# Zero-trust in the home lab: ditch port forwarding forever The oldest way to reach your home lab from outside is to forward a port — and it is also the one that quietly advertises your home to every scanner on the internet. Here is why to stop, and the zero-trust tools that replace it. There is a rite of passage in self-hosting where you forward port 443 to your server, watch your app load from your phone on mobile data, and feel like a wizard. The problem is that you have just done the thing every security guide tells you not to: you have opened an inbound door in your home firewall, and within minutes automated scanners will be knocking on it. There is a better way, and it is the same idea enterprises spent the last decade adopting: **zero trust.** ## 01 Why port forwarding is a real risk A forwarded port is a permanent, publicly-reachable entrance into your home network. The entire internet is continuously scanned — services like Shodan catalogue exposed devices around the clock — so an open port is not "hidden until someone finds it"; it is found almost immediately and probed forever. Every service you expose this way is only as safe as its worst unpatched vulnerability and weakest password, and a single compromised app can become a foothold onto the rest of your home network — including the laptops and phones that live there. The risk is not hypothetical; it is the default outcome of leaving doors open on the public internet. ## 02 What zero trust actually means "Zero trust" is not a product; it is a security model, formalised by NIST in **Special Publication 800-207**. Its core idea is that no user or device is trusted merely for being on a particular network — every access request is authenticated and authorised on its own merits, and trust is never granted just because a request came from "inside."[1](#ref-1) The practical translation for a home lab is powerful: instead of exposing a service to the network and hoping the network is safe, you make every connection prove who it is first. That single shift is what lets you close every inbound port and still reach everything. ## 03 Reverse proxy plus Cloudflare Tunnel: no open ports The first replacement for port forwarding is an **outbound-only tunnel**. **Cloudflare Tunnel** runs a small daemon (`cloudflared`) inside your network that makes an *outbound* connection to Cloudflare; inbound traffic then reaches your services through that established tunnel, so you never open a single inbound port on your router.[2](#ref-2) Your firewall stays fully closed to the internet, your home IP address is hidden behind Cloudflare, and you can layer Cloudflare Access policies on top to require a login before anyone reaches the app at all. Pair the tunnel with a local **reverse proxy** (Traefik, Caddy, or Nginx Proxy Manager) and each service gets a clean HTTPS hostname without a port number in sight. ``` # The whole model in one line: the connection goes OUT, not in. cloudflared tunnel run my-homelab # cloudflared dials Cloudflare from inside your network. # Your router's inbound ports stay closed. Nothing is forwarded. ``` ## 04 ZTNA with Tailscale and Twingate The second replacement is a **zero-trust network access** overlay — a private mesh that only your authenticated devices can join. **Tailscale** builds a mesh VPN between your devices on top of the modern **WireGuard** protocol:[5](#ref-5) each device authenticates through your identity provider, and they connect directly and encrypted, with no public ports and no central VPN box to expose.[3](#ref-3) **Twingate** offers a similar ZTNA model built explicitly around the zero-trust principle of least-privilege, per-resource access.[4](#ref-4) The mental model is the opposite of a traditional VPN: you are not "letting a device onto the network," you are granting a specific authenticated device access to specific resources — exactly what NIST 800-207 describes.[1](#ref-1) > Port forwarding asks the whole internet to behave and trusts your weakest service to hold. Zero trust asks every connection to prove itself and trusts nothing by default. Only one of those is a plan. ## 05 Reaching your apps from your phone, safely The payoff is that remote access gets *easier*, not harder. With Tailscale installed on your phone, your self-hosted apps are reachable over the encrypted mesh from anywhere, as if you were home — no port forwarding, no exposed services, nothing for a scanner to find.[3](#ref-3) With a Cloudflare Tunnel plus Access, you simply open the app's hostname in a browser and authenticate at Cloudflare's edge before the request ever reaches your network.[2](#ref-2) In both cases the internet sees nothing pointing at your house, and you get to your dashboards from the bus. That is the whole promise of zero trust made concrete: less exposure and more convenience at the same time. ## 06 Where OcxlyDev lands We do not forward ports, and we advise no one else to. The zero-trust tools are free or cheap, take an evening to set up, and remove an entire category of risk — the standing, public, inbound door — from your home network. Start with Tailscale for your own device access because it is the fastest win; add a Cloudflare Tunnel when you need to share a service with someone who is not on your mesh. Close every inbound port, make every connection authenticate, and treat your home network the way a modern enterprise treats its own: as somewhere nothing is trusted just for showing up.[1](#ref-1) **About this piece.** This is part two of a five-part OcxlyDev field guide on building a modern home lab — the 10-layer stack, zero-trust networking, de-Googling with self-hosted apps, mini-PC hardware, and Infrastructure as Code with Ansible. Every load-bearing claim links to a primary or reputable source below; project names and hardware move quickly, so check the live page before quoting specifics. ## References 1. [NIST — Special Publication 800-207, "Zero Trust Architecture": the authoritative definition of the model](https://csrc.nist.gov/pubs/sp/800/207/final) 2. [Cloudflare Documentation — Cloudflare Tunnel: outbound-only connections with no open inbound ports](https://developers.cloudflare.com/cloudflare-one/connections/connect-networks/) 3. [Tailscale — "What is Tailscale?": a WireGuard-based zero-config mesh VPN with no exposed public ports](https://tailscale.com/kb/1151/what-is-tailscale) 4. [Twingate — "How Twingate Works": zero-trust network access with least-privilege, per-resource access](https://www.twingate.com/docs/how-twingate-works) 5. [WireGuard — official site: the fast, modern, encrypted VPN protocol Tailscale is built on](https://www.wireguard.com/)