Confused about securely exposing self-hosted apps? A Senior DevOps Engineer shares three battle-tested strategies for building a secure gateway, moving from quick fixes to a zero-trust fortress.

Stop Port Forwarding! A Senior Engineer’s Guide to Self-Hosted Gateways

I still remember the feeling in the pit of my stomach. It was 2012, and I was so proud of my first “homelab”—a dusty Dell Optiplex running a dozen services for my personal projects. To access my new wiki from outside, I did what every beginner does: I logged into my router and forwarded port 8080 directly to the server’s internal IP. Job done, right? A week later, my internet was crawling. After hours of troubleshooting, I found it: my little server was part of a botnet, happily chewing through my bandwidth to attack someone else. I had left the front door wide open, and someone had walked right in. That mistake cost me a weekend and a lot of pride, but it taught me the most important lesson in self-hosting: never, ever expose a service directly.

The “Why”: What’s So Wrong with Port Forwarding?

When you forward a port from your router to a server (like `router:8080 -> my-server:8080`), you’re essentially putting that service—and the machine it runs on—directly on the public internet. Think of it as punching a hole straight through your firewall. This is a problem for a few key reasons:

• Increased Attack Surface: Every open port is another door for an attacker to knock on. If that service has a vulnerability, your entire network is at risk.
• No Centralized Security: You have no single place to manage SSL/TLS certificates, handle authentication, or monitor traffic. You have to configure security for each and every service.
• IP Address Exposure: You’re broadcasting your home IP address to the world, making you a potential target for DDoS attacks or other unwanted attention.

The professional solution is a reverse proxy or a secure gateway. This is a single, hardened server that sits between the internet and your internal services. All traffic hits the gateway first. It handles the TLS encryption, inspects the request, and then securely routes it to the correct internal application (like Plex, Grafana, or your photo gallery). Your internal apps are never directly exposed.

So, let’s look at three battle-tested ways to build this gateway, from the quick-and-dirty to the enterprise-grade.

Solution 1: The Quick Fix – Nginx Proxy Manager

This is my go-to recommendation for anyone just starting out. Nginx Proxy Manager (NPM) is a beautiful web UI built on top of the rock-solid Nginx web server. It completely abstracts away the complexity of writing Nginx config files and makes getting a secure, SSL-enabled proxy up and running a 15-minute job.

You point ports 80 and 443 from your router to the machine running NPM, and then do everything else through its GUI. It handles creating and renewing Let’s Encrypt SSL certificates automatically. It’s the “I need it working yesterday” solution.

How to Set It Up:

It’s best run via Docker. Here’s a typical docker-compose.yml:

version: '3.8'
services:
  app:
    image: 'jc21/nginx-proxy-manager:latest'
    restart: unless-stopped
    ports:
      - '80:80' # Public HTTP Port
      - '443:443' # Public HTTPS Port
      - '81:81' # Admin Web UI
    volumes:
      - ./data:/data
      - ./letsencrypt:/etc/letsencrypt

Once it’s running, you log into the web UI on port 81, add a “Proxy Host,” enter your domain (e.g., plex.mydomain.com), the internal IP and port of your Plex server (e.g., 192.168.1.50:32400), and click the “Request SSL Certificate” button. That’s it. Seriously.

Darian’s Take: NPM is fantastic, but it’s a bit of a pet. You manage it by clicking buttons. For a handful of services, it’s perfect. But if you’re managing dozens of dynamic services, you’ll quickly outgrow the GUI and want a more declarative, code-based approach. It’s a great tool, but know its limits.

Solution 2: The Permanent Fix – Traefik

Welcome to the big leagues. Traefik is a “cloud-native edge router.” That’s a fancy way of saying it’s a reverse proxy built for the modern, containerized world. Instead of manually configuring every route in a UI, you add labels to your Docker containers, and Traefik automatically discovers them and creates the necessary routes and SSL certificates.

This is the “Infrastructure as Code” approach. Your proxy configuration lives right next to your application’s configuration. When you spin up a new container for a service like Grafana, Traefik sees the labels and instantly makes it available at grafana.mydomain.com, complete with a valid SSL cert. No UI clicking required.

Example Configuration:

First, your Traefik docker-compose.yml:

version: '3'
services:
  traefik:
    image: traefik:v2.9
    container_name: traefik
    command:
      - "--api.insecure=true"
      - "--providers.docker=true"
      - "--providers.docker.exposedbydefault=false"
      - "--entrypoints.web.address=:80"
      - "--entrypoints.websecure.address=:443"
      - "--certificatesresolvers.myresolver.acme.tlschallenge=true"
      - "--certificatesresolvers.myresolver.acme.email=your-email@example.com"
      - "--certificatesresolvers.myresolver.acme.storage=/letsencrypt/acme.json"
    ports:
      - "80:80"
      - "443:443"
      - "8080:8080" # For the dashboard
    volumes:
      - "/var/run/docker.sock:/var/run/docker.sock:ro"
      - "./letsencrypt:/letsencrypt"

Now, to expose another service, you just add labels to its `docker-compose.yml`. For example, a Portainer container:

version: '3'
services:
  portainer:
    image: portainer/portainer-ce:latest
    container_name: portainer
    volumes:
      - "/var/run/docker.sock:/var/run/docker.sock"
      - "./portainer-data:/data"
    labels:
      - "traefik.enable=true"
      - "traefik.http.routers.portainer.rule=Host(`portainer.mydomain.com`)"
      - "traefik.http.routers.portainer.entrypoints=websecure"
      - "traefik.http.routers.portainer.tls.certresolver=myresolver"
      - "traefik.http.services.portainer.loadbalancer.server.port=9000"

Just run `docker-compose up -d` on that file, and Traefik handles the rest. It’s magical.

Solution 3: The ‘Nuclear’ Option – The Zero Trust Tunnel

Both previous solutions still require you to open ports 80 and 443 on your firewall. What if you could expose your services without opening any inbound ports? That’s the principle behind a “zero trust” tunnel, and it’s my personal favorite for critical services.

Services like Cloudflare Tunnels (formerly Argo) or Tailscale Funnel work by having you run a small agent inside your network. This agent creates a persistent, outbound-only connection to the provider’s global network. When a request comes in for your domain, the provider sends it down this secure, pre-established tunnel to the agent, which then forwards it to your internal service. Your firewall remains completely locked down. No open ports. No exposed IP.

How It Works (Cloudflare Tunnel):

You run their lightweight daemon, `cloudflared`, inside your network. A simple Docker command looks like this:

docker run cloudflare/cloudflared:latest tunnel --no-autoupdate run --token <YOUR_TUNNEL_TOKEN>

You configure everything in the Cloudflare Zero Trust dashboard—you tell it that `app.mydomain.com` should route to the internal service at `http://192.168.1.100:8000`. That’s it. Your server is now accessible globally, but your network perimeter is sealed.

Warning: This is powerful, but you are placing your trust and your traffic in the hands of a third-party provider. For most self-hosters, the benefits (DDoS protection, hiding your IP, no open ports) are massive. But be aware of the trade-off. Your data is being proxied through their network.

Comparison at a Glance

So, which one should you choose? It depends on your goals.

Method	Ease of Use	Security Level	Flexibility	Best For…
Nginx Proxy Manager	★★★★★ (Very Easy)	★★★☆☆ (Good)	★★☆☆☆ (Basic)	Beginners, simple setups with a handful of static services.
Traefik	★★★☆☆ (Moderate)	★★★★☆ (Excellent)	★★★★★ (Very High)	Serious hobbyists, container-heavy environments, automated deployments.
Cloudflare Tunnel	★★★★☆ (Easy)	★★★★★ (Maximum)	★★★☆☆ (Moderate)	Security-focused users, those who can’t open ports, or want to hide their IP.

My advice? Start with Nginx Proxy Manager. Get a feel for how a reverse proxy works. When you find yourself wanting to automate things or you’re tired of the UI, graduate to Traefik. And if you’re hosting something truly critical or you just want the peace of mind of having zero open ports, set up a Cloudflare Tunnel. Don’t be like 2012 me—build your gateway right the first time.

---

🤖 Frequently Asked Questions