At some point every homelab operator wants to reach their stuff from outside the house, checking on a download, pulling up Jellyfin at a friend’s, hitting the Proxmox web UI from a coffee shop. The wrong way to do this is punching holes in your router’s firewall and forwarding ports straight to internal services. The right way is a VPN that puts your remote device on the same private network as your homelab, so nothing is exposed to the internet at all. WireGuard, Tailscale, and ZeroTier are the three tools homelabbers reach for most, and they’re not really three competing options for the same job, they’re two different approaches with WireGuard sitting underneath one of them.
Why port forwarding is the wrong default
Forwarding a port on your router exposes whatever’s listening on it directly to the internet, and the internet scans every routable IPv4 address for open ports constantly. It’s not a matter of if a forwarded port gets probed, it’s a matter of how fast. Every service you expose this way becomes something that has to be patched, monitored, and hardened against direct attack, on its own, forever. A VPN flips this entirely: nothing is listening on the public internet except the VPN endpoint itself, and everything behind it, Jellyfin, Proxmox, your NAS, Home Assistant, stays on a private network that’s simply unreachable unless you’re already authenticated onto it. One thing to secure well instead of a growing list of forwarded ports to secure individually.
WireGuard: the protocol everything else here is built on
WireGuard is a VPN protocol, not a product with a management dashboard. It’s implemented as a small, auditable kernel module (or userspace equivalent) that does one thing: creates an encrypted point-to-point tunnel between two devices, each identified by a public/private keypair instead of a username and password. It’s fast, has a tiny codebase compared to older VPN protocols like OpenVPN or IPsec, and is now built into the Linux kernel directly, which is part of why it’s become the default choice for new VPN deployments across the board, not just homelabs.
The catch is that WireGuard by itself is just the tunnel. You still have to generate keypairs, write config files, distribute them to every device, and handle NAT traversal and reconnection yourself. For a single site-to-site tunnel, two boxes, two configs, this is genuinely simple and worth doing directly. For a phone, a laptop, a work computer, and three home devices all needing to reach each other and the homelab, hand-rolled WireGuard configs turn into a real maintenance burden fast, every new device or IP change means editing configs on every peer that talks to it.
Tailscale: WireGuard with the hard parts handled for you
Tailscale takes the WireGuard protocol and wraps it in a coordination layer that handles key distribution, NAT traversal, and device management automatically. You install the client on each device, log in with an identity provider (Google, GitHub, Microsoft, or their own accounts), and every device that logs into the same Tailscale network, called a tailnet, can reach every other device on it directly, with WireGuard tunnels negotiated automatically in the background. No manual key exchange, no config file editing, no port forwarding required even for the initial connection, Tailscale’s coordination servers handle introducing peers to each other and punching through most home routers’ NAT without any router configuration at all.
The tradeoff is that the coordination plane, the service that introduces peers and manages the tailnet’s identity and access rules, is Tailscale’s own hosted infrastructure by default. The actual data between your devices still flows peer-to-peer over WireGuard and doesn’t route through Tailscale’s servers in the common case, but the control plane, who’s allowed on the network and what they can reach, lives on infrastructure you don’t run. Tailscale does ship an open-source coordination server implementation (Headscale, a community project, not an official Tailscale product) that lets you self-host that control plane if depending on a third party for tailnet membership doesn’t sit right with you, at the cost of losing some of Tailscale’s newer managed features and needing to run and maintain it yourself.
ZeroTier: a different overlay model, self-hostable from day one
ZeroTier solves a similar problem, letting devices join a virtual private network without manual key exchange or port forwarding, but it’s a separate protocol and architecture, not WireGuard underneath. It creates a software-defined Ethernet-like overlay network rather than a set of point-to-point tunnels, which makes some things more natural: broadcast traffic works across the overlay, and it feels more like plugging every device into the same physical switch than stitching together individual tunnels. Like Tailscale, it uses hosted coordination servers by default (ZeroTier Central) to help peers find each other, but ZeroTier’s controller component has been self-hostable from early on, running ztncui or a similar controller yourself is a well-trodden path, not a community side project bolted onto someone else’s product.
The practical differences that actually matter when picking: ZeroTier’s client and network management feel a notch less polished than Tailscale’s, and its documentation and default free-tier network size have shifted over the product’s history, worth checking current terms directly rather than assuming. What it buys you in exchange is a more mature story for running the entire stack, data plane and control plane both, without touching anyone else’s infrastructure, if that’s a hard requirement rather than a preference.
Picking one for your homelab
If you want it working in five minutes and don’t mind a third party handling device coordination: Tailscale. It is genuinely the easiest of the three to set up, the mobile apps are polished, and features like MagicDNS (reach devices by name instead of memorizing tailnet IPs) and exit nodes (route all your traffic through your homelab when you’re on untrusted Wi-Fi) solve real problems without any extra configuration. For a single operator or a small household, this is the right default.
If self-hosting the entire stack, including the control plane, is non-negotiable: either run Headscale as a self-hosted Tailscale-compatible coordination server, or go with ZeroTier and run your own controller. Both are more setup and more ongoing maintenance than trusting the hosted option, and both are legitimate choices if that tradeoff matters to you specifically.
If you only need one or two static tunnels, like linking a home network to a single VPS, and don’t need a growing mesh of ad hoc devices: skip the coordination layer entirely and configure WireGuard directly. Two peers with static configs is genuinely simpler to reason about and audit than either overlay product, and it’s one less piece of software with its own update cadence and attack surface.
Where to run the gateway
Whichever you choose, the endpoint on the homelab side belongs in its own small LXC or VM, not installed directly on your Proxmox host or NAS. This keeps the VPN gateway’s attack surface isolated from the systems it’s protecting, and makes it trivial to snapshot, back up, or rebuild independently if something goes wrong with it. Give it a static internal IP, and if you’re using subnet routing (advertising your whole home LAN through the tunnel rather than just the gateway device itself), review exactly which subnets and ports you’re exposing through it. The entire point of this setup is replacing “everything exposed, hope nothing gets found” with “nothing exposed except one authenticated tunnel,” and that only holds if the routing rules on the far end are actually scoped to what you mean to share.
Bottom line
Port forwarding trades convenience for a constantly growing attack surface. A VPN overlay trades a little setup time for collapsing that surface down to one authenticated entry point. WireGuard is the right foundation either way, the only real question is whether you want Tailscale’s polish and hosted coordination, ZeroTier’s more mature self-hosted-controller story, or bare WireGuard’s simplicity for a small, static set of tunnels. All three get you the same outcome that actually matters: reaching your homelab from anywhere without ever opening a port to the public internet.