Homelab 6: reach home from anywhere without opening a port

Level BeginnerEstimated time 30 minRead first Homelab 2: one HTTPS entrance for all your servicesA word you don't know? Glossary

Every port you open to the internet is scanned within hours. So open as few as possible: 80 and 443, to the HTTPS proxy, for the sites that really are public (Homelab 2). For everything else, administration pages, AI models, your notes, build a private network between your own devices. From a café or a train, your phone reaches home as if it were on your sofa, and the internet sees nothing.

Two doors. The public one opens 80 and 443, to the HTTPS proxy only. Everything else, administration included, goes through the private network: your devices reach home, the internet sees nothing.

Two ways to build it

WireGuard, alone: the modern, fast, audited VPN protocol, built into the Linux kernel. One UDP port forwarded to an always-on machine, one key pair per device. Fully self-hosted, a little more manual.
Tailscale: WireGuard plus automatic key exchange and NAT traversal, so no port to open at all. The coordination service is hosted by Tailscale; if you want that part at home too, Headscale is an open-source replacement for it. Your traffic itself goes device to device, encrypted.

We use Tailscale for the convenience; the steps below use it. The principles are the same with WireGuard alone.

1. Join your devices

curl -fsSL https://tailscale.com/install.sh | sh
sudo tailscale up

Do it on each server, then install the app on your phone and laptop with the same account. Each device gets a private address and a name.

On servers, disable key expiry in the admin console. Otherwise, months later, a server silently drops off your private network, usually the day you are away.

2. Publish a service to your private network only

Let the service listen on the machine itself (127.0.0.1), then publish it over HTTPS, to your devices only:

tailscale serve --bg 8765

The service is now at https://<machine>.<your-tailnet>.ts.net, with a real certificate, reachable from your devices and nowhere else. HTTPS matters more than it seems: browsers refuse the microphone, the camera and some APIs on plain HTTP, which is how we serve our voice console to the phone.

3. Or open a port on the private side only

For a service that must listen on the network (an API for your other machines), let the firewall accept it from the private interface only:

sudo ufw allow in on tailscale0 to any port 4000 proto tcp

That is how our model gateway is reachable by every machine of the private network and by nothing on the home network or the internet.

Traps

tailscale serve stays private; tailscale funnel publishes to the whole internet. One word apart: read twice before pressing enter.

A service that listens on 0.0.0.0 is reachable from every network the machine is on, including your home Wi-Fi and its guests. Bind to 127.0.0.1, or filter by interface.

A private network is not a reason to skip passwords: a stolen, unlocked phone is inside it. Keep authentication on every service.

Sources

Found this useful? Tell us what to measure next.