I have wireguard, it's supported by my router (Fritzbox).

I am very happy with Tailscale

Wireguard.

Dunno if Cloudflare does effective auth for the tunnel or if you have to set that up yourself, but I don't bother trying to expose services to the internet in any way because some of this stuff was just never designed for proper web security (cough Jellyfin).

It's still worth setting up a wildcard cert with ACME so you get nice https and a real domain.

Pangolin on a free Oracle VPS.

Headscale on fly.io

• option 3: self-host Netbird control plane
• option 4: use Netbird's reverse proxy

How about both? I run the evil Cloudflare Tunnels/Zero Trust with Tailscale as an overlay on the server.

tailscale. works perfectly, the only problem is needing a google acc for login

Temp stuff where I could care less about the free tier domain name or things that I just want to funnel to my existing devices: Tailscale

Widespread, prolonged services that will be more actively maintained for a longer amount of time and can just spin off of its own domain/subdomain: Cloudflare

Both are great.

I'm liking self hosted NetBird atm

Just Wireguard on a router, but I'm thinking Netbird.

WG can be a bit PITA to set up, but once you do, it just works. What I would to have is more fine grained control over who goes where if I were to expose some of the services to friends.

Wireguard

Netbird via a free cloud VM. Works great.

Acronyms, initialisms, abbreviations, contractions, and other phrases which expand to something larger, that I've seen in this thread:

[Thread #265 for this comm, first seen 30th Apr 2026, 19:30] [FAQ] [Full list] [Contact] [Source code]

I actually have Wireguard running on a pi zero 2, all it really does is provide me my pihole DNS.

Edit:

I should say I have pihole running on a couple of pi 5’s currently, overkill yes but one of my pi 4’s was sacrificed to the whims of magic smoke another was donated to a friend and another now hosts HAOS, I have a few pi zero 2’s (only one was sacrificial) the one that hosts wireguard has one of my last few working SD cards. The pi 5’s host many other things other than just pihole.

Wildcard dns with port 80 & 443 port forwarded to traefik with tinyauth & fail2ban

I used wireguard, then switched to Pangolin. Wireguard was simpler and worked better with mobile apps though. I'll prob switch back for most apps.

Zerotier. I found it easy to set up and use. Free tier gives you one network and ten hosts, I think.

I have a port forwarding without any tunnel to third parties and Wireguard.

Both.

I have a free vps providing me a public IPv4 address, connected to my opnsense router via tailscale, and use a simple port forward from the VPs to the router's tailscale IP.

I have certain port/connections coming in either via the tailscale IP or my external IPv6 address all forwarded to my internal Caddy reverse proxy which itself is only running IPv4.

And I use cloudflare for my dynamic DNS resolution of my domain. A records are my public VPS IPv4 and AAAA are my own public IPv6 addresses respectively.

If/when I change to a service provider that doesn't use CGnat for IPv4, I can stop doing the forwarding from my VPS.

That's so we can stream music/video without needing to use the VPN.

But, I also run tailscale on my phone, so I can do admin stuff remotely from it, albeit painfully, on this small screen when things break. 🤣