Networking

Ever since i moved behind starlinks cgnat i have been looking for a way to proxy my sites out to a public ip I have been using cloudflare tunnels for http/https however for tcp/udp i have been less successful as a patch job i setup playit.gg for git and minecraft however this has a very low amount of ports and does not let you chose which port to use. My first major break through came when i started investigating oracle cloud free tier. My first attempt was using a software called pangolin and i just could not figure out its tunnelling. I then looked to wireguard and while i could create a tunnel i ran into a issue with ip config where the tunnel wouldn’t bind to the public ip only to the tunnel ip. The one which finally worked was as you can guess rathole. It has a docker image and uses a single config file on both ends. This makes it ideal to use in my current environment. I am still unsure if i want to switch off of cloudflare tunnel but i will definitely switch off playit.gg.

So in my process of preparing to switch to starlink I setup headscale to replace my wireguard vpn. I thought that I would have to use tailscale as I presumed the headscale server would require a port. It does but it just so happens to use https which I can tunnel with cloudflare. So with that in mind I setup headscale in a docker container and connected my phone with no issue. The server side was slightly harder as a i used the tailscale docker container and accidentally removed the envs so i spent a while trying to figure out why the state file wasn’t saving properly. That is fixed now and it works fine. However on further investigation I realised that I could not use it for my main purpose as cloudflare tunnels do not support web socket PUSH.

I am not mad I will be keeping ipv4 for my LAN however for reasons beyond my control I am moving from a wired internet connection to starlink that uses carrier grade nat. This leaves me with a range of problems I need to solve to get my homelab working without access to public ports. The first solution I am going to use is cloudflare tunnels. So i go from… to… This is not terrible and was easy to setup and integrate in my CI/CD pipeline however it is not a 1 size fits all solution as I still have game severs, mail, VPN, git ssh, remote access and sftp. I have some ideas such as headscale or similar for VPN. Git ssh i can tunnel but it would not be public so i feel it is pointless. The others I will have to try ipv6 when i change to starlink.

I have been using nginx reverse proxy for quite a while and it works great. However with my recent switch to automation and git managment i have decieded to switch to caddy i know many people love traefik however i have tried it in the past and had some errors so decided to investigate caddy. My current setup works as such in each projects git repo I store the caddy file their is then an action which will copy the caddy file to the correct folder before running caddys hot reload command caddy reload --config /etc/caddy/Caddyfile --adapter caddyfile.

During a backup test I did recently I found that wireguard wasn’t working properly. I have no idea how long this has been the case but to fix it I started trying to change the config however when that lead to no improvment I decided to reinstall. This is something I have considered before as my current setup doesn’t have a gui which would be nice so I use the repository (https://github.com/wg-easy/wg-easy?tab=readme-ov-file). The install was over all easy however the password hashing didn’t work on a super strong password. This seems to be working now and I will probably redo the backup test for wireguard soon.

I chose to use Pi hole for ad blocking and local dns as it has a large community and I have used it in the past. The install went fine and then i used http://firebog.net to get a list of ad blocks. The only issues I have run into is that I blacklisted a google link that stopped a lot of surchs i did and that it only prompts you to re loggin after you fail to do something. ...