Hi,
I want to make some of my services (like Nextcloud, Immich, Komga, Jellyfin and FreshRSS for example) on my home server easier accessible from remote. For that I want to use a VPS where I install Nginx and Wireguard on it and establish a VPN connection between it and my homeserver. So far so good.
My first question: For the services that I don’t want to expose for remote access over that setup, can I just keep my Nginx instance that I have running now for these services. For example my budgeting service is available under finance.example.com as long as I’m in the same network as my home server right now. Would that still be possible when I have 2 Nginx instances running (one on the VPS and one on the home server directly) or would I need to configure it differently for that to work?
My second question:
Do I need to install Fail2Ban on my VPS or can I also install it on my homeserver?
You must log in or # to comment.
I agree with the other folks recommending Pangolin on a VPS for this. It’s great. It combines a reverse proxy and a wireguard tunnel together for you. You don’t have to open any ports on your home network, and Pangolin allows you to set access levels for each individual service.
So you can have some fully open for those who aren’t going to mess with VPNs and tunneling, and you can put other things behind Pangolin auth to add additional protection.
Configure the VPN route for only that one address, not the whole subnet.
If you only have the VPN, nothing exposed directly, you don’t need fail2ban at all. I suppose you could configure it for the VPN service, but that seems unnecessary to me.
Fail2ban, crowdsec, or similar is still nice to have on the VPS side to reduce the load on your internet connection from abusive bots and LLM scrapers and such.
Personally, I’ve been having good luck with Pangolin, but I have several services that I expose via different subdomains.
You can totally do that yeah!
We have our stuff set up so inbound VPS traffic (for HTTPS) comes in on port 4430, while LAN traffic is on 443. It’s not done for firewall reasons, it’s so we can pass the client’s IP through with Nginx’s proxy_protocol feature, but you could just make your local-only services not listen on 4430. Boom, done.
Fail2Ban on the VPS is probably good. On the home server, it might just lock out the VPS (since everything comes from there).
Anyway yeah, I’ve got a whole guide on this sort of setup! https://frost.brightfur.net/blog/selfhosting-with-a-bounce-vps-part-1/
– Frost
I do this currently. I have a Hetzner VPS with Pangolin, giving access to family services like Immich etc, and my own nerdy services I keep locked to my home IP, and if I’m away from home, I tunnel in with Wireguard and hence then the home IP kicks in and they work.
You can issue traefik IP rules with Pangolin as well to limit what IPs can access services.
I have Pangolin and all family services behind Pocket ID with passkey only auth.
The VPS I protect with Hetzner’s firewall, so only SSH is allowed from my home IP.
The whole setup is as secure as I can make it. My family would just roll their eyes at any VPN I asked them to use, so it has to be publicly accessible for some things annoyingly.
I also have private services coming direct to my home firewall away from the VPS (for speed efficiency), and for truly public services (websites), I have those tunneled through a Cloudflare tunnel that can handle Google Auth for WordPress login pages etc.
It made me uncomfortable to start with using the VPS, but in time, confidence grows.
Are you able to ssh in with Pangolin? I’m also using Pangolin on a VPS, and though a little while ago (last year somteime?) they demoed a tool for ssh over the pangolin tunnel, I could not get it to work.
I haven’t tried TBH. Because the VPS is restricted to my home IP for SSH using Hetzner’s firewall, I wireguard to home, then SSH to the VPS direct. I’ve been updating Pangolin since last summer, but haven’t really played with the newer features. I should have a proper look really.
Configure the VPN route for only that one address, not the whole subnet.
If you only have the VPN, nothing exposed directly, you don’t need fail2ban at all. I suppose you could configure it for the VPN service, but that seems unnecessary to me.
Acronyms, initialisms, abbreviations, contractions, and other phrases which expand to something larger, that I’ve seen in this thread:
Fewer Letters More Letters CGNAT Carrier-Grade NAT DNS Domain Name Service/System HTTP Hypertext Transfer Protocol, the Web HTTPS HTTP over SSL IP Internet Protocol NAT Network Address Translation SSH Secure Shell for remote terminal access SSL Secure Sockets Layer, for transparent encryption TCP Transmission Control Protocol, most often over IP VPN Virtual Private Network VPS Virtual Private Server (opposed to shared hosting) nginx Popular HTTP server
[Thread #130 for this comm, first seen 2nd Mar 2026, 21:10] [FAQ] [Full list] [Contact] [Source code]
