0

Plan is to have most of my homelab stay on LAN, but still be able to access it through a WireGuard tunnel. I would use my public IP to set it up, but my IP is dynamic, which means that I would have to use a DDNS. Using a DDNS means that my home IP can be seen on the DNS records and I don't want that. So the next option is to use a VPS with a reverse proxy but I couldn't find a way to set it up in a way that I need it. Is there a reverse proxy that

A. Lets me use WireGuard through it to my home network

B. I can use as a DDNS while

C. proxying the real IP address

Little diagram to maybe help understand

Improve this question

2 Answers 2

Reset to default
2

harrymc’s answer already has the “does it make sense” angle covered. So I will answer the technical side!

Simply put your WireGuard server on the VPS, done! No dynamic DNS needed, only regular DNS, because the VPS IP address will be static. Your home network would connect to this WireGuard server, enabling traffic to and from your home network inside the VPN.

Bonus: This even works when your home network does not have a public IP address (because of carrier-grade NAT).

If you’re fine with others managing things for you, services like ZeroTier or Tailscale could eliminate the need for a VPS or DDNS altogether.

Improve this answer
1

You are trying to achieve Security through obscurity, which is highly discouraged by security experts. It's doubly inefficient when applied to the internet.

People knowing your IP does not make you vulnerable. Thousands of zombie computers are constantly scanning every IPv4 IP in existence for open ports, so hiding your IP is not a security improvement.

Using improper security methods on your network makes you vulnerable, and relying on people not knowing your IP for security is a really bad idea. If your network is properly secured, then you would not care who knows it, because you know that your security can protect you.

If WireGuard is not enough to protect your computer, then sooner or later an attacker will get through. You should work on your defenses, if they are not enough, rather than trusting in hiding.

Take it as given that every few days you computer will be scanned and examined for weaknesses by some attacker, and it won't be using your DDNS, but will rely on brute-force scanning.

I suggest to direct your energies for finding better security defenses than obscurity.

Improve this answer
5
  • I get what you mean, but it seems like you didn't quite get my point. I know that computers are scanning my IP and thats not the problem I'm trying to solve. Lets take real addresses as an example. Lets say you're a victim of ding-dong ditching (DoS). It happens all the time to you! You know it will end soon since you're moving but then you realise: they can find out the address by using your name. So instead of registering your home address to receive your mail, you use poste restante (proxy). Your home address still exists, but none of your mail or ding-dong ditches will go there directly.
    – MoaM
    Mar 10 at 7:08
  • I doubt seriously that anyone will take the trouble to DoS a user - hackers charge money for these services. If you would like to be safe, using a service such as Cloudflare would hide your IP and protect you totally against DoS attacks. This is an over-kill unless you're a company doing business via the web.
    – harrymc
    Mar 10 at 9:39
  • Its not new for hackers to attack someone just because they can. I would need to buy the enterprise plan of Cloudflare to get what I need, and thats not on my budget range. Thats pretty much what my question was about, a self hosted alternative to Cloudflare. Again, if I had a static IP this wouldn't be a problem for me. Also, you're trying to give the impression that with the right security methods its safe for anyone to have your IP. If thats the case, why don't you just give me your IP to prove your point? Why do people want to hide their IP? Why do YouTubers blur their IP in their videos?
    – MoaM
    Mar 10 at 11:13
  • For reasons of privacy. My house is connected to two ISPs and I switch between them when one is encountering a problem. I could also use that as an anti-DoS measure if it ever happens, and you could too (or even your phone as hotspot). Occasionally I check my router's log and see that it was attacked, but never breached, so I feel 97% safe (no one is at 100%). For the other 3% I keep multiple backups. For me that's enough.
    – harrymc
    Mar 10 at 11:24
  • Privacy is also what I'm trying to do. In my case I want to proxy the only IP that leaves with a domain from my house so if someone sees my IP, they'll think its just some random IP and if they see my domain they'll just think its just some random domain and they won't be able to put those together.
    – MoaM
    Mar 10 at 15:35

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .