• A different device from your home server?
  • On the same home server as the services but directly on the host?
  • On the same home server as the services but inside some VM or container?

Do you configure it manually or do you use some helper/interface like WGEasy?

I have been personally using wgeasy but recently started locking down and hardening my containers and this node app running as root is kinda…

  • sakphul@discuss.tchncs.deEnglish
    4·
    4 hours ago

    Always in the router if it supports it. If it does not support wireguard I would rather (if you are able and allowed to) replace the router instead of using something else.

  • FrederikNJS@sopuli.xyzEnglish
    1·
    4 hours ago

    I have a Raspberry Pi that runs pihole and Wireguard exclusively. My home server is a Kubernetes cluster running on an old desktop PC and 2 Intel NUCs.

    The reason for the separate Pi was essentially because I only had the desktop PC initially, and for a while I had a faulty CPU, making the desktop PC crash or become unresponsive, so it helped a lot having DNS and VPN access separated from the instability.

  • Lucy :3@feddit.orgEnglish
    2·
    6 hours ago

    Home 1’s Routers, Home 2’s Router, public IPv4/v6 VPS. All as the native arch package.

    • SayCyberOnceMore@feddit.ukEnglish
      2·
      4 hours ago

      The routers are running Arch? What hardware are they?

      I’m running pfSense as edge firewalls with a Fritzbox router as a bridge - no issues there, but would be interesting to replace that part too, if possible.

      • Lucy :3@feddit.orgEnglish
        1·
        4 hours ago

        Old small desktop towers. Powerful, very open (so I can run my NS infra and WG server and bridge on there, and easily have them redundant), and very extendable (need a 10G NIC or SFP+? Plug in a PCIe card!), and easily replaceable. I now have some old Cisco APs, which will be for my 2nd Home, so I can use my FritzBox as only a modem. In my 1st Home, I’ll hopefully soon actually have fibre in addition to using my dads FritzBox as uplink. And I could add a Mobile Modem too. There, I don’t need a wireless network, as in contrast to my 2nd Home, that infra is only for servers, to which I can just connect from my dads network/FB.

  • LordKitsuna@lemmy.worldEnglish
    2·
    9 hours ago

    One end is a local VPS with insanely good peering pretty much round the damn world, other end is my opnsense router. I actually pass a block of ipv6 through the vpn and my router hands it out to devices which is a nice little bonus

  • brewery@feddit.ukEnglish
    8·
    14 hours ago

    I have a vps (hetzner dedicated server auction) as well as my home servers. The vps has a fixed IP so ive setup wireguard endpoints to all point to it with forwarding on so can access every device indirectly through the vps. It allows them to work across DDNS or remotely.

    I used this guide (https://www.digitalocean.com/community/tutorials/how-to-set-up-wireguard-on-ubuntu-20-04). Tried different tools gui’s and other methods but always came back to this to work the best

  • cmnybo@discuss.tchncs.deEnglish
    3·
    12 hours ago

    I run one on my firewall, but it’s IPv6 only because of CGNAT. The other one is running on a VPS in case I need IPv4 access. I just configured them manually.

  • i_am_not_a_robot@discuss.tchncs.deEnglish
    3·
    13 hours ago

    Wireguard normally runs with higher than root privileges as part of the kernel, outside of any container namespaces. If you’re running some sort of Wireguard administration service you might be able to restrict its capabilities, but that isn’t Wireguard. Most of my devices are running Wireguard managed by tailscaled running as root, and some are running additional, fixed Wireguard tunnels without a persistent management service.