How can I access my home server remotely without port forwarding?
Pick a VPN that dials out rather than sitting there waiting for someone to dial in. Tailscale (a mesh VPN built on WireGuard) works like that, so not one port gets forwarded on your router. Plain self-hosted WireGuard is close: one UDP port forwarded. Way smaller risk than putting Jellyfin or your NAS login page straight on the internet.
Short version, anyway. Which one's right for you comes down to your ISP, how you feel about config files, and who else at home needs in.
Why bother at all? Because anything you put on the public internet gets found. Automated scanners sweep the whole IPv4 address space constantly, and a forwarded port on a self-hosted app starts seeing login attempts and exploit probes pretty fast. With a VPN, the only thing listening publicly is the VPN. Connect, and your services work like you're on the couch at home. It's step 8 in the home-lab checklist I posted earlier (never expose services directly).
Running WireGuard yourself
WireGuard's a small, quick VPN protocol. In the Linux kernel since 5.6. The server will run on basically any little Linux box (a Raspberry Pi is fine) or in Docker, and wg-easy is a popular container if you'd like a web UI. A lot of router and firewall platforms have it built in already: OpenWrt, OPNsense, pfSense and some consumer routers.
Setup, roughly: each device gets a key pair. In the server's config you list every client's public key plus the internal address it's allowed to use. Each client's config points at your home IP and the server's public key. Then you forward one UDP port to the server. 51820 is the usual one, but that's just convention.
Forwarding a port sounds bad after everything I said above. It's less scary than it looks, though. Packets not signed with a key WireGuard knows get no reply at all, so to a port scanner it just looks closed. There's no banner or login page. Nothing to poke.
The annoyances are mostly practical. Your home IP probably changes now and then, so you'll want a dynamic DNS name. Adding a phone means making keys and getting a config onto it, and a QR code makes that a lot less painful. The bigger problem is carrier-grade NAT. Some ISPs put customers behind it, sharing one public IP between lots of people, and then inbound connections just don't reach you. Port forwarding can't work. Self-hosted WireGuard is basically out unless you add a relay somewhere, like a cheap VPS.
What you get in return is no third party at all. Your keys, your server.
Tailscale
Under the hood Tailscale is WireGuard, with the fiddly bits handled for you. Install the client on each device, sign in with Google, Microsoft, GitHub, Apple or some other identity provider, and you're mostly done. Each device gets a stable 100.x address and can reach the others. Connections go outbound and punch through NAT, so there's nothing to forward, and CGNAT stops being your problem. If two devices can't connect directly, traffic goes through Tailscale's DERP relay servers, still encrypted end to end.
For a home lab, a few extras are really useful. A subnet router lets one machine advertise your whole LAN, so the printer or the NAS that can't run the client is still reachable. An exit node sends your traffic out through home when you're stuck on sketchy café Wi-Fi. Access control rules decide which devices can talk to which.
The catch is trust. Tailscale's coordination server distributes keys and knows your device list, although it can't read your traffic. Your tailnet is also only as safe as the account you sign in with, so put a passkey (Matt's password manager and passkey basics) or strong MFA on that identity provider. Don't want to depend on their control server? Headscale is an open-source, self-hosted replacement for it. There's a free personal plan too. The device and user limits have changed over time, so check what they are now before planning around them.
So which one?
Behind CGNAT, it's Tailscale or another mesh VPN, no real debate. Router already does WireGuard, you have a public IP, and you like knowing exactly what's running? Self-hosted WireGuard is hard to beat. And if a partner or parent needs access and won't go near a config file, the Tailscale app is much easier to hand over.
Whichever way you go, being on the VPN shouldn't mean being trusted with everything. A lost phone with a working VPN profile is basically a key to your house. With WireGuard, the server-side allowed IPs plus your firewall rules decide what each peer can reach. With Tailscale, it's the access rules. A phone probably needs the media server. It doesn't need the admin interface of your hypervisor. Same default-deny idea as the segmentation steps.
If a device does go missing, revoke it that day. Delete its peer on the WireGuard server, or remove it in the Tailscale admin console. Tailscale keys also expire periodically by default, which is a nice backstop for laptops. You'll probably want expiry off on always-on servers, though, or they'll drop off at 3 a.m.
– Matt
I'm Matthew (Matt) Donnelly, a New Yorker into IT, cybersecurity and photography in my spare time.
Source: r/u/matthewdonnellyny · by /u/matthewdonnellyny