How are people securely accessing their self hosted things from the internet?

Expand the replies to this comment to learn how AI was used in this post/project.

Pangolin here

Even stuff that I don't want exposed, Pangolin has an option for Public resources and Private resources. The new version with SSH/VNC publishing via HTTPS is pretty sweet too.

Tailscale

Pangolin/Traefik with PocketID for authentication into a few select services. I also use Tailscale for stuff that I absolutely don't want to expose (e.g., Bitwarden), the servers themselves. Then finally, I do use a cloudfare tunnel where it's supported by specific apps such as Immich on the Iphone

Wireguard/tailscale/headscale

I'm using Tailscale with Unraid.

Wireguard VPN

I use Pangolin for this. Includes auth management too.

People really over-engineer that part of hosting. I'm straight on the net. SSH for server access. Fail2Ban and UFW. Never had any issues in 2 decades.

Currently Cloudflare tunnels + access (with mTLS where supported) I'm planning on moving across to Pangolin hosted on a vps which will tunnel back home. But as with most of my home lab stuff, its on the to-do list.

I have my own domain which via dynDNS points to my home ip, there I have a mini pc running pve with cosmos cloud listening on 80/443 as a reverse proxy with geoblocking for my own country (admin sites only via internal or my static work ip). Apps are accessed via that reverse proxy some accessible without login (cuz own login and phone apps dont like the proxy login) others with normal login and some only accessible with admin login.

I just port forward

Tailscale and Cloudflare. Alternatively Netbird and Pangolin. Cloudflare is extremely good at what they do, but it does come at the price of your privacy.

I use Pangolin for specific stuff that should just be public while I also have a wireguard vpn to my homelab

Reverse Proxy + Nftables + SSHGuard is enough for me. May consider adding an IP Bouncer soon. But not a priority. Not a fan of VPN’s suggestions, commonly on this sub, as it is overkill in my opinion unless you’re running a Team / Business or you are using something like Samba which should never be exposed to the internet. A big disadvantage of using VPNs is the battery drain. Not a fan of Cloudflare Tunnels and the ToS doesn’t help further.

Regular domain on the open internet.

ZeroTier vpn

VPN

Cloudflare access

From easiest to actually self hosted would be Tailscale if you want a third party member involved Wireguard if you want to host the VPN yourself Reverse Proxy with DMZ VLAN and IDP. Tailscale is the easiest for the tech, but more difficult to get clients on. Reverse Proxy is on the other side of that scale, it's the hardest for a tech to setup but it's the professional method and easiest for clients to connect.

Ive been converted from VPN, to NGINX, to Cloudflare Tunnels and WARP to now Tailscale.

Tailscale, this is the way

I would split the services into two groups before choosing a tool. For things only you need, use Tailscale or WireGuard and do not expose them publicly at all. That is the cleanest answer for admin panels, n8n, databases, dashboards, and anything with weak or missing authentication. For browser apps that other people need, Cloudflare Tunnel plus Cloudflare Access is reasonable. Put the Access policy in front of the hostname, require your identity provider plus MFA, and verify the origin cannot still be reached directly over an open port. The tunnel should be the only path in. I would not treat the access layer as permission to ignore application security. Keep containers on private networks, avoid publishing ports unless necessary, use separate service accounts, and test the unauthenticated URL in a private browser. If a container has no auth and contains sensitive data, VPN-only is the safer default.