Zero-trust in the home lab: ditch port forwarding forever

The oldest way to reach your home lab from outside is to forward a port — and it is also the one that quietly advertises your home to every scanner on the internet. Here is why to stop, and the zero-trust tools that replace it.

There is a rite of passage in self-hosting where you forward port 443 to your server, watch your app load from your phone on mobile data, and feel like a wizard. The problem is that you have just done the thing every security guide tells you not to: you have opened an inbound door in your home firewall, and within minutes automated scanners will be knocking on it. There is a better way, and it is the same idea enterprises spent the last decade adopting: zero trust.

01Why port forwarding is a real risk

A forwarded port is a permanent, publicly-reachable entrance into your home network. The entire internet is continuously scanned — services like Shodan catalogue exposed devices around the clock — so an open port is not "hidden until someone finds it"; it is found almost immediately and probed forever. Every service you expose this way is only as safe as its worst unpatched vulnerability and weakest password, and a single compromised app can become a foothold onto the rest of your home network — including the laptops and phones that live there. The risk is not hypothetical; it is the default outcome of leaving doors open on the public internet.

02What zero trust actually means

"Zero trust" is not a product; it is a security model, formalised by NIST in Special Publication 800-207. Its core idea is that no user or device is trusted merely for being on a particular network — every access request is authenticated and authorised on its own merits, and trust is never granted just because a request came from "inside."¹ The practical translation for a home lab is powerful: instead of exposing a service to the network and hoping the network is safe, you make every connection prove who it is first. That single shift is what lets you close every inbound port and still reach everything.

03Reverse proxy plus Cloudflare Tunnel: no open ports

The first replacement for port forwarding is an outbound-only tunnel. Cloudflare Tunnel runs a small daemon (cloudflared) inside your network that makes an outbound connection to Cloudflare; inbound traffic then reaches your services through that established tunnel, so you never open a single inbound port on your router.² Your firewall stays fully closed to the internet, your home IP address is hidden behind Cloudflare, and you can layer Cloudflare Access policies on top to require a login before anyone reaches the app at all. Pair the tunnel with a local reverse proxy (Traefik, Caddy, or Nginx Proxy Manager) and each service gets a clean HTTPS hostname without a port number in sight.

# The whole model in one line: the connection goes OUT, not in.
cloudflared tunnel run my-homelab

# cloudflared dials Cloudflare from inside your network.
# Your router's inbound ports stay closed. Nothing is forwarded.

04ZTNA with Tailscale and Twingate

The second replacement is a zero-trust network access overlay — a private mesh that only your authenticated devices can join. Tailscale builds a mesh VPN between your devices on top of the modern WireGuard protocol:⁵ each device authenticates through your identity provider, and they connect directly and encrypted, with no public ports and no central VPN box to expose.³ Twingate offers a similar ZTNA model built explicitly around the zero-trust principle of least-privilege, per-resource access.⁴ The mental model is the opposite of a traditional VPN: you are not "letting a device onto the network," you are granting a specific authenticated device access to specific resources — exactly what NIST 800-207 describes.¹

Port forwarding asks the whole internet to behave and trusts your weakest service to hold. Zero trust asks every connection to prove itself and trusts nothing by default. Only one of those is a plan.

05Reaching your apps from your phone, safely

The payoff is that remote access gets easier, not harder. With Tailscale installed on your phone, your self-hosted apps are reachable over the encrypted mesh from anywhere, as if you were home — no port forwarding, no exposed services, nothing for a scanner to find.³ With a Cloudflare Tunnel plus Access, you simply open the app's hostname in a browser and authenticate at Cloudflare's edge before the request ever reaches your network.² In both cases the internet sees nothing pointing at your house, and you get to your dashboards from the bus. That is the whole promise of zero trust made concrete: less exposure and more convenience at the same time.

06Where OcxlyDev lands

We do not forward ports, and we advise no one else to. The zero-trust tools are free or cheap, take an evening to set up, and remove an entire category of risk — the standing, public, inbound door — from your home network. Start with Tailscale for your own device access because it is the fastest win; add a Cloudflare Tunnel when you need to share a service with someone who is not on your mesh. Close every inbound port, make every connection authenticate, and treat your home network the way a modern enterprise treats its own: as somewhere nothing is trusted just for showing up.¹