

I would suggest NetMaker (I made a couple of videos on it, and one was to specifically route traffic through Wireguard).

[@beauthompson5338]

@@AwesomeOpenSource ok what i try to do is i have a prxmox server an i I am in us and i went to remote in to a pc in the uk with out opening ports

[@dcmoisan]

I don't have any docker containers on my destination server (the one at home behind CGNA). Is the docker snippet that's generated from the script useable as-is?

[@AwesomeOpenSource]

You'd have to modify it a bit I imagine, the idea behind this is to make your applications accessible from outside. You could just run a proxy container, and put this in it, then proxy traffic from there perhaps. I'd have to think through it a bit. Also, make sure to ask at the project site in their issues section and see if they can provide help on running it outside a container.

[@dcmoisan]

@@AwesomeOpenSource I read the Git code and instructions, but I was really lost. I have two cloud hosts and subdomains set up, no problem. I have an Icecast server for a radio scanner feed inside my house in a Debian VM. I have the idea of using Wireguard on one of cloud endpoints and a reverse proxy like caddy or nginx. I don't want to be handheld, but I am lost at this point. Thanks.

[@AwesomeOpenSource]

Take a look at my recent Netmaker tutorials. I did one where I show how to install and setup egress and ingress, and one where I setup a reverse proxy on my cloud node and use it to forward traffic into my home network without having to open any ports. I think this may be what you need.

[@OlindoPindaro]

Is the registration of domain mandatory?

[@AwesomeOpenSource]

For this application as it was setup at the time, it seemed like the least path of resistance to have a domain ready. If you are just wanting to have an IP, maybe check out something like straight wireguard, possibly Tailscale / Headscale.

[@OlindoPindaro]

@@AwesomeOpenSource using wireguard stand alone is not a problem, i deploy a test on digital ocean. My problem is how to provided access to my home network by vpn created. Is missing the last pieces of the puzzle. How to address the single node on Home network? Thanks a lot for your suggestions

[@OlindoPindaro]

@@AwesomeOpenSource very interesting headscale tailscale probably is what i need

[@michaell7511]

How do you tunnel this to a locally installed proxy server like Caddy or Nginx Proxy Manager so NPM or Caddy can handle the actual proxying for local services and apps that one wants exposed?

[@AwesomeOpenSource]

I would have to think about it, but I think you could set the tunnel up on the compose file for your NGinX Proxy manager, so all requests are pushed to it, then let it handle your traffic around your network.

[@leopard289]

@@AwesomeOpenSource I tried this, however I am stuck. I 'published' the Nginx Proxy Manager like I publish any app, established the tunnel, tunnel is UP. but traffic does not flow BEYOND NPM. So I can reach NPM from outside, but not hosts present in NPM

[@mikebru10]

Which solution is better for routing traffic into your network, Nginx Proxy Manager or this solution. I’m looking at hosting 25 or 30 services on my home network but I have dynamic ip to be concerned with, and my ISP blocks ports 80, 443, and pop3 and imap ports.

[@AwesomeOpenSource]

I would definitely consider a tunneling solution given the hinderances your ISP is putting in place. Mail servers may not be possible, but you should really never run a mail server from home anyway if you don't have a static IP and open ports.

[@farshidazadyghalehtaki1969]

hi ,i am in IRAN unfortunatly Every things baned here in iran.And The wireguard has not Recive only send.would you please how my clients connect by wireguard client in android or ios with this tunnel? I need to help please!/ appreciate you and Your Team please answer me as soon as posible

[@AwesomeOpenSource]

Without seeing your setup it's hard to know what you have set.

[@Goldcrowdnetwork]

I'm unclear on this point "4. You need to make sure your users SSH keys from this server are set for use on the VPS, just lilke we did above. Then, run the following to make sure SSH is ready on the system." I generated an ssh key pair on my workstation and copied it to the VPS server and then copied it to the client server. I then ran these commands on the client server eval `ssh-agent -s` and ssh-add ~/.ssh/id_rsa (this second command kicked back ".ssh/id_rsa: No such file or directory") Are the client server and the vps server supposed to have their own key pair different than the one between my workstation and the client & VPS server?

[@AwesomeOpenSource]

I think the idea, is that the server needs to tell the client (or vice-versa) how to generate parts of the code that links them together, so they want you to have the SSH keys in place. The keys (I don't believe) don't have to be the same on each machine, but the machines should be able to communicate over SSH using keys.

[@anurag-vishwakarma]

Can i use it for media streaming? Like Nextcloud.

[@AwesomeOpenSource]

Should be able to.

[@bkcy18]

Any opensource and selfhosted alternative to ilovepdf that anyone knows of? Need something like that for my organization. Requirements: merging, splitting, rearranging, compressing and watermarking pdfs.

[@AwesomeOpenSource]

I've not personally ome across anything, but that doesn't mean it doesn't exist. You might ask on the self hosted sub-reddit (reddit.com/r/selfhosted)

[@Big_Kahuna]

is use pdfsam

[@Glatze603]

Hi Brian, thanks for your time to make this video, but this project seems far too much configuration and too complicated in case of a crash! I've tested many solutions: NPM, Wireguard, Printunl,... but the easiest, cheapest and most secure solution is Cloudflare Argo Tunnel. No server required, no open ports, minimal configuration in your homelab (you need a blanc ubuntu server) instead a multi-tiered application firewall in Cloudflare's web dashboard - you have to check it out!

[@AwesomeOpenSource]

I have seen what cloudflare and Argo have to offer, and indeed they are some great services. I just like to provide options for folks to know what's available out there in the open source world.

[@Glatze603]

@@AwesomeOpenSource I forgot to mention rport and teleport

[@mobalaa9995]

This solution is closer to true ZeroTrust architecture because you control both sides of the tunnel. Another benefit to this approach is that each service has complete network isolation from other services and the underlying host. Not to mention this is effectively a no code solution relying only on Docker, nginx, WireGuard.

[@Glatze603]

@@mobalaa9995 That's correct, but I wouldn't call the applications, systems and methods used (docker, nginx, authelia, etc.) "my control", since there can also be errors and vulnerabilities in the code here. Nevertheless, I believe that we are on a fairly high level of safety here, so everything is fine. I see the advantage of CF in the fact that on the one hand I neither need a dedicated cloud server ("Deutsche Glasfaser" > CGNAT), nor that I have to open ports to the outside and on top of that I can define further application rules to protect my services (e.g. country of origin , login method, mail domain etc.). That gives me an even better feeling of security, even if that's partly due to CF. Incidentally, the traffic from Cloudflare ends up on a dedicated server in my DMZ, from which only the required traffic (port, protocol) to the relevant internal server is allowed - so here's another security aspect.

[@mobalaa9995]

Those are all fair points. I think it depends mostly on how “independent “ you want to be of 3rd party providers. With CF if they raise prices or change their terms of use you will be stuck looking for another solution. With this selfhosted-gateway you can deploy anywhere with a public IP address. I agree that CF has many more features for now but we hope to add the same capabilities to this open source solution. Thanks for the reply.

[@VitorHugo-hd8bw]

Their readme says that docker on the client is optional, but I'm failing to see how can I expose a service that is not running on docker. Do you have any idea? I have a few services running directly on LXC containers on Proxmox and I'd like to expose them.

[@AwesomeOpenSource]

I remember seeing that as well, but I think maybe they meant the server doesn’t require it. Not sure though. Ask on their GitHub and see what they say.

[@VitorHugo-hd8bw]

@@AwesomeOpenSource Thank you for the reply. I asked directly on the CEOs twitter (he usually comments here too) and I'm waiting for a reply. The server definitely requires docker.

[@DamjanDimitrioski]

Silly question, does it costs a lot of CPU to just forward the request via the tunnel ? Reason I ask is whether the 512 ram Droplet's instance would be sufficient :) ?

[@AwesomeOpenSource]

It will depend on how many sites you wan to forward. I woudl guess that 512 will handle several sites without issue. Keep in mind, that there are also transfer limits on droplets. So, if you're using something like streaming movies, that limit could potentially be reached. I'm guessing the traffic is proxied all the way, and there's not a peer connection made to the server from your local device.

[@mobalaa9995]

CPU load will depend on traffic. For low traffic services the concern is not CPU but RAM. Each link takes approximately 5mb of RAM so there is a limit on the number of links a system can support. You can route many services through a single link but then you lose the benefit of the ZeroTrust network architecture this project provides.

[@DamjanDimitrioski]

@@mobalaa9995 Another question, if I get a load balancer or an option with multiple IP addresses, can I allocate each IP to a given tunnel ?

[@mobalaa9995]

@@DamjanDimitrioski that should be possible but it would be helpful to have more context on what you want to achieve. Drop by our Matrix channel and we can discuss further: matrix.to/#/%23fractal:ether.ai

[@ricardobreddels123]

Damn I'm kinda crying now, i basically did the same, but on a very hard way, this solution is definitely wat better, atleast i think so, cuz my hone connect is fully gnat, so no ports are open on my shared non real public ip, Do you think this will work too? Cuz i might gonna change my setup to something close to this. ❤️ Thanks anyway i like the way you showing but also teaching many others!

[@AwesomeOpenSource]

Definitely give it a try, it's really great stuff.

[@ryanp787]

Great video Brian!! Have you heard of Tailscale and Teleport? Both are great tools that are similar.

[@garylovesbeer]

Tailscale is a freemium product.

[@AwesomeOpenSource]

I have. I haven't done Tailscale yet, but want to in the future, more around Headscale though. Teleport, I need to tackle as well, just haven't gotten there yet.

[@cdoublejj]

what if i run windows server? with windows native hosting apps?

[@AwesomeOpenSource]

This just runs on Docker and Docker-compose... not sure how you would get it going with native. I'm working on another video for Wireguard that may help with your specific setup.

[@cdoublejj]

@@AwesomeOpenSource that would be awesome as, as much as I love Linux I can't always run it on ever application/use case

[@luilu9167]

Can I use this to give my friends access to my server an the dedicated server for games hosted on my server? My problem is, that I only have D's lite due to my fiber provider. So far, everything I tried, failed... Will this work?

[@AwesomeOpenSource]

So, in theory this should work. If you don't have a VPS provider, and you just want to try it out, you can use the Digital ocean link in the description to get a $50 credit, then cancel if it's not working for you.

[@luilu9167]

@@AwesomeOpenSource thank you then I will give it a try this weekend. Until last year I had 6mbit down, 0.5mbit upload but my own ipv4. I could use one of my computer as server, but it was slow as hell. Now I have fiber with 600/300mbit and only dslite and can't use my server anyway. Things changed but did not get any better... Hopefully your tool will help:)

[@sidneyking11]

I have a question that is a little off the topic. I want to be able to vpn into my home network when I am out of town using my macbook. I do not know what to setup in order to accomplish this. I have a proxmox host server and can setup a ubuntu vm. what do you suggest?

[@AwesomeOpenSource]

If you are trying to just get into your network, then you can use the same concept, but use the Pritunl VPN open source option. I use it for that purpose, and it's great, easy to setup, and has easy to use clients for all the OSes. kzbin.info/www/bejne/aX_VmZunid2XrKM

[@raihan7871]

could you please one creat using wg ui docker image.

[@AwesomeOpenSource]

I'll see if I can work on it in the future.

[@iamrage4753]

Super guide Brian, this looks great just need to workout how to do this on a dynamic ip and what dns service is best to use....on the server i was planning to use a pi4 to cut down on vps costs etc

[@AwesomeOpenSource]

You might look at the docker containers for your registrar if you have a domain you want to use, and see if there's is a DDNS container for them. I use one for Cloudflare, so I get an updated IP, same for GoDaddy.

[@iamrage4753]

@@AwesomeOpenSource so the ip updater docker runs on the server to monitor ip change? i don't think duckdns supports wildcard dns etc so i'm guessing for each service i would like to point to a url i would need to create a specific url

[@AwesomeOpenSource]

DuckDNS doesn't as far as I know, but if you had your own domain, like my-super-great-domain.org, then you could use CloudFlare DNS, and a cloudflare dynamic updater to keep your IP up to date. Was just throwing that out there.

[@iamrage4753]

@@AwesomeOpenSource can you recommend a good service for getting a domain pls?

[@AwesomeOpenSource]

I like Hover. I've used them for a lot of domains, their DNS controls are great, and their chat support is tops as well. I have a code in the contact section of my video descriptions that can give you a discount with them as well. There are plenty of good registrars out there though.

[@luwk]

Is this better then cloudflare tunnel

[@AwesomeOpenSource]

I can't say specifically, as "better" is often objective. But I prefer to control the mechanism behind the tunnel, even if I don't own the physical hardware. If Cloudflare tunnels work for you, then by all means use them. I'm just providing options.

[@charlesromney]

I need some help with the wireguard vpn and reach my NAS services using https and my certificate. At this moment I can reach everything using their ip addresses. I can reach them internally or externally without the vpn using my domain name and my ssl cert but the issue is with wireguard. Anyone could let me know what I'm missing. Thanks.

[@AwesomeOpenSource]

I'm not following what this issue is. You can reach things by IP and by domain, so what is it you are asking for?

[@charlesromney]

@@AwesomeOpenSource How to access the devices/services using my domain name (reverse proxy)and encrypted thru the vpn. I hopes that this clarify my question. 😀

[@ThomasPoth]

👍👍👍

[@AwesomeOpenSource]

Thank you.

[@The1neo34]

I may suggest using the cloudflare tunnel / gateway instead of hosting your own wireguard gateway.

[@AwesomeOpenSource]

Indeed, Cloudflare is an option, but if you want to control both sides of the tunnel (more control anyway), then this, to me is the better option. IF Cloudflare works for you, by all means, use the tool that works best for you.

[@simuman]

Hi great vid. I'm just stuck in this loop, which I think is ISP blocking ports as I can't figure out what I'm doing wrong otherwise. Has anybody tried to do something like this in Truenas Scale as I can't seem to get external access to local network to work no matter what I try (including Cloudflare tunnelling).

[@AwesomeOpenSource]

Interesting that you can't. but maybe do an outgoing portscan and see if there are certain ports being blocked?

[@Maleko48]

🥇

[@jasonji1152]

another great open source project specifically made for intranet penetration - FRP. check that out

[@AwesomeOpenSource]

open source + ingenuity = freedom

[@navarrohillsranch]

I have tried a couple times to get this to work. I keep getting the following error on the last step. Unable to find image 'fractalnetworks/gateway-cli:latest' locally docker: Error response from daemon: pull access denied for fractalnetworks/gateway-cli, repository does not exist or may require 'docker login': denied: requested access to the resource is denied. See 'docker run --help'. make: *** [Makefile:16: link] Error 125 Any insight would be greatly appreciated.

[@thebalaa]

Running "make docker" should resolve this

[@navarrohillsranch]

@@thebalaa Thank You!