I’m re-setting up my HomeLab and one of the things I’m trying to learn about on this go-around is Zero Trust networking. To accomplish this I am planning on using NetBird’s mesh overlay network. I would like all of my services to use the NetBird mesh network at all times, whether they are communicating within my homelab’s LAN or I am accessing them from outside via the greater internet.
I have successfully set up the NetBird management interface on a Hetzner VPS, however the issue I run into is if I lose internet access at home, none of my services are able to function as they can no longer reach the management interface. However, if I self host the management interface in my homelab, I am unable to access it from outside my home LAN.
I’ve identified 2 solutions that could solve this:
-
Self host the management interface and set up a Cloudflare tunnel to the management interface, which would allow access from outside my home network.
-
Self host the management interface, then set up a wireguard proxy/tunnel on a VPS that forwards traffic to my management interface (Similar in my mind to option 1, but not relying on Cloudflare)
What are your thoughts? Any other ideas?
I appreciate your comments/criticisms!
Okay, so two really big things:
-
You’re confused a bit on how network routing works. If you’re building something that bridges multiple networks (local + VPN + VPS), you need to know about how to route things to different places. You’re dealing with 3 networks at this point.
-
You might be misunderstanding how “zero-trust” and local networking fit together. Right now you have some local machines at least, AND a router. You don’t need all of your local machines to individually bridge a gap to your VPS, you want it the other way around.
If the majority of your machines are local, then make that your hub. Everything else should be a client. Adding all these individual nodes to routes in a mesh network makes absolutely no sense, and will definitely cause routing problems, if not something like ARP poisoning (we can’t see your config).
Just make the remote machine clients to your local network and be done with it.
Thanks for your response! I’m completely self-taught, so I’ll go ahead and acknowledge knowledge gaps on my end, but how would putting all the nodes in a network cause routing problems or ARP poisoning?
I recognize that what I’m trying to accomplish is a bit overkill for the average home network, and a lot of my reasoning behind my design is purely for learning. My reasoning for putting everything on a mesh network is 2-fold:
- Providing encrypted, secure, and mutually identified networking between all nodes
- Creating a centralized source of truth and control – NetBird runs its own DNS system behind the scenes, which allows all nodes to be addressed by name regardless of location, which interests me because it creates a single point of administration for ACLs, routing, etc. I’m also able to access any node I want across the mesh network as long as I’m connected to it.
I have successfully run this setup previously with the NetBird management console hosted in a VPS, however the issue I ran into was that if internet went down at home, I could no longer access my locally hosted services through the mesh network. I could still access them via IP, since I was on the same LAN, but that defeats my goal of centralized control, mDNS, and a central source of truth that I got via the mesh network.
I have also successfully ran this setup completely local, however I am unable to access it from outside my homelab. For my use case, I think having all components of the mesh network hosted within my homelab is the best design. However now I have to figure out the best way to allow external connections to my management interface. Thus my original question should I use a cloudflare tunnel to my management interface, set up a wireguard tunnel from an externally accessible VPS service pointed to my management interface, or something different?
It’s not about actually getting it to work, it’s about having it work PROPERLY.
You have multiple routes to the same network right now it sounds like, and you’re almost certainly routing local network traffic over NetBird instead of using local routes. Have you looked at your routing tables?
That’s one of the advantages for those interested in ZTN. In a somewhat similar way to IPv6, a local address/network isn’t inherently trustworthy.
you’re almost certainly routing local network traffic over NetBird instead of using local routes
That’s precisely the functionality I want, though. Secure, encrypted, mutually identified traffic should be the only traffic in a zero trust network.
I’m simply trying to create an ingress point into this network for outside access.
-
however the issue I run into is if I lose internet access at home, none of my services are able to function as they can no longer reach the management interface.
Do the services stop working immediately, or only after restarting the netbird client(s)? I’ve found headscale/tailscale nodes will continue to communicate with each other with the internet down, but restarting the tailscale client will break things (which makes sense of course).
If netbird has an equivalent to MagicDNS that could cause issues after a while of losing connectivity (since the DNS will be hosted on the VPS).
Well the internet down scenario has only happened once, and I returned home to no internet, booted up my laptop, and could not connect to any of my services since I couldn’t reach my control server. I haven’t forced the issue to occur by disconnecting my internet and testing connectivity. I just did the lazy thing and connected to the services I wanted via their IPv4 address
I don’t know anything about the Zero Trust network you’re working with, but this is essentially the same as what I’m doing with Home Assistant. It runs on the LAN, because it’s controlling everything in my house. The server is on a battery backup, most of my devices are z-wave, and several are battery powered. I can lose internet and power to the house, and still disarm the alarm and unlock the front door, at least until the UPS runs out, which is several hours.
Since HA is on my LAN, accessing it while traveling requires exposing my server to the internet, which terrifies me. I do have VPSes, though, and I have one locked down s.t. it’s only accessible via VPN. It’s not exposing any ports to the WAN except the Wireguard ports. To get to my HA, I connect to that one VPS via the VPN, which is on a VPN subnet with my home server.
The downside is that it is not possible to access my LAN (and, therefore, my HA server) without a pre-configured client. If I don’t have my laptop or phone, I can’t get to my LAN. If my VPS went down, I couldn’t get to my LAN. And, obviously, if my home internet goes down, I can’t get to my LAN. I’d rather be safe than sorry, though.
