Hey everyone,
I’m one of the people who still used proton and am now in the process of switching everything and trying to selfhost more.
I sucessfully setup Vaultwarden. I also decided I should move away from having my dockers publicly exposed with nginx reverse proxy and switched everything over to netbird. Im using their proxy feature now to access everything with custom domains and followed a tutorial to setup a bring your own proxy server on a vps. So now all my services are only accessible when my netbird vpn is active. I also spun up a pihole docker and added that to my netbird dns servers to try and get ad blocking on my mobile devices. So far so good.
I wonder however that while some webui’s like vaultwarden run with https, others like radarr dont. Is this a problem or does it not matter so much since i have the vpn running?
I dont really understand how I would go about making them https though. Im on unraid for my dockers and don’t see why some use https and others don’t.
Sorry if this is a convoluted post, I’m quite in over my head with all the networking and dns stuff and just hoping I’m not doing something stupid.
Thanks for your help!
If you’re not using https, then anyone who can see the traffic in your VPN can see everything you do.
Whether that’s a problem depends. In principle, as long as access to your VPN is restricted to people you trust, then http inside it is fine. In practice, if your security isn’t perfect, and someone gets access to your VPN, then https provides a meaningful second line of defense.
My recommendation would be to never use http for anything where a breach would be really painful. It’s good that vaultwarden is on https. Beyond that, https is absolutely the best practice, but if someone getting access to your service is only a mild inconvenience, then leaving it on http is fine as long as it’s only accessible inside your VPN - the risk is relatively low, and the consequences aren’t bad.
What about Tailscale, can they see http traffic over my Tailscale connection?
No, they can’t see anything inside node-to-node connections. They are encrypted end-to-end with keys that are only kept on each node and the node clients are open source so you can verify yourself that’s how it works.
The Tailscale servers only help the nodes find each other and establish connections to each other, they don’t have any access to the connections themselves.
The only way for Tailscale to intervene would be for them to silently add their own nodes to your tailnet but (1) even then the rogue node would only see connections between itself and other nodes, not connections between other nodes, and (2) at some point they added a setting that requires existing nodes to approve any new node, so you can use that to completely prevent it.
Tailscale is a sort of VPN. So, yeah, treat it the same.
I’m mostly responding to add a little context to the security concerns. Probably the biggest inside-the-VPN concern is that someone on your VPN gets some malware. So, if this is your family network, and say, your kid’s phone or laptop gets some malware, now any non-encrypted traffic is potentially compromised. Basically, the VPN is only as secure as the weakest link. That’s the thing you’re protecting against with https for individual services.
If I were hosting vaultwarden, and had my bank login in there, I absolutely wouldn’t consider a VPN + http sufficient protection. With LLMs, if we don’t have malware that knows how to hunt around for valuable credentials in the wild already, it’ll be here soon. I personally run my Jellyfin server over https because I’ve gone to the trouble to set up a good system to use letsencrypt with nginx as a proxy for any service. But I wouldn’t be too worried about running Jellyfin over http.
Tail scale should act as a mediator basically initializing the connection between two remote sessions. Then stepping away, letting go two remote sessions handle everything else. If every customer’s traffic had to go through them as a central server, it would be a central bottleneck and a massive operating cost for them. This is why free Vpns are never worth it. You are always the product on them, and they are always heavily mining your data.
I’m not sure that’s true to say it “steps away” because you can go to tailscale.com (on a machine that’s not connected to the tailnet) and log into the console and see all the machines and change their settings if you want, so clearly something is routing through their servers and actions taken on their servers are able to influence the machines.
I’m not an expert here clearly, just going on my own observations.
The tailnet devices report their status to the central servers along with the version they run, the state of their connections to the rest of the tailnet and (unless you disable it) they also send in their logs. But the central server can’t see inside node-to-node connections.
Ok good to know thanks for the clarification!
Its possible the client on your PC could be profiling your traffic and reporting back. That would likely end up badly for the parent company. But things like that aren’t unheard of and part of the reason I’m building my own router again. (See the ongoing GN LG coverage) Those sort of devices can spy on, and report back about other traffic on the network. If your smart devices are connected via Ethernet then they can likely see and read everything on your network that is unencrypted.
But a management console isn’t traffic snooping. Yes, you do have to trust the client to use it. They aren’t routing your traffic through them though. If they’re found to be spying it will be huge news turning them into a parriah in the IT and open source communities.
Thanks that makes sense