Hi.

 

I have been spending hours on hours reading about VPNs and how to connect to some of my dockers from the outside-> in. It seems there is alot of differing opinions the way I read into this.

 

My need:

To be able to access Sonarr & Radarr (and maybe something else in the future) from the outside.

 

I have a Asus Rog Rapture GT AC5300 as my main router.

 

I don't think I have any need to reach any other devices from my LAN from the outside.

 

PS: My plex instance works perfectly for me and is accessible from the outside without me setting up anything specific.

PPS: I already have a paid subsricption from PIA, if that would help me in any way...

Question:

Should I go with VPN from my router OR should I set it up from the Unraid side? Please tell me whats best/safest and why...

Edited February 6, 20251 yr by tormi

17 hours ago, tormi said:

Question:

Should I go with VPN from my router OR should I set it up from the Unraid side? Please tell me whats best/safest and why...

I currently do it both ways.  I am not into the reverse proxy thing like many are but, what I have done so far works well and seems fairly secure.  I have had no issues.

 

i started by doing OpenVPN and ZeroTier on the Unraid server.  I always seemed to use OpenVPN and rarely used ZeroTier (no particular reason).  The past couple of years, I migrated almost exclusively to WireGuard on Unraid setup to allow access to anything on the LAN plus my VLAN (it is in the allowed IP address ranges) on which I put my docker containers.  As a backup, I have WireGuard installed on a Raspberry Pi on the LAN in case the Unraid server is down.  It is usually on 24x7, but if a power outage occurs, I need to get into the LAN a different way as I do not have the Unraid server set to automatically boot when power is restored.

 

When Tailscale integration with Unraid came along, I set that up as well. 

 

Recently, I discovered that my router/gateway (Ubiquiti UniFi Cloud Gateway Ultra) has an SD-WAN site-to-site VPN feature built in so I use that between the networks in my two homes.  I can also include the docker VLAN so I can access anything on 3-4 related LANs/VLANs securely.  It uses Wireguard tunnels.

 

Basically, I have four ways to access LAN resources and all work great and securely.

 

WireGuard on one of two Unraid servers for LAN-specific access

Wireguard on a Raspberry Pi on either LAN for LAN-specific access

Tailscale on Unraid servers as well as many other devices for access to resources on either site

Site Magic Site-to-Site VPN (WireGuard) on routers for access to anything on LANs/VLANs in two different sites

• Wireguard requires forwarding a single port and client configuration
• Tailscale requires no port forwarding but requires "setup" of devices in the Tailscale network
• Site Magic requires no port forwarding and no client setup

Edited February 7, 20251 yr by Hoopster

Wow. 

 

Thanks for your setup @Hoopsterand elaborations. Seems like this work great for you. Can you tell me why you choose to go with both Unraid and router setup? Would you do the same if you only need to access unraid dockers?

 

I did experience 8 months ago a breakin to my router and one of my dockers hosting podcasts. At that time I did not use Vpn, only portforward from router to docker containers. Nothing serious happened but today I have a Knx smart home and I am very sceptical to allowing anybody entering anything from the router level. 

 

What would you suggest to go for if I only want to do Vpn on the Unraid server? 

21 minutes ago, tormi said:

Can you tell me why you choose to go with both Unraid and router setup?

Because I can 😀 

 

Actually, I just discovered the Site-to-Site VPN capabilities of my routers and set it up just last week.  It was super easy and is based on WireGuard.  I do not have a lot of experience with it yet but I m about to move my backup server down to our second home this week and I will be trying it out a lot more.  I intend to do unattended Unraid to Unraid server backups over Site Magic utilizing User Scripts and the IPMI capabilities of the servers.

 

21 minutes ago, tormi said:

What would you suggest to go for if I only want to do Vpn on the Unraid server? 

WireGuard on the 24x7 Unraid server is what I have been using for years for remote LAN access to Unraid and other resources on the same LAN.  I also included my docker container VLAN subnet (192.168.3.0/24) in the allowed IP addresses for the WireGuard client devices (phones, laptops, PCs, tablets) from which I access the LAN and VLAN remotely.  It works great.  WireGuard on a Raspberry Pi in the LAN is my backup entry point in case there is an issue with it on the Unraid server.

 

For this setup, I have two ports forwarded in my router, one for WireGuard on Unraid and one for WireGuard on the RPi.

 

I am not as familiar with Tailscale use as I just started using it recently but it is also based on WireGuard.

Edited February 7, 20251 yr by Hoopster