Networking

Publishing a homelab without opening a port

Nothing in my homelab is reachable by opening a hole in the router, because there are no holes. Everything external goes out through a tunnel, and everything private sits behind an access policy.

The usual approach, and why I skipped it

  • The common homelab pattern is port forwarding plus dynamic DNS.
  • That exposes the origin address and puts services directly in front of the open internet.

The architecture

  • External exposure is exclusively through Cloudflare Tunnel: the connection is outbound, so no inbound ports are open.
  • Cloudflare Access sits in front of anything that is not meant to be public.
  • No port forwarding and no dynamic DNS anywhere in the design.
  • The tunnel daemon runs on a cluster node rather than on the storage server, so the box holding the data is not the box terminating public traffic.

WireGuard is a different job, not a backup plan

  • Separately from the tunnel, WireGuard runs on the gateway as a private mesh for my own devices.
  • These are not redundant paths doing the same thing. The tunnel publishes specific hostnames to the public internet, with an access policy in front. WireGuard puts my laptop or phone back inside the network as if it were at home.
  • Keeping them separate means the public surface stays deliberately small: it is only what I chose to publish, not everything I can reach.
  • Neither one requires an inbound port on the router.

Designing a public surface that is safe to show

  • The public site publishes architecture and decisions, not topology.
  • Internal addressing, VLAN layout, hostnames, and the full service inventory stay unpublished.
  • The line I settled on: publish the architecture and the reasoning, never the map. How something is designed is interesting and safe. What is running at which address is neither.
  • The test I apply is whether a detail would help a stranger understand my thinking, or help them find something. Model numbers and service inventories fail that test.

What I would tell someone starting out

  • Start from outbound-only. A tunnel is easier to reason about than a forwarded port because there is no listening service on the public internet to get wrong.
  • Put the access policy in front of the service, not inside it. Application-level auth is one bug away from being no auth at all.
  • Decide what is public on purpose. The default of "whatever I happened to expose" is how homelabs end up in search results.

More

← All writeups