How to Remotely Connect

When it comes to connecting to your services while away from home, there are two common methods to approach this: through connecting to a self-hosted Virtual Private Network or broadcasting your services to the World Wide Web.  These techniques can be used individually or combined to create a tailored experience.

Virtual Private Network 

Just like a corporation or university, you can self-host a Virtual Private Network server from home.  This enables anyone with the proper credentials to securely connect individual devices to your Local Area Network.  This way, your services can be available to you, friends and family – even while away from your home – without making them accessible to the public internet.

This is clearly not the ideal for hosting a WordPress blog or Flarum forum intended for an online audience.  VPN access can be the perfect balance of security and convenience for a small or exclusive audience – such as Bookstack for a tabletop roleplaying campaign.  Some services may require using a web domain to properly function, but access can still be restricted to access from your LAN.

For accessing services that handle private personal information such as Actual Budget or Paperless-ngx, this is the most secure option.  By requiring authorization to remotely access your Network, you can greatly decrease your attack surface – or the amount of publically-accessible software that may contain software vulnerabilities that can be leveraged by malicious actors. 

These type of software vulnerabilities are commonly called zero-day exploits because they are either unknown or unfixed.

While open-source software can improve security by putting more eyes on potential vulnerabilities, it does not mean there will not be breaches.  Software projects are written by developers with varying priorities, including security and privacy.  You do not need to be as concerned about the security of individual software programs when everything is protected behind a singular VPN program.

 

Comparison

Security	Security starsstarsstars By requiring authentication before even  connecting to any services, you can greatly decrease your overall attack surface.
Shield_with_heart	Convenience starscirclecircle This will need to be configured on a device-by-device basis.  Once the service has been setup, you just need to make sure you stay connected.

Web Domain Name

This process will involve connecting your server and it's services to the world wide web. This makes it extremely simple for you to access your server from anywhere using any device.  This is, however, equally true for everyone in the world who has access to the internet.  You can take proactive steps to harden security, preempt vulnerabilities and limit fallout, but at the end of the day you are opening yourself and your server to the open internet.  Your Web servers address will be accessible by lookup on the Domain Name System databases.

Similar to a VPN, a well-configured single sign on service can decrease your attack surface.  Instead of individual apps like radarr managing their authentication, each with their own potential for vulnerabilities, services like authelia can act as a dedicated middle man.

 

Comparison

Security	Security starscirclecircle By requiring authentication before connecting to any services, you can decrease your overall attack surface.
Shield_with_heart	Convenience starsstarsstars Once the service has been setup, you just need to make sure you stay connected.

Combination

While using a domain name to access an application, such as app.example.com, it is possible to restrict access to it to users on your local Network or connected by VPN.  This provides the convenience of a domain name and the security of a VPN.  This technique requires the most configuration but can produce the most tailored experience for balancing security and convenience.  For example, you can require that a user be on the VPN or local network to access actual or radarr, but OwnCloud and your website are accessible to the open internet.

diagram showing inside and outside access to a local restricted address.

 

Comparison

Security	Security starsstarscircle By requiring authentication before connecting to any services, you can decrease your overall attack surface.
Shield_with_heart	Convenience starsstarscircle Once the service has been setup, you just need to make sure you stay connected.