Hi, I live in Germany and only have public IPv6. My address changes only very, very rarely and has never changed in the time I’ve been self-hosting.
I also have a very small, pretty cheap VPS with static IPv4/IPv6 – which would seem like a great fit for some sort of tunneling/proxy setup. Now comes the question: What/how should I use it? I would like to not have the additional latency for IPv6 enabled hosts, can I just setup a reverse proxy for IPv4? Would Tailscale work for my usecase, what are some resources you found useful when using it?
Currently, I’m just hosting everything IPv6-only and hoping my address never changes, but that does not work for everyone, as especially many new buildings with fiber optic connections still only have IPv4 (strangely).
Ionos.de has a €1 a month VPS
I think 1 core, 1gb ram, and 10gb.
Use either caddy or Nginx proxy manager. Both are easy to setup. Also both are dockerized.
I use Tailscale as my tunnel.
Total latency is about 70-90ms for me.
I’d just set up the reverse proxy on the VPS and make it forward everything via IPv6. But you could also use a tunnel/VPN, everything from Tailscale to Wireguard or even an SSH tunnel would work. And there are dedicated services like Cloudflare, nohost, neutrinet, pagekite…
I’ll add Pangolin to the list, it’s a self-hosted Cloudflare tunnel alternative.
Wire guard to the vps with nftables port forwarding.
Check my wiki here https://wiki.gardiol.org/doku.php?id=networking%3Awireguard_redirects
Or setup ssh with port forwarding as well. Less reliable but nothing to install on a basic Linux.
This. Using simple ssh tunneling with port forwarding in a similar scenario. Working flawlessly with zero maintenance for 5 years and counting. Very reliable
Not really reliable, much less than wire guard. If your connection is unstable ssh not the best option. Autossh make it better, but still after a forced disconnection ssh will take a while to drop and reconnect. Wire guard is much better. I moved from ssh+autossh to wireguard and wished I did that sooner.
Small and stupid question.
Why don’t use a ddns client to update your ipv6 evytime it changes? With a ttl of a minute your shouldn’t be able to see any downtime…
I (genuinely) thinks you are trying to solve a small problem in the complicated and hard way… M
Plenty of IPv4 only networks still exist from which you would not be able to access the services. I am in a similar situation as OP with my offsite address being IPv6 + CGNAT IPv4 and my own address being IPv4 only.
Plenty of ipv4 only in 2025?? Really?? Without a possibility to activate dual stack or just the dslite-crap?
I honestly didn’t think this could be a real issue in those years.
Yup, sorry to be the bearer of bad news🥲
Curious question, why would IPv6 introduce additional latency?
Tailscale is amazing. When i first started self hosting i tried a bunch of things to avoid a companies solution but tailscale just works perfectly and form what they say in interviews they dont intend to change the free tiers. Its also open source and there’s headscale so eventually you could not rely on the company at all.
I switched from Tailscale to headscale, and I still would suggest Tailscale to anyone. It’s just really done well and they seem to actually love that self-hosters and hobbyists use their stuff.
Yes, you can just use a reverse proxy for IPv4 only and point it to the IPv6 upstream. That is what I do, with a separate DNS record which then combines the two. See the DNS records for id.knifepoint.net (CNAME), http.vineta.knifepoint.net (AAAA, A) and vineta.knifepoint.net (AAAA).
The reverse proxy config and certificate management is set up with NixOS, if it helps: https://git.dblsaiko.net/systems/tree/nixos/defaults/v4proxy.nix https://git.dblsaiko.net/systems/tree/nixos/modules/sys2x/v4proxy.nix
But having a reverse proxy would enable someone getting access to it to read traffic, while having a VPN Tunnel won’t.
If someone manages to get root (!) access on this VPS it’s over either way.
NO, an attacker getting control over a vps used as a tunnel could not read Data captured in the past. Also they could not do a MITM with decrypted SSL without breaking HSTS
Your reverse proxy should have a cert with HTTPS.
Tbf, technically data is still decrypted at the reverse proxy and then re-encrypted. So if someone manages to reconfigure the proxy or read its memory somehow they could read traffic in plain text.
However then since they have to control the VPS, they could also get a new cert for that domain (at least the way I’ve configured it) even if it was passed as is to the real host via a tunnel and read the plaintext data that way, so I don’t think a tunnel protects against anything.
I use this setup and don’t terminate SSL at the VPS and solely tunnel the encrypted traffic over a wire guard tunnel to the home lab where SSL is terminated.
The VPS solely serves to move the traffic from an external IP to an internal one.
It’s possible that someone could log into my server, change the nginx config to terminate SSL and then siphon data but it would take a few steps and can be somewhat mitigated by stapling the SSL certs that should be seen from the homelab.
