Best way to securely access a homelab remotely without relying only on Tailscale?

Question

I currently run a small homelab on an old gaming PC with Proxmox and a few VMs. For remote access I mainly use Tailscale, which has worked well so far, but I’d like to have a backup solution and not depend entirely on a third-party service. I’m considering setting up WireGuard directly on my router or possibly using a DigitalOcean Droplet as a gateway/VPN endpoint. My home internet connection has a dynamic IP, so I’m also looking at dynamic DNS options. Has anyone here built a similar setup? What would you recommend as the most secure and reliable approach for accessing a homelab remotely while keeping management relatively simple? I’d be interested in hearing what architecture others are using and whether a small VPS adds any real benefits in this scenario. Thanks!

Bobby · Answer

Hi there, Using a DigitalOcean Droplet as a WireGuard jump server is a solid approach for exactly this situation. The Droplet gets a static IP which solves your dynamic DNS problem entirely, and you run WireGuard between the Droplet and your homelab. Your clients then connect to the Droplet, which forwards traffic to your homelab. No dynamic DNS needed, no relying on Tailscale’s infrastructure. The basic setup looks like this: Your devices → DigitalOcean Droplet (WireGuard) → Home server (WireGuard peer) The Droplet acts as a relay. Your home server initiates and maintains the WireGuard tunnel to the Droplet, so even with a dynamic home IP the tunnel stays up as long as the home server is running. A $6/month Droplet is more than enough for this. WireGuard is extremely lightweight and the bottleneck will be your home internet connection, not the Droplet. For the WireGuard setup on Ubuntu, DigitalOcean has a solid tutorial here: https://www.digitalocean.com/community/tutorials/how-to-set-up-wireguard-on-ubuntu-22-04 You can keep Tailscale running alongside this as a fallback. They should not conflict and having two independent paths into your homelab is exactly the kind of redundancy worth having.

alexdo · Answer

Running a DigitalOcean Droplet as a WireGuard jump host is actually a pretty neat and common approach. It gives you a stable public endpoint, which solves the dynamic IP issue at home, and your homelab can just maintain an outbound WireGuard tunnel to the VPS. From there you can securely route into your home network whenever needed. It does add an extra hop compared to direct WireGuard + DDNS, but in return you get better reliability, easier access from multiple locations, and a clean separation between your home network and the public internet.

Become a contributor for community

DigitalOcean Documentation

Resources for startups and AI-native businesses

The developer cloud

Start building today

Report this

Best way to securely access a homelab remotely without relying only on Tailscale?

Related questions