Remote access back to home network

[xiaofan]

Just wondering how people access home network resources from outside, like the router and NAS.

1. Using vendor provided solution:

Some of the solutions use cloud server based solutions which will work behind CGNAT. Some of the solutions may require you to have public IP (and may need to use DDNS since most of the users get dynamic Public IP address).

Asus router remote access from Internet: not working behind CGNAT or Double NAT
https://www.asus.com/sg/support/faq/1000926/

TP-Link router: remote management of wireless routers, with lots of limitations.
https://www.tp-link.com/sg/support/faq/1553/
https://www.tp-link.com/sg/support/faq/1697/

Some people think the above is not secure and prefer to use #2/#3/#4.

2. Using VPN servers like Wireguard, OpenVPN and IPSec. You will need public IP and this may be a problem for users behind CGNAT. IPv6 helps a bit but then you can only use networks with IPv6 access.

You may set up the VPN server on the home network router or other devices like a mini PC or Raspberry Pi.

Asus router Wireguard VPN sever setup guide
https://www.asus.com/sg/support/faq/1048280/

Asus router Instant Guard VPN server setup guide (IPsec based)
https://www.asus.com/sg/support/faq/1044340/

Asus router Instant Guard VPN server setup guide behind another router (Double NAT)
https://www.asus.com/sg/support/faq/1045725/

TP-Link Wireguard VPN server setup for Archer series
https://www.tp-link.com/sg/support/faq/3772/

TP-Link Wireguard VPN server setup for Deco series
https://www.tp-link.com/sg/support/faq/3988/

PIVPN with Wireguard or OpenVPN
https://www.pivpn.io/

3. Using overlay VPN like Tailscale, Zerotier and Netbird. Usually this can work behind CGNAT.

Tailscale KB
https://tailscale.com/kb

Zerotier document
https://docs.zerotier.com/

Netbird document
https://docs.netbird.io/

Nebula document
https://nebula.defined.net/docs/

Netmaker document
https://docs.netmaker.io/docs/about

Twingate (Closed Source)
https://www.twingate.com/docs/

4. Using other remote access solutions like Cloudflare Tunnel and Pangolin

Cloudflare tunnel - you will need a domain name and public IP address.
https://developers.cloudflare.com/cloudflare-one/connections/connect-networks/

Pangolin - Pangolin is a self-hosted tunneled reverse proxy server with identity and access control, designed to securely expose private resources on distributed networks. You need a domain name and public IP address.
https://github.com/fosrl/pangolin

FRP: frp is a fast reverse proxy that allows you to expose a local server located behind a NAT or firewall to the Internet
https://gofrp.org/en/

5. Using things like Teamviewer, RustDesk and Chrome Remote Desktop, to access a specific device at home.

Teamviewer Remote
https://www.teamviewer.com/apac/products/remote/

RustDesk: Fast Open-Source Remote Access and Support Software
https://rustdesk.com/

Chrome Remote Desktop
https://remotedesktop.google.com/?pli=1

6. More options
https://github.com/anderspitman/awesome-tunneling

 

[xiaofan]

I use #1 for TP-Link HB710 (Aginet, no wireguard VPN server function).

Then I use #2 (mainly Wireguard VPN server) for my OpenWRT/pfSense router remote access. Previously I also use Asus Instant Guard when I used Asus router (RT-AX82U and then RT-AX86U) as the main home network router.

But I find using #3 (mainly Tailscale and Zerotier) easier.

 

[thiamhui]

I settle down with Tailscale after switching to SIMBA. With the Subnets option, I can access all device in the home network.

 

[xiaofan]

Indeed Taiscale is nice, especially with the subnet and exit node function. It also works behind CGNAT and Double NAT.

I just started to play with the Subnet function and it seems to be quite useful. I can access different networks at the same time.

Tailscale subnets function.
https://tailscale.com/kb/1019/subnets

Tailscale exit node function.
https://tailscale.com/kb/1103/exit-nodes

 

[kindredSG]

For me - UnifiOS routers with Wireguard server setup. Ridiculously easy to setup and I have both my laptop and iphone automatically turn on their VPN if I'm not on my home SSID - great for traveling.

 

[merriman]

For me, I have Wireguard server running inside a Truenas box. I use it to access the NAS, Nextcloud, Immich and smart home.

 

[orangbulu]

I'm using Tailscale installed on my NAS and mobile devices. I also have pi hole installed on my NAS,

WIth this setup i get adblocking on my mobile devices, and access Starhub TV when I'm overseas.

 

[kashix]

I use Wireguard VPN with my unifiOS Router
Previously tried Teleport but throughput higher on Wireguard!

 

[grynove]

can eli5 what is exit node on tailscale ?

 

[firesong]

Tailscale, Wireguard, and Cloudflare Tunnels for me. I have found different uses for each.

 

[hwzlite]

HomeLab *anywhere* using Kasm Workspaces simply with web browser

 

[xiaofan]

can eli5 what is exit node on tailscale ?

I am not using the Exit Node feature but it may be useful for some use cases.
https://tailscale.com/kb/1103/exit-nodes?tab=linux

 

[BBCWatcher]

Most MikroTik equipment running RouterOS (7.12 or higher) includes their Back To Home feature. BTH provides an end-to-end encrypted VPN connection to your home network. MikroTik runs free relay servers if you need them to get through NAT/CGNAT and firewall barriers, but they only relay the encrypted traffic (can't read it). MikroTik provides Android and iOS/iPadOS apps to set up BTH, although you could fiddle with RouterOS settings to set it up manually if you wish (and to review what the app configures if you wish). BTH uses standard WireGuard protocol, so any WireGuard client works.

On edit: To be clear, you only need one instance of RouterOS somewhere on your home network in order to use Back To Home. If you don't want to use a MikroTik-manufactured device, MikroTik sells perpetual licenses for US$45 each to run their RouterOS on your own Intel/AMD X86 equipment (a mini PC for example). A free trial is available.

 

[joeltng]

I mostly use tailscale, but i have SOME services exposed through DDNS and port forwarding. Hoping to test out unifi solution in the future esp when i move out of my parents place to share server access and maybe sharing one home assistant instance (if it works)

 

[TanKianW]

Personally and professionally, I use/deploy a wide variety of methods/ways/protocols/software for remote access which is subjected to the remote site requirements, use cases and applications. Some could be for keeping myself up to date of the latest technology. Most of these will be in a sandbox network within a (vlan/subnet) firewalled network if I am opening a port. These are the ones I use/deploy:

1) VPN servers could be​

• Self hosted on remote/home network appliances/serverd, eg (VMs) servers, firewall (pfsense), NAS, storage servers (TrueNAS)​
• Self hosted on public cloud like AWS, DigitalOcean, etc​
• SaaS VPN on third party servers/cloud, this could be for clients who implemented zero trust services and requires recursive authentication over VPN or some form of encryption​

2) Different VPN protocols: either WireGuard, OpenVPN or IPSec for ancient/legacy servers/end-points

3) VPN/remote access software like Tailscale, Netbird, Twingate, Zerotier, TeamViewer, Kasm, Chrome remote desktop, MS remote desktop, etc

4) Tunneling/reverse proxies/load-balancer I use could be Pangolin, Cloudflare, HAproxy, Ngnix Proxy Manager, Traefik, etc

End of the day, pick one that best suits your use case.​

 

[Noirkw]

Tailscale on unraid if really need to access / GUI via nanokvm
cloudflare for nextcloud / vaultwarden / etc - geolocked

 

[zerodddd]

I use tailscale

 

[d3adc3II]

Normal method usually by vpn ( ipsec, wireguard) or some forms of mesh overlay-network ( tailscale) or vpn-like ztna ( taiilscale) or reversed-proxy ztna tunnel ( Cloudflare zero trust). All methods give some form of "zero trust" more or less.

Imo, for each use case:
1. If you simply want to connect point A > B : a tailscale is perfect

2. If you look for more VPN-like overlay network , so that from A > connect to B in order to connect to C , and when which dns server to resolve ur request is very important for you: Twingate

3. If you could not install vpn cliient ( computer laptop ) or dont want to run vpn software ( vpn client drain phone battery ? ), and if most of things you want to access are Web based ( most things are web-based in 2025 anyways ?) : either Cloudflare tunnel or Pangolin , they are more or less the same, just that Pangolin you need get a to setup urself, ideally on vps.

4. Last but not least: traditional vpn , for usecase can ut it simply: Wireguard for personal/home, IPSec for corporate. Ignore SSL vpn , its already dead at this point.

Personally, I use 3. 96.69% of the time, I also had Twingate running as standby. Its the best combo for me in most case. You dont need to connect back to home network when ur home network is already part of the "cloud".

I dun really like Tailscale, not sure if it's getting better now, but ii have some issue with it in the past. Mainly due to the nature of mesh network, the connection sometimes change, and II couldnt make it just use certain dns servers ( i need to use 2 dns in Japan HQ to resolve some systems , some I need to point to company dns , while the rest I prefer my house dns lolz ). Maybe skill issue lol but I gave up on Tailscale 2 days, and Twingate make it work right away.

 

[hwzlite]

...
I dun really like Tailscale, not sure if it's getting better now, but ii have some issue with it in the past. Mainly due to the nature of mesh network, the connection sometimes change, and II couldnt make it just use certain dns servers ( i need to use 2 dns in Japan HQ to resolve some systems , some I need to point to company dns , while the rest I prefer my house dns lolz ). Maybe skill issue lol but I gave up on Tailscale 2 days, and Twingate make it work right away.

Do give tailscale another chance, it's under-the-hood WireGuard-Go and had since implemented with Enhance UDP Throughput for QUIC and HTTP/3 . (Note: WireGuard itself does not natively use QUIC or HTTP/3)

Personally, I use Tailscale as a subnet router and also config its Override DNS servers pointing to my AdguardHome (Similar Example: Access a Pi-hole from anywhere )

 

[xiaofan]

For those who use Cloudflare Tunnel, do you have any concerns about the issue that Cloudflare has visibility into tunnel traffic (including sensitive data) due to TLS decryption?

I am not into tgings like Plex or Jellyfin so I do not have concerns of using large amount of data through the tunnel (which may or may not trigger the ban by Cloudflare).