Introduction

If you know or are entering the world of self hosting (that is, having your own servers at home), you have surely wondered: How can I access my local applications when I am away from home? In fact, even if this self hosting thing sounds like Chinese to you, you may have found yourself in the situation of having a desktop PC at home, going out of it and wanting to access data from that PC from your own laptop. Well, today I bring you a very simple, free and above all secure way, since we do not want any person other than us to get into our network.

And I tell you one thing in advance, it is not any remote control program like TeamViewer or Chrome Remote Desktop, it is something much more sophisticated: it is through WireGuard.

Why not expose ports?

Before explaining how to do it, I want you to first understand well what it is about.

More and more often, people who like the world of technology and programming choose to host services on our own home network. It is no longer strange to hear that someone has set up their own NAS (Network Attached Storage) to store their photos, videos or movies on the home network, with the intention of stopping depending on the Google cloud or other providers. By doing it yourself, although the initial investment is more expensive, in the long run it is much cheaper and, above all, you have wide options.

The NAS is just one example. In your home network you can configure endless services, for example, a Home Assistant to control all your IoT (Internet of Things) devices.

Exposing a port is very dangerous

The “problem” is that these services are only available when you are connected to your home wifi. This could be solved by exposing the specific service port, but exposing a port of a service from your local network to the internet is extremely dangerous due to the speed with which attackers detect and exploit vulnerabilities. A port exposed to the internet can start receiving attack attempts in less than 5 minutes. Automatic scans and targeted attacks on open services are constant and aggressive.

In a typical experiment with honeypots (services designed to be attacked), more than 13 attacks per second were observed, which translates into tens of thousands of intrusion attempts every hour. These attacks try to exploit known vulnerabilities or use default credentials such as “admin” or “root” in services such as SSH, Redis or databases.

My personal experience

I do not have a NAS mounted at home, not for the moment, but the need arose to connect to my home network through my desktop PC. Whenever I went on a trip I wanted to access something I had on that PC. Although there are data clouds to store things or GitHub for the code issue, I always had something left that I wanted to use and could never. Then I came up with the idea of opening a port and allowing the connection with Windows remote desktop from the outside. And well, it worked, although I had to allow several things in the firewall, which made me realize that it was a very serious mistake to expose a remote connection to a PC from your public IP.

The solution: WireGuard

Then I found the solution I should have taken from the beginning: a VPN.

And surely you have all heard of commercial VPNs, like the ones youtubers advertise, which allow you to change your IP to virtually locate yourself in another country and thus bypass regional restrictions. But in our case we are going to use the VPN for something different. A VPN is basically a virtual bridge between your device and another network, in this case, that of our house.

This practice is very common in work environments, where companies have their own services located in an area, and employees, when working from home, must use a VPN to be able to use all those services. This ensures that everything is in a protected internal network and only someone with their credentials can access it.

How to create your own VPN?

Creating your own VPN is simpler than it seems. You only need a Linux device to run it, in my case I am going to use a Raspberry Pi 3B. If you don’t have a Raspberry, you could configure it on a computer, although it is a terrible idea because it would have to be always connected. I recommend using a VPS server, like one from DigitalOcean or the free tier of Oracle Cloud, which is more than enough for what we need.

Configuring WireGuard with Docker Compose

The operation is quite simple. One of the community’s favorite alternatives is WireGuard, since with a simple Docker Compose we will be able to create it in a matter of minutes. WireGuard offers more speed and simplicity than other VPNs, and is compatible with Linux, Windows, macOS, iOS and Android.

Here is the Docker Compose you should use:

version: '3.3'
services:
  wireguard:
    image: linuxserver/wireguard:arm32v7-v1.0.20210914-ls113
    container_name: wireguard
    privileged: true
    cap_add:
      - NET_ADMIN
      - SYS_MODULE
    environment:
      - PUID=1000
      - PGID=1000
      - TZ=Europe/Madrid
      - SERVERURL= #optional
      - SERVERPORT=51820 #optional
      - PEERS=5 #optional
      - PEERDNS=auto #optional
      - INTERNAL_SUBNET=10.13.13.0 #optional
    volumes:
      - /home/edu/wireguard:/config
      - /lib/modules:/lib/modules
      - /usr/src:/usr/src
    ports:
      - 51820:51820/udp
    sysctls:
      - net.ipv4.conf.all.src_valid_mark=1
    restart: unless-stopped
    networks:
      containers:
        ipv4_address: 172.20.0.6

networks:
  containers:
    ipam:
      config:
        - subnet: 172.20.0.0/24

I am using a 2021 version for WireGuard because I didn’t find a more recent one for arm32 architecture. If you have a more recent Raspberry or use a server, you can use a newer version that you will find on Docker Hub.

Starting the service

With this ready, we can do a docker-compose up -d. (Install Docker Compose if you don’t have it).

Then, we open the port on our router and connect. Depending on the peers we have configured, files will be generated that we can see in QR form with the following command:

docker exec -it wireguard /app/show-peer 1

This will show us a QR that we can scan with the mobile to connect automatically. If you are going to connect from a PC, you can use this other command to show the configuration that you must copy and paste in the client that is going to connect:

docker exec -it wireguard cat /config/peer1/peer1.conf

Conclusion

With this, we would already have a VPN connection to our house securely. I hope it saves you the same headaches that it has saved me and is useful to you.

What do you think?

Leave your opinion, question or suggestion. Comments are synced with GitHub Discussions .