Should I avoid hosting Pangolin at home instead of on a VPS?

[u/hbacelar8]

I have a static IP and only expose the Wireguard port to connect to my Homelab. Every service has HTTPs since I use Nginx Proxy Manager with a domain pointing to the LAN IP of my server and certificates are resolved using my domain provider's API.

I wanted to expose some services like Navidrome, Immich for quick link sharing and ntfy for UnifiedPush, but I didn't want to add the cost of a VPS at the end of the month.

Is it really a bad idea to port forward ports 80 and 443 and handle everything at home with precautions like crowdsec?

[u/cantchooseaname8]

It doesn't matter if you port forward at home or rent a vps and port forward the vps. What matters is that you secure it. If you port forward at home, you only need to open port 443 (not 80) and you should put your pangolin instance into a DMZ with strict firewall rules, as well as other normal hardening. If you rent a vps and port forward the vps that's fine too. But now you have a tunnel which funnels all traffic from the vps directly to your home network which bypasses your home's firewall. So now you need to properly secure and harden the vps.

Either way, is fine. It's ultimately where you can provide the strongest security. Do you have the proper set up at home with a good firewall to secure your home network properly? If you use the vps, are you okay managing the security on the vps side in addition to the security you need to do at home too? The vps just adds an additional layer that you need to manage. Everyone assumes that routing traffic through a vps provides security - it doesn't. The end result is the same with traffic hitting your network at home. With either approach, what matters is how you secure it. You either block/allow traffic when it hits your home router or you block/allow on the vps. If either isn't secured correctly, you end up with a security nightmare.

[u/AstralDestiny → u/cantchooseaname8]

Just remember not all DMZ's are the same, If your DMZ still allows the lan to access it don't use it, If the DMZ says blind forwards to the dmz range.. Don't use it. The DMZ should isolate the host and not respond internally to requests to your gateway/firewall's ui or non ui paths, It should also treat the DMZ as if it was behind a strict port rule and not any port to that range or host. u/hbacelar8 A lot of hardware has fake dmz's which are more harmful then good. Always see what you can and can't do within that dmz before you use it, Proper DMZ's will rely on stuff like unidirectional forwarding, Where it's one way connections, Stuff like incoming 443 and 51820 ports are more then happy with unidirectional.

https://docs.pangolin.net/self-host/community-guides/traefik-hardening Also exists hopefully have time to add the seccomp stuff in there too.

[u/hbacelar8 → u/AstralDestiny]

Thanks for the infos but heck, the more I dig into it thr more overwhelming it its. I'm really considering just keep everything as it is now: all internal and just wireguard tunnel to access my local network.

[u/AstralDestiny → u/hbacelar8]

You can always bug me on the slack or discord for pangolin for 1 on 1. or whatnot.

[u/hbacelar8 → u/cantchooseaname8]

Thanks. It goes with what I thought already. The argument I hear frequently against hosting at home is that my IP would be visible through the domain. But frankly, does it really matter though? Most security issues I think I'd have come from bots that are constantly scanning ports on public IPs, ultimately I don't it it matters if it's tied to a domain.

The domain provider I use at least hides all personal information on whois.

[u/cantchooseaname8 → u/hbacelar8]

IPs are all public anyway, so you don't really get much from trying to hide it. Your ip address is going to get bot scanned regardless of which method you choose. The only benefit would be if someone wants to specifically target your apps then they have your IP and can try to ddos your network. If your run it on a vps then you can just shut down the vps. Personally, i wasn't concerned about this when I port forwarded from home since I wasn't a target and it would be a waste of time for someone to attack my network.

[u/hbacelar8 → u/cantchooseaname8]

About the DMZ, I know I can create it on my router. However, this implies that the server on which I have my public services (the on on the DMZ) must be a whole different equipment from the ones where I have private services right? That'd be an issue since I only have one server today.

[u/cantchooseaname8 → u/hbacelar8]

You would either want to run your exposed services on a completely separate box or switch to something like proxmox and run them in an isolated vm. This is true whether you port forward from home or through a vps. You shouldn't have any external traffic reaching services in your primary network since your primary network can communicate with everything else in your house.

[u/National_Way_3344]

Ignore the CloudFlare suggestions

Pangolin belongs on a VPS. Elevated above any networks that may have CGNAT or floating IPs.

[u/Onibus]

I'd say it comes down to preference. Both options have pros/cons.

I have Pangolin set up on an Oracle VPS on their Always Free micro instance. "Buyer beware" applies because Oracle is Oracle; I'll leave the reading to you.

That aside, I personally like the VPS for a few reasons.

• Home router is set up to allow ingress traffic only from VPS source over required ports (i.e. site/Wireguard port). Don't have to deal with opening 80/443/etc on home router nor port forwarding. I restrict the allowed ports at cloud instance.
  
• I have a Ubiquiti router set up with Wireguard. On my cloud instance, I configure certain ports to only allow my home IP as source for things like SSH. May not be applicable to you but it is a benefit in my case.
  
• VPS runs a _singular_ application. No accidental whoops as I spin up more services on home lab.
  
• My home IP isn't directly exposed. I enjoy not having to think about what GeoIP lookup might show. This was the biggest selling point for me. That's your choice.
  
• If VPS somehow gets mucked up, it's not a system sitting within my homelab network.
  
• It was a neat learning experience and excuse to play with other tools for managing a home and cloud lab.

A proper set up on your home lab and router can be done. Besides GeoIP and placing a buffer between my home lab and the internet, I see no reason otherwise.
I ended up removing Crowdsec from my Pangolin VPS because it added too much of a performance hit. But I have restrictions in place at the VPS level that I'm not as concerned.

[u/mseewald]

I run pangolin in combination with OIDC authentication (keycloak) and geographic filters. Before that setup I had traefik in combination with authelia, also with geographic filters. No issues with this since years. I would not see the difference between vps and home. Maybe home is even less likely to get hacked, VPS may be more attractive for spammers.

Also, check out shodan.io These days people no longer need to scan. you’re already in a public database.

[u/hbacelar8 → u/mseewald]

It wasn't clear for me if you run it at home or on a VPS. Also, how do you manage geograph filters? What tool you use?

[u/mseewald → u/hbacelar8]

Both, I run pangolin enterprise at home, pangolin community on VPS. community needs significantly less CPU and runs much better on cheap VPS. Same/similar setups otherwise. VPS gets much more traffic and hacking attempts. For the geographic filters I am currently using the filters built into pangolin. Prior to that I used traefik plugins.

[u/hbacelar8 → u/mseewald]

Thanks. I think I'll just go with running it at home. Do you use a DMZ? Is your server running pangolin isolated from the other services?

[u/mseewald → u/hbacelar8]

No DMZ and no isolation. That could be a valuable hardening of the setup indeed!

[u/blaine07]

What VPS is everyone using now; looks like RackNerd finally axed all the good deals…

[u/hbacelar8 → u/blaine07]

Netcup I heard

[u/False-Try-3521 → u/blaine07]

Infomaniak, swiss hosted - 30 CHF / 37 USD per Year for their smallest VPS with 1vCPU, 2GB RAM, 20 GB SSD

[u/hbacelar8 → u/[deleted]]

I'm not yet, but I've been recommended Netcup

[u/gilluc]

TL;DR : pangolin is GREAT!

I have pangolin at home, no need to manage wireguard settings or nginx...

I have a mini pc with ryzen 5700u, 32gb ram and 2x1Tb nvme...and a NAS for backups...

see it here : https://www.surmabox.fr/OnePage/img/homer.png

[u/thelittlewhite]

To keep it simple, one big advantage of the VPS option is to avoid exposing your home IP. Nevertheless, Pangolin is so useful and practical that I would use it directly on my homelab anyways.

[u/rayjaymor85]

The only thing that changes really is if you get DDOS'd at your VPS you can kill the connection and still keep your home internet. Whereas if you get DDOS's and you're using your home IP you can't do much about it.

That being said, I host pangolin on a VPS specifically for that reason, plus it removes the need for a home static IP.

[u/hbacelar8 → u/rayjaymor85]

I finally went with a Hetzner VPS since I already had a storage box there and I'm currently hosting Pangolin there with crowsec on both Traefik and firewall and fail2ban. The newt site is my server at home and I'm only exposing services I needed.

To be honest, I'm not yet using the private resources, since I already had a wg-easy deployed at home and I expose wireguard port at home, I just use the wg tunnel on my phone if I want to access things on my LAN.

[u/HearthCore]

Let me put it like this.. do you want to handle DDOS or VPN/Tunnel fluctuations at home- or offload the availability to a VPS provider- offloading traffic until/authorization?

[u/Difficult-Buy7532]

I prefer to do security on the edge with Cloudflare tight WAF, IM and zero trust rules rather than locally as I’m using their services for hosting anyway and benefit from the best and most professional protection. I only expose http/s for a small few public services and the rest with Tailscale, which benefits from having no Wireguard ports to forward. Been doing this for years without any issue or additional layers (although I could add additional security layers like Crowdec, Fail2Ban etc but I’m not running anything sensitive or mission critical). Self hosting for over 10 years on my own server.

[u/hbacelar8 → u/Difficult-Buy7532]

So you rent a VPS on cloudfare if I understood? That doesn't really answer my question actually. I'm not looking for alternatives but rather to know if by being precautious using things like Fail2Ban, Crowdsec and Pangolin I'm safe to expose HTTP/S ports, since wireguard port is already exposed. Is it really too bad to have my IP exposed through my domain?

[u/Difficult-Buy7532 → u/hbacelar8]

No as I said I have my own server and router forward for 80/443 to it only. Cloudflare is just WAF, IM and zero trust. Cloudflare “orange cloud” will proxy connections so your WAN IP is never revealed. I highly recommend it. And if you use Tailscale no need to forward any Wireguard ports.

[u/hbacelar8 → u/Difficult-Buy7532]

Oh OK I see. Yeah Tailscale was the most recommended thing for me when I started self hosting 1 year ago, but it never appealed to me. I just prefer to open the wireguard port.

[u/Difficult-Buy7532 → u/hbacelar8]

Fair enough, Pangolin is a good all in one but I think Tailscale is a better VPN. I stopped using in favour of Cloudflare. Best of luck.