I have wireguard, it's supported by my router (Fritzbox).

Pangolin on a vps.

tailscale. works perfectly, the only problem is needing a google acc for login

I am very happy with Tailscale

Pangolin on a free Oracle VPS.

I do run wireguard on my router, but the main reason is ad blocking, not hiding services. Most services are publicly exposed.

Wireguard.

Dunno if Cloudflare does effective auth for the tunnel or if you have to set that up yourself, but I don't bother trying to expose services to the internet in any way because some of this stuff was just never designed for proper web security (cough Jellyfin).

It's still worth setting up a wildcard cert with ACME so you get nice https and a real domain.

Netbird via a free cloud VM. Works great.

How about both? I run the evil Cloudflare Tunnels/Zero Trust with Tailscale as an overlay on the server.

• option 3: self-host Netbird control plane
• option 4: use Netbird's reverse proxy

Headscale on fly.io

Asked my ISP for a public IP, exposed all things that can handle that to the public. Custom Wireguard server for VPN

Acronyms, initialisms, abbreviations, contractions, and other phrases which expand to something larger, that I've seen in this thread:

[Thread #265 for this comm, first seen 30th Apr 2026, 19:30] [FAQ] [Full list] [Contact] [Source code]

Temp stuff where I could care less about the free tier domain name or things that I just want to funnel to my existing devices: Tailscale

Widespread, prolonged services that will be more actively maintained for a longer amount of time and can just spin off of its own domain/subdomain: Cloudflare

Both are great.

I'm liking self hosted NetBird atm

Just Wireguard on a router, but I'm thinking Netbird.

WG can be a bit PITA to set up, but once you do, it just works. What I would to have is more fine grained control over who goes where if I were to expose some of the services to friends.

Wireguard

Zerotier. I found it easy to set up and use. Free tier gives you one network and ten hosts, I think.

I used wireguard, then switched to Pangolin. Wireguard was simpler and worked better with mobile apps though. I'll prob switch back for most apps.

Wildcard dns with port 80 & 443 port forwarded to traefik with tinyauth & fail2ban

I actually have Wireguard running on a pi zero 2, all it really does is provide me my pihole DNS.

Edit:

I should say I have pihole running on a couple of pi 5’s currently, overkill yes but one of my pi 4’s was sacrificed to the whims of magic smoke another was donated to a friend and another now hosts HAOS, I have a few pi zero 2’s (only one was sacrificial) the one that hosts wireguard has one of my last few working SD cards. The pi 5’s host many other things other than just pihole.

I have a port forwarding without any tunnel to third parties and Wireguard.