Interestingly this is something I have been thinking about as well. But I don't really feel comfortable with a full connection between a bridge and home network. I suppose this isn't that different from exposing a server in your physical network to the internet. But it still does give people potential access to your entire network when something on the bridge is configured wrongly.
Recently I did experiment with using autossh portforwarding a specific localip and port to a "bridge" vps. Where the used ssh key is restricted. The idea being that I could combine this in a docker config and just spin up a docker container to only forward traffic I want forwarded.
Which did work fine for the application I used it for, though I can imagine that due to the type of connection not all web applications work well.
But I don't really feel comfortable with a full connection between a bridge and home network. I suppose this isn't that different from exposing a server in your physical network to the internet. But it still does give people potential access to your entire network when something on the bridge is configured wrongly.
You can practice defense in depth to minimize risks by:
Keeping the home peer in a network DMZ. Consider using that machine just for that purpose.
Compartmentalizing. Use that VPS exclusively for the bridge and nothing else. Consider using an OS like OpenBSD that makes it easy to establish the bridge with built-in tools: pf, wg, and, if using DNS for custom domains within the WireGuard network, unbound.
Limiting the scope by only allowing what's needed. If you're just accessing web apps, the home peer should only allow incoming tcp on port 443 from the bridge ip, or if running WireGuard on the router then it should only forward as such.
Keeping everything up to date.
A while back I wrote an article on my blog on WireGuard topologies for self-hosting.
creesch | 6 hours ago
Interestingly this is something I have been thinking about as well. But I don't really feel comfortable with a full connection between a bridge and home network. I suppose this isn't that different from exposing a server in your physical network to the internet. But it still does give people potential access to your entire network when something on the bridge is configured wrongly.
Recently I did experiment with using autossh portforwarding a specific localip and port to a "bridge" vps. Where the used ssh key is restricted. The idea being that I could combine this in a docker config and just spin up a docker container to only forward traffic I want forwarded.
Which did work fine for the application I used it for, though I can imagine that due to the type of connection not all web applications work well.
ggpsv | 2 hours ago
You can practice defense in depth to minimize risks by:
A while back I wrote an article on my blog on WireGuard topologies for self-hosting.
fazalmajid | 5 hours ago
Usually you also need to adjust MTU lower for this to work
Foxboron | 4 hours ago
I run the same setup at home currently with a VPS at the local hackerspace. A similar post was written by mjg about the same thing.
https://mjg59.dreamwidth.org/72095.html
tobz619 | 3 hours ago
I've got a similar thing going with an Oracle free forever VPS. Too scared to wean myself off of Tailscale right now though :(
baetylboy | an hour ago
Unrelated but I love the initial at the start of the article
singpolyma | an hour ago
If I have to pay for a VPS anyway, why not run my services on it?