Phase 1 of this project focused on building a self-hosted remote access environment that could securely connect approved devices back to a home network, provide remote LAN access, and route Internet traffic through the home connection when needed.
WHAT I WANTED TO SOLVE
The goal was to create a secure way to reach selected resources on my home network while away, with the option to route Internet traffic back through my home connection when needed. I also wanted the setup to recover cleanly after reboots and adapt automatically when my residential public IP address changes.
PHASE 1 ARCHITECTURE
Phase 1 uses a repurposed Linux laptop as the home VPN host. Docker runs the self-hosted NetBird control plane, while the NetBird client on the host provides routing back to the home network and can also act as an Internet exit point. Traefik handles the public-facing HTTPS connection, Cloudflare provides DNS and automated dynamic DNS updates, and the host is configured to recover the required services after reboot.
CORE COMPONENTS
- Kali Linux host
- Docker and Docker Compose
- Self-hosted NetBird
- NetBird Linux client
- Traefik
- Let’s Encrypt
- Cloudflare DNS and dynamic DNS
- OpenSSH
- systemd
- iptables / ip6tables
- Residential gateway port forwarding
SECURITY & HARDENING
The build was designed to minimize unnecessary exposure and keep administrative access tightly controlled. SSH uses key-based authentication with root login and password authentication disabled. A dedicated host firewall applies explicit inbound filtering, allowing only trusted LAN administration and required public service traffic while dropping other unsolicited inbound connections. Cloudflare credentials are stored in a root-only configuration file, and the DDNS updater is restricted to the intended VPN DNS record.
The firewall configuration was designed to coexist with Docker and NetBird rather than flushing or replacing their forwarding and NAT rules. Public exposure was limited to the services required for the VPN deployment, and SSH was not forwarded through the Internet gateway.
RELIABILITY & RECOVERY
The host was configured for always-on operation and tested for recovery after reboot. Docker, SSH, the host firewall service, the NetBird client, the self-hosted NetBird containers, and the Cloudflare DDNS timer were all verified to return automatically after restart.
WHAT PHASE 1 DELIVERS
- Secure remote access to selected home network resources
- Home Internet exit routing for approved remote devices
- Automatic DNS updates when the residential public IP changes
- Key-based SSH administration with hardened access controls
- Host-level firewall filtering for unsolicited inbound traffic
- Automatic service recovery after reboot
- A documented backup and recovery process for the VPN environment
WHAT’S NEXT
Phase 2 will extend the design to a portable travel router so trusted devices can use the VPN without each device needing its own client configuration. The goal is to create a simple travel workflow where connected devices can securely route back through the home environment while away.
FULL WALKTHROUGH & SOURCE
The full public walkthrough, sanitized configuration examples, recovery notes, and supporting scripts are available in the project repository. Network-specific values, credentials, and other sensitive details have been removed or replaced with placeholders.
Leave a Reply