I don't get the need for those tunnels.
Wouldn't a simple wireguard setup be enough un less you are behind CG-NAT?
Wireguard it's there, free, open source, doesn't rely on any external server or company...
What does these "tunnels" actually add?
this post was submitted on 01 Sep 2026
84 points (98.8% liked)
Selfhosted
61855 readers
453 users here now
A place to share alternatives to popular online services that can be self-hosted without giving up privacy or locking you into a service you don't control.
Rules:
-
Be civil.
-
No spam.
-
Posts are to be related to self-hosting.
-
Don't duplicate the full text of your blog or readme if you're providing a link.
-
Submission headline should match the article title.
-
No trolling.
-
Promotion posts require active participation, with an account that is at least 30 days old. F/LOSS without a paywall has exceptions, with requirements. See the rules link for details. Tags [CBH] or [AIP] are required, see the links in Rule 8 for details.
-
AI-related discussions and AI-involved promotional posts have additional requirements for tagging, as noted in Rule 7 and the AI & Promotional Post Expanded Rules post, and find example disclosures here.
Resources:
- selfh.st Newsletter and index of selfhosted software and apps
- awesome-selfhosted software
- awesome-sysadmin resources
- Self-Hosted Podcast from Jupiter Broadcasting
Any issues on the community? Report it using the report flag.
Questions? DM the mods!
founded 3 years ago
MODERATORS
It bundles WireGuard transport layer and a SNI reverse proxy natively, along with optional authentication. Good enough for beginners or people who need quick deployments.
That's exactly the use case for "tunnels": allowing public, incoming connections behind CGNAT.
Wireguard requires a public IP on at least one side of the connection and only allows private access. If you want to host a blog or website AND you're behind CGNAT, then a "tunnel" service is a very easy solution.
Edit: my previous blog post on the topic: https://blog.k3can.us/posts/2025/feb/2025-02-21_cloudflarefort/
But going with a self-hosted approach like Towonel, you need a server with a public IP too. And I think what the commenter meant is, if you already have that, you can just setup a WireGuard connection to that public server, so that it can route the traffic to your local network.
Oh, maybe I misunderstood? It sounded like he didn't understand what advantage a "tunnel" could provide.
If your server is behind CGNAT, you need a TURN-style "tunnel" to allow incoming connections. If you have your own remote server with a public IP, then you can absolutely use that and create the tunnel using wireguard (or openvpn, ssh, etc).
I just mentioned CF in my blog post because it's probably the most popular solution.
The point is, if you have CGNAT, you need to create that "tunnel" somehow if you want to allow incoming connections.
What does these “tunnels” actually add?
Ease of deployment / time savings generally. You can certainly do it yourself with wireguard and a reverse proxy.
They are saying wireguard alone, no reverse proxy. No exposing any services at all to the outside, just tunnel in with WG and access locally.
yep, i used to use this behind a cgnat. being a broke kid i couldn't have another machine with exposed ports proxy things
Its a secure way to route the traffic from a public endpoint to your internal services without exposing your home IP address. You could do something similar with wireguard. I didn't indicate you couldn't.
I checked and this does a similar thing. You can use WG to punch out a connection, and I have before. The linked program uses quic in a similar way to WG but doesn't do any of the routing, just registers the connection to a hostname for application level forwarding.
It looks more that it provides an easy setup for an alternative.
Both methods can work on cg-nat as well since you are punching out.
One would be CG-NAT as you mentioned, and some people want to host for other people too, potentially including too many people/too distant/too tech illiterate to easily set up WG.
The benefit here is the software by design can't read your traffic - it's using SNI to route, not the host header, so SSL pass thru keeps the payload private. It's billed as shareable for that reason.
Also this is open source and you can host it yourself.
Edit: I concede BakedCatboy's point.
In either case I would probably just use FRP.
You missed my point?
why can't you just use a wireguard connection between your device and the server, or network?
between your device
Thats the part right there. Its for not your device to access.
Like a self- hosted website/blog for example. Or taking the complexity of "start this before you try to connect to my eBook server" for your BIL, or "OK mom, when you want to watch the home videos I converted to digital you have to do it only from your phone, press this first, then share to your TV".
That is the part I think you are missing. Use other than yourself and your own managed devices.
You mean putting your home servers on a VPN with your client devices? That wouldn't really allow for exposing public services.
I use a wireguard tunnel as a reverse proxy and it does ssl passthrough with sni. Termination happens on my local box and the reverse proxy host doesn't do any certs.
What reverse proxy are you using?
I use haproxy just for simplicity, with the https fronted in tcp mode with a tcp request inspect delay and acls using req_ssl_sni allows switching between multiple backend based on hostname, though if you only had 1 backend server then it could just be a raw tcp proxy. I have my stuff split between 2 local boxes that are both connected to the reverse proxy using wg so this works well for me.
Why keep DNS on Cloudflare?? Quad9 is where it's at! Supports DNSSEC, DoT or DoH, QUIC, no log, no BS.
Want it on your phone out and about (and not already using a VPN?) https://dns.quad9.com/dns-query or use the app.
I believe OP would require an authoritative DNS server, which AFAIK Quad9 is not. desec.io would be my recommendation though.
Yeah, that's a future step. I just haven't finished migrating everything.
Most of this type of software depends on VPS or already having public ip. Pure self-hosted alternative still not known.
Self hosted alternative is buying a static IP from your ISP I suppose. Mine is an extra $5/mo which is eh, but I'm not paying for a VPS.
As far as I know an ISP has to provide one at your request in Europe. Idk if it's free.