Remote access
Getting to the services at home from somewhere else: overlays, tunnels, and picking what fits.
Most self-hosted setups hit the same first wall: the thing you built is at home, and for most of the day so are you. The moment you leave, the network stops cooperating. Carrier-grade NAT means you may not even have a public address, the one you have changes, and forwarding ports on someone else’s router is a decision with consequences.
There are two families of answers. Overlay networks put your devices on one private network wherever they are, which is the closest thing to being home. Tunnels and reverse proxies expose specific services at their own names, usually with certificates and access rules, which is better when other people should reach one thing and nothing else. The trade-offs are real: some tools want an account with a company, some you run entirely yourself, and each piece below says which it is.
If you are new to the area, start with the bridge piece. After that, pick the family that matches how you leave the house.
Self-hosting behind carrier NAT, with a VPS as the bridge. The foundational piece: a small VPS and WireGuard give you a stable way in when your ISP has put you behind someone else’s NAT.
Pangolin 1.24 adds exit nodes and on-demand clients. The self-hosted access layer that wants to be your front door: a reverse proxy and a dashboard, with WireGuard underneath.
Tailscale is replacing the one-lane path through subnet routers. If an overlay network carries your traffic, this explains why subnet routers were a bottleneck, and what changed.
Tailcat is netcat over Tailscale’s data plane. A small, sharp tool for poking one port from one machine to another, with no account in the middle.
Nginx Proxy Manager 2.16.0 adds a logs viewer and per-path access lists. The classic front door for a home lab: certificates, hosts, and now per-path rules, with one certbot caveat to read.
Home Assistant Cloud is being renamed Home Assistant Link. If remote access to your home includes a subscription, read this before the December release: the same service, under a name that finally says what it does.