Secure Remote Access: VPN, SSH, and Zero-Trust Options

WireGuard-first is the default pattern

Exposing every admin UI with only a password is fragile. Our documented default on Orivana review benches: WireGuard (or Tailscale when you want a managed control plane) for admin paths; reverse proxy only for apps that must be public — Immich for family, maybe a status page.

Vaultwarden, Homarr, Portainer, and Grafana stay VPN-first. If a service does not need to be reachable from the open internet, it should not be. That single decision removes more attack surface than any obscure `sshd_config` tweak.

Minimal WireGuard on the homelab host

We often run wg-easy or linuxserver/wireguard in Compose on the same Proxmox VM that hosts the edge stack. UDP 51820 is the only inbound port besides 443.

services:
  wireguard:
    image: lscr.io/linuxserver/wireguard:1.0.20210914
    cap_add:
      - NET_ADMIN
      - SYS_MODULE
    environment:
      - PUID=1000
      - PGID=1000
      - PEERS=phone,laptop,tablet
      - INTERNAL_SUBNET=10.13.13.0
    volumes:
      - ./wireguard:/config
    ports:
      - "51820:51820/udp"
    sysctls:
      - net.ipv4.conf.all.src_valid_mark=1
    restart: unless-stopped

Client configs get `AllowedIPs` scoped to homelab subnets — not `0.0.0.0/0` unless you explicitly want full-tunnel. More on that below.

SSH still matters — hardened, not heroic

SSH is break-glass and automation transport, not your primary admin UI. Keys only, passwords off, root login off.

sshd hardening bullets we apply on every bench:

• `PasswordAuthentication no` and `KbdInteractiveAuthentication no`
• `PermitRootLogin no` — use a named operator account in `sudo`
• `AllowUsers ben` (or your operator list) — not every account on the box
• `MaxAuthTries 3` — fail fast, review logs
• `AllowTcpForwarding no` unless you have a documented jump-host reason
• Keep OpenSSH current; distro security updates beat custom compile drama

Non-default SSH port (e.g. 2222) is a mild speed bump against background noise — not security. Fail2ban or crowdsec helps when bots hammer 22/tcp anyway.

# after editing /etc/ssh/sshd_config
sudo sshd -t && sudo systemctl reload ssh
# verify from a SECOND session before closing the first
ssh -p 2222 ben@homelab.example.com

Split tunneling and captive portals

Decide whether phones route all traffic through the home network or only private subnets. The choice affects battery, DNS, and whether hotel Wi‑Fi works at all.

Operator note: full-tunnel WireGuard (`AllowedIPs = 0.0.0.0/0, ::/0`) killed captive-portal login at a hotel — the phone tried to route the portal page through home, failed, and never got internet. Switching the phone profile to split-tunnel with only `10.13.13.0/24` and `192.168.10.0/24` let Immich and Vaultwarden work while normal browsing used the hotel gateway.

Terminal-style reminder we keep in STACK.md:

# phone peer — split tunnel (Orivana review-host default)
AllowedIPs = 10.13.13.0/24, 192.168.10.0/24

# laptop peer — full tunnel when on untrusted café Wi‑Fi (optional second profile)
AllowedIPs = 0.0.0.0/0, ::/0

Two profiles beat one compromise config. Name them clearly in the WireGuard app.

Public apps vs private admin

Reverse proxy + TLS + SSO (Authelia, Authentik, or Cloudflare Access) for anything that must face the internet. VPN for everything else. Mixing "Portainer on :9443 with a strong password" into your public DNS is how review benches get interesting log files.

If you must expose SSH, prefer key-only auth behind a known-IP allowlist or a small VPS jump host — not raw 22/tcp on a residential IP the whole world can find.

Document break-glass access

If the VPN dies, how do you recover? Keep an out-of-band path: Proxmox console, IPMI, physical keyboard, or a second VPS you can reach without the home tunnel.

Break-glass drill we run quarterly on a review host:

1. Disable the active WireGuard profile on your phone (simulate lost keys).
2. Confirm you can still reach Proxmox or the host via console / alternate network.
3. Regenerate peer configs from backup or wg-easy UI.
4. Time the process. If it takes longer than 30 minutes without panic, document what slowed you down.

Paper or offline copies of emergency steps beat memory. Digital-only runbooks fail when the only machine that can open them is the one behind the broken VPN.

Log and review

Remote access logs tell you who connected when. Review them occasionally — monthly is enough for a household lab.

# quick WireGuard peer check
sudo wg show
# recent SSH auth (adjust path for your distro)
sudo journalctl -u ssh --since "7 days ago" | grep -E 'Accepted|Failed'

Unexpected sessions deserve investigation even on a personal network. A login from a country you are not in is worth a password rotation and a peek at `docker ps`.

Zero-trust overlays when VPN feels heavy

Tailscale, Headscale, or Nebula can reduce port-forwarding pain for relatives who will never edit a `wg-quick` conf. They still belong in your threat model: identity provider trust, ACL files, and key expiry matter.

We document mesh tools as alternatives — not replacements for knowing which subnets exist and which compose projects publish ports.

Lab notes from careful ops practice

Default pattern: WireGuard for admin; reverse proxy for public HTTPS. Vaultwarden and Homarr are unreachable from WAN without the tunnel.

Hotel captive-portal failure taught us to ship split-tunnel phone profiles by default and keep a full-tunnel laptop profile optional.

Break-glass drill caught a missing Proxmox console password once — fixed before a real outage, which is the whole point.

SSH on 2222 with keys-only cut auth noise by ~90% on a bench VPS; the remaining 10% is why fail2ban stays enabled.

Related reading

See Docker Compose hardening, reverse proxy TLS basics, and backup strategy for the stack that sits behind your tunnel.