Skip to content

Remote Access

This document describes how remote access to the homelab is implemented.

The environment uses Cloudflare Dynamic DNS to keep a public hostname updated with the current public IP address. Remote clients connect to this hostname, which forwards traffic to the WireGuard server hosted on hades.skynet.lan.

Architecture

flowchart TB
    PUBLICHOSTNAME[🌐 Static Hostname using Cloudflare DDNS]
    ISP[🌐 ISP Connection]
    ROUTER[📡 ISP Router]
    MT[🔀 MikroTik Router]
    HADES[🖥️ hades.skynet.lan\nWireGuard]
    CLIENTS[💻 iPhone / MacBook]
    SERVERS[🖥️ *.skynet.lan\nApplication Servers]

    CLIENTS --> PUBLICHOSTNAME
    PUBLICHOSTNAME --> ISP
    ISP --> ROUTER
    ROUTER --> MT
    MT --> HADES
    HADES --> SERVERS

Connection Flow

  1. A remote client (MacBook, iPhone, etc.) initiates a WireGuard connection.
  2. The client connects to the public Cloudflare hostname.
  3. ddclient continuously updates the DNS record whenever the ISP changes the public IP address.
  4. The ISP router receives the connection and forwards the WireGuard UDP port to the MikroTik router.
  5. The MikroTik router forwards the traffic to hades.skynet.lan.
  6. The WireGuard server authenticates the client.
  7. After authentication, the client becomes part of the internal network and can securely access services hosted under *.skynet.lan.

Components

Component Purpose
Cloudflare Public DNS hosting
ddclient Automatically updates the Cloudflare DNS record
ISP Router Receives inbound Internet traffic and forwards the WireGuard port
MikroTik Router Internal routing and firewall
hades.skynet.lan WireGuard VPN server
Clients iPhone, MacBook, laptop, etc.
Internal Servers All services hosted inside the homelab

Port Forwarding

The ISP router forwards the WireGuard UDP port to the MikroTik router.

Example:

Protocol Port Destination
UDP 51820 MikroTik

The MikroTik firewall then forwards the traffic to:

hades.skynet.lan:51820/UDP

Dynamic DNS

The public hostname always points to the current ISP public IP.

Remote Client
        │
        ▼
vpn.example.com
        │
Cloudflare DNS
        │
Current Public IP

The DNS record is automatically maintained by ddclient.

ddclient Configuration

Configuration file:

/etc/ddclient.conf

Example placeholder:

# ddclient configuration
daemon=300                              # check every 300 seconds
syslog=yes                              # log update msgs to syslog
pid=/run/ddclient/ddclient.pid  
ssl=yes
use=web
web=ifconfig.me
##
## Cloudflare
protocol=cloudflare,        \
zone=<mydomain.tld>,            \
ttl=1,
password='Cloudflare API Key',
vpn.<mydomain.tld>
#############################################

Install Wireguard here

Set up Wireguard Server

WireGuard Authentication

Clients authenticate using WireGuard public/private key pairs.

Only configured peers are allowed to establish a VPN connection.

After authentication, clients receive an internal VPN address and can securely access resources inside the skynet.lan network.

Network Flow

Internet
    │
    ▼
Cloudflare DNS
    │
    ▼
Public IP Address
    │
    ▼
ISP Router
    │
    ▼
MikroTik
    │
    ▼
hades.skynet.lan
    │
    ▼
Internal Services

Benefits

  • Secure encrypted remote access.
  • Automatic DNS updates when the ISP changes the public IP.
  • No need to remember changing IP addresses.
  • Internal services remain private and accessible only through the VPN.
  • Centralized access to all homelab resources through a single WireGuard endpoint.