Best way to securely access a homelab remotely without relying only on Tailscale?

Question

I currently run a small homelab on an old gaming PC with Proxmox and a few VMs. For remote access I mainly use Tailscale, which has worked well so far, but I’d like to have a backup solution and not depend entirely on a third-party service. I’m considering setting up WireGuard directly on my router or possibly using a DigitalOcean Droplet as a gateway/VPN endpoint. My home internet connection has a dynamic IP, so I’m also looking at dynamic DNS options. Has anyone here built a similar setup? What would you recommend as the most secure and reliable approach for accessing a homelab remotely while keeping management relatively simple? I’d be interested in hearing what architecture others are using and whether a small VPS adds any real benefits in this scenario.

Bobby · Answer

Hi there, Using a DigitalOcean Droplet as a WireGuard jump server is a solid approach for exactly this situation. The Droplet gets a static IP which solves your dynamic DNS problem entirely, and you run WireGuard between the Droplet and your homelab. Your clients then connect to the Droplet, which forwards traffic to your homelab. No dynamic DNS needed, no relying on Tailscale’s infrastructure. The basic setup looks like this: Your devices → DigitalOcean Droplet (WireGuard) → Home server (WireGuard peer) The Droplet acts as a relay. Your home server initiates and maintains the WireGuard tunnel to the Droplet, so even with a dynamic home IP the tunnel stays up as long as the home server is running. A $6/month Droplet is more than enough for this. WireGuard is extremely lightweight and the bottleneck will be your home internet connection, not the Droplet. For the WireGuard setup on Ubuntu, DigitalOcean has a solid tutorial here: https://www.digitalocean.com/community/tutorials/how-to-set-up-wireguard-on-ubuntu-22-04 You can keep Tailscale running alongside this as a fallback. They should not conflict and having two independent paths into your homelab is exactly the kind of redundancy worth having.

John Andersen · Answer

Just built something recently that’s focused only on the HTTP side of this problem space https://github.com/publicdomainrelay/atproto-reverse-proxy You could run that with some kind of HTTP -> VNC or whatever setup if you want to access VMs in a GUI way. This has the added benifit you can slap oauth2-proxy over top of it for auth. It’s just open source stuff but you could deploy it on your droplet or use the hosted service (fedproxy.com ) I’m running as a community service. But if you want to ensure it’s up then probably best to run it yourself on your Droplet :P

alexdo · Answer

Hello, @leon21 Running a DigitalOcean Droplet as a WireGuard jump host is actually a pretty neat and common approach. It gives you a stable public endpoint, which solves the dynamic IP issue at home, and your homelab can just maintain an outbound WireGuard tunnel to the VPS. From there you can securely route into your home network whenever needed. It does add an extra hop compared to direct WireGuard + DDNS, but in return you get better reliability, easier access from multiple locations, and a clean separation between your home network and the public internet. Regards

Become a contributor for community

DigitalOcean Documentation

Resources for startups and AI-native businesses

The developer cloud

Start building today

Report this

Best way to securely access a homelab remotely without relying only on Tailscale?

Related questions

Digital Ocean Team SSO with Entra ID - Work Around?

Post-Incident Security Validation: Rebuild or Trust the Existing Droplet

VLESS VPN connects but no traffic passes through (DigitalOcean VPS + x-ui + Xray)

What’s the status of CopyFail patches in shared hosts?

How are you handling the Axios supply chain attack in your deployments?

Keeps signing me out (even more frequently than before)

What’s the best way to secure a DigitalOcean Droplet running WordPress against brute-force attacks?

prevent firewall ssh lock out

how do I find my droplet's username and password?

How To Set Up an Endlessh Tarpit on Ubuntu 22.04

Issues with SSH Access After Changing Firewall Settings

Accessing Connecting Public Client IP in App Platform

Report this

Best way to securely access a homelab remotely without relying only on Tailscale?

Related questions

Digital Ocean Team SSO with Entra ID - Work Around?

Post-Incident Security Validation: Rebuild or Trust the Existing Droplet

VLESS VPN connects but no traffic passes through (DigitalOcean VPS + x-ui + Xray)

What’s the status of CopyFail patches in shared hosts?

How are you handling the Axios supply chain attack in your deployments?

Keeps signing me out (even more frequently than before)

What’s the best way to secure a DigitalOcean Droplet running WordPress against brute-force attacks?

prevent firewall ssh lock out

how do I find my droplet's username and password?

How To Set Up an Endlessh Tarpit on Ubuntu 22.04

Issues with SSH Access After Changing Firewall Settings

Accessing Connecting Public Client IP in App Platform