--- title: I stopped forwarding ports on my router, and a... description: A home lab owner describes moving away from router port forwarding toward a self-hosted mesh VPN setup. NetBird, a self-hosted WireGuard-based mesh VPN, is... canonical: https://daily.dev/posts/i-stopped-forwarding-ports-on-my-router-and-a-self-hosted-mesh-vpn-made-my-home-lab-safer-overnight-mfessuzf6 twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: I stopped forwarding ports on my router, and a self-hosted mesh VPN made my home lab safer overnight | daily.dev og:description: A home lab owner describes moving away from router port forwarding toward a self-hosted mesh VPN setup. NetBird, a self-hosted WireGuard-based mesh VPN, is... og:url: https://daily.dev/posts/i-stopped-forwarding-ports-on-my-router-and-a-self-hosted-mesh-vpn-made-my-home-lab-safer-overnight-mfessuzf6 og:image: https://api.daily.dev/og/posts/mFEsSuzf6.png og:image:alt: I stopped forwarding ports on my router, and a self-hosted mesh VPN made my home lab safer overnight og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # I stopped forwarding ports on my router, and a self-hosted mesh VPN made my home lab safer overnight **[XDA Developers](https://daily.dev/sources/xda-developers)** · 4 min read · 0 upvotes · 0 comments ## Summary A home lab owner describes moving away from router port forwarding toward a self-hosted mesh VPN setup. NetBird, a self-hosted WireGuard-based mesh VPN, is used to give personal devices private access to home server services without opening any router ports. Pangolin, a self-hosted tunneled reverse proxy built on WireGuard with Newt, Gerbil, and Traefik components, handles the small subset of services that genuinely need public exposure. The result is a smaller attack surface since services no longer sit behind forwarded ports scannable from the internet, though existing protections like firewalls, authentication, and HTTPS remain in place as defense in depth. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Questions this post answers ### How does NetBird provide remote access to home lab services without port forwarding? NetBird creates a self-hosted WireGuard-based mesh VPN with your own coordination server, letting your devices and home server join the same private network. Instead of exposing each service individually via router port forwards, any device on the mesh can reach services on the home server directly, changing the access path from internet-router-port forward-service to device-NetBird-service. _Anyone weighing mesh VPNs against port forwarding for home lab access can compare real setups on daily.dev._ ### What is Pangolin used for in a self-hosted homelab networking setup? Pangolin is a self-hosted tunneled reverse proxy and gateway for exposing specific services to the public internet without relying on an ISP or third-party ingress. It has three components: Newt connects machines, Gerbil handles WireGuard tunneling, and Traefik manages reverse proxying, letting only intentionally public services be reachable while private services stay behind a mesh VPN. _Developers deciding how to expose selected home lab services publicly can dig into setups like Pangolin on daily.dev._ ## Similar posts on daily.dev - [I ditched port forwarding for a mesh VPN, and my home network is finally secure](https://daily.dev/posts/i-ditched-port-forwarding-for-a-mesh-vpn-and-my-home-network-is-finally-secure-pk0onln3h) · XDA Developers · 9 upvotes · 4 comments - [I reach every service on my home server from anywhere without opening a single port](https://daily.dev/posts/i-reach-every-service-on-my-home-server-from-anywhere-without-opening-a-single-port-qgiwzdz5k) · XDA Developers · 0 upvotes · 0 comments - [Pangolin lets me reach my own apps from anywhere, and I didn't have to open a single port](https://daily.dev/posts/pangolin-lets-me-reach-my-own-apps-from-anywhere-and-i-didn-t-have-to-open-a-single-port-bibaxjtci) · XDA Developers · 0 upvotes · 0 comments - [How do you secure access to your self-hosted/homelab services?](https://daily.dev/posts/how-do-you-secure-access-to-your-self-hosted-homelab-services--6rlyvh8et) · Lobsters · 1 upvotes · 0 comments - [I stopped exposing half my self-hosted services to the internet, and nothing broke](https://daily.dev/posts/i-stopped-exposing-half-my-self-hosted-services-to-the-internet-and-nothing-broke-rkh9wdjn9) · XDA Developers · 0 upvotes · 0 comments --- Tags: [#security](https://daily.dev/tags/security), [#vpn](https://daily.dev/tags/vpn), [#homelab](https://daily.dev/tags/homelab) [View this post on daily.dev](https://daily.dev/posts/i-stopped-forwarding-ports-on-my-router-and-a-self-hosted-mesh-vpn-made-my-home-lab-safer-overnight-mfessuzf6) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"I stopped forwarding ports on my router, and a self-hosted mesh VPN made my home lab safer overnight","url":"https://daily.dev/posts/i-stopped-forwarding-ports-on-my-router-and-a-self-hosted-mesh-vpn-made-my-home-lab-safer-overnight-mfessuzf6","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/i-stopped-forwarding-ports-on-my-router-and-a-self-hosted-mesh-vpn-made-my-home-lab-safer-overnight-mfessuzf6"},"datePublished":"2026-08-16T18:33:45.389Z","dateModified":"2026-09-13T21:58:49.663Z","description":"A home lab owner describes moving away from router port forwarding toward a self-hosted mesh VPN setup. NetBird, a self-hosted WireGuard-based mesh VPN, is...","image":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/2d2bcdb733c554981050c291b334d144?_a=AQAEuop","thumbnailUrl":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/2d2bcdb733c554981050c291b334d144?_a=AQAEuop","isAccessibleForFree":true,"articleSection":"XDA Developers","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"XDA Developers","logo":"https://media.daily.dev/image/upload/s--kCg6yyAP--/f_auto,q_auto/v1774964407/logos/xda-developers?_a=BAMAMiWQ0","url":"https://daily.dev/sources/xda-developers"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/i-stopped-forwarding-ports-on-my-router-and-a-self-hosted-mesh-vpn-made-my-home-lab-safer-overnight-mfessuzf6","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":0},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"security,vpn,homelab","timeRequired":"PT4M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"XDA Developers","item":"https://daily.dev/sources/xda-developers"},{"@type":"ListItem","position":3,"name":"I stopped forwarding ports on my router, and a self-hosted mesh VPN made my home lab safer overnight"}]} {"@context":"https://schema.org","@type":"FAQPage","@id":"https://daily.dev/posts/i-stopped-forwarding-ports-on-my-router-and-a-self-hosted-mesh-vpn-made-my-home-lab-safer-overnight-mfessuzf6#faq","mainEntity":[{"@type":"Question","name":"How does NetBird provide remote access to home lab services without port forwarding?","acceptedAnswer":{"@type":"Answer","text":"NetBird creates a self-hosted WireGuard-based mesh VPN with your own coordination server, letting your devices and home server join the same private network. Instead of exposing each service individually via router port forwards, any device on the mesh can reach services on the home server directly, changing the access path from internet-router-port forward-service to device-NetBird-service. Anyone weighing mesh VPNs against port forwarding for home lab access can compare real setups on daily.dev."}},{"@type":"Question","name":"What is Pangolin used for in a self-hosted homelab networking setup?","acceptedAnswer":{"@type":"Answer","text":"Pangolin is a self-hosted tunneled reverse proxy and gateway for exposing specific services to the public internet without relying on an ISP or third-party ingress. It has three components: Newt connects machines, Gerbil handles WireGuard tunneling, and Traefik manages reverse proxying, letting only intentionally public services be reachable while private services stay behind a mesh VPN. Developers deciding how to expose selected home lab services publicly can dig into setups like Pangolin on daily.dev."}}]} ```