{"id":423,"date":"2026-08-29T08:30:00","date_gmt":"2026-08-29T06:30:00","guid":{"rendered":"https:\/\/www.lukaswojcik.com\/?p=423"},"modified":"2026-10-09T22:51:00","modified_gmt":"2026-10-09T20:51:00","slug":"wireguard-tailscale-dmz-secure-external-access-to-home-assistant-and-self","status":"publish","type":"post","link":"https:\/\/www.lukaswojcik.com\/blog\/en\/smart-home\/wireguard-tailscale-dmz-secure-external-access-to-home-assistant-and-self\/","title":{"rendered":"WireGuard &amp; Tailscale DMZ: Secure External Access to Home Assistant and Self-Hosted Servers"},"content":{"rendered":"\r\n<p class=\"wp-block-paragraph\">Traditional remote access architectures for home automation platforms like Home Assistant and self-hosted servers have long relied on exposing ports 80 and 443 to the public internet via NAT port forwarding. However, public-facing endpoints attract continuous automated vulnerability scanners, brute-force attacks, and zero-day exploitation attempts against reverse proxies and web applications. Modern network design removes the publicly exposed web ports by transitioning to encrypted point-to-point VPN tunnels using WireGuard or Tailscale.<\/p>\r\n\r\n\r\n\r\n<h2 class=\"wp-block-heading\">1. The Security Risks of NAT Port Forwarding and Reverse Proxies<\/h2>\r\n\r\n\r\n\r\n<p class=\"wp-block-paragraph\">Opening external firewall ports lets untrusted internet traffic reach the local network perimeter. Automated SSL certificate renewal and reverse proxy authentication still leave several structural vulnerabilities:<\/p>\r\n\r\n\r\n\r\n<ul class=\"wp-block-list\">\r\n<li><strong>Automated Scanning &amp; Exploitation:<\/strong> Public IPv4 addresses are scanned continuously. Unpatched CVEs in web servers, authentication daemons, or IoT dashboards can lead to immediate compromise without prior authentication.<\/li>\r\n<li><strong>Credential Brute-Forcing:<\/strong> Login interfaces exposed via port 443 remain accessible to automated dictionary attacks from global botnets.<\/li>\r\n<li><strong>DDoS &amp; Bandwidth Saturation:<\/strong> Public endpoints lack native protection against application-layer denial-of-service floods, which can degrade residential internet connectivity.<\/li>\r\n<\/ul>\r\n\r\n\r\n\r\n<figure class=\"lw-diagram\">\n<img decoding=\"async\" src=\"https:\/\/www.lukaswojcik.com\/blog\/wp-content\/uploads\/diagrams\/dia-423-vpn-dmz-en.png?v=20261005\" width=\"1120\" height=\"580\" loading=\"lazy\" alt=\"Three columns from left to right: open ports 80\/443 with the risks scanning, brute-forcing and DDoS; WireGuard and Tailscale as point-to-point tunnels instead; the tunnel endpoint in a DMZ or VLAN with granular firewall policies such as TCP 8123 for Home Assistant, ACLs and no WAN ingress.\">\n<figcaption>How remote access moves from NAT port forwarding to a WireGuard or Tailscale tunnel whose endpoint sits in a restricted DMZ.<\/figcaption>\n<\/figure>\r\n\r\n\r\n\r\n<h2 class=\"wp-block-heading\">2. Point-to-Point VPNs: WireGuard vs. Tailscale<\/h2>\r\n\r\n\r\n\r\n<p class=\"wp-block-paragraph\">Replacing traditional inbound NAT rules with encrypted overlay networks enforces a Zero-Trust approach. Remote access requires cryptographic key exchange before any application-layer data is transmitted.<\/p>\r\n\r\n\r\n\r\n<h3 class=\"wp-block-heading\">WireGuard (Kernel-Space Raw Performance)<\/h3>\r\n\r\n\r\n\r\n<p class=\"wp-block-paragraph\">WireGuard operates as a lightweight, kernel-space VPN protocol utilizing state-of-the-art cryptography (ChaCha20, Curve25519, BLAKE2s). Its primary architectural advantage is stealth: a WireGuard interface drops all unauthenticated packets silently without responding, making the host invisible to network scanners. It requires a single UDP port to be reachable or benefits from direct integration into perimeter routers.<\/p>\r\n\r\n\r\n\r\n<h3 class=\"wp-block-heading\">Tailscale (Zero-Config Mesh Overlay with DERP Relays)<\/h3>\r\n\r\n\r\n\r\n<p class=\"wp-block-paragraph\">Tailscale builds a mesh overlay network (Tailnet) on top of the WireGuard protocol without requiring any open firewall ports or static public IPs. Utilizing advanced NAT traversal techniques (STUN\/ICE) and encrypted DERP relay servers as fallbacks, Tailscale connects devices point-to-point regardless of Carrier-Grade NAT (CGNAT) restrictions or dynamic residential IP changes.<\/p>\r\n\r\n\r\n\r\n<h2 class=\"wp-block-heading\">3. DMZ Architecture and Restricted Access Rules<\/h2>\r\n\r\n\r\n\r\n<p class=\"wp-block-paragraph\">Establishing an encrypted VPN tunnel should not grant remote devices unrestricted access to every internal LAN subnet. Proper network hygiene requires deploying the VPN termination endpoint inside a restricted DMZ or VLAN:<\/p>\r\n\r\n\r\n\r\n<ul class=\"wp-block-list\">\r\n<li><strong>Granular Firewall Policies:<\/strong> Ingress traffic from the VPN subnet must be restricted strictly to the IP addresses and port numbers of the target services (e.g., TCP port 8123 for Home Assistant).<\/li>\r\n<li><strong>Access Control Lists (ACLs):<\/strong> In Tailscale deployments, server-side ACL rules ensure that specific identities or devices can only communicate with designated servers, preventing lateral movement across the network.<\/li>\r\n<li><strong>WAN Ingress Prohibition:<\/strong> All inbound NAT forwarding rules for web services on the edge router can be permanently deleted. With Tailscale, no inbound forwarding remains; a self-hosted WireGuard endpoint keeps a single forwarded UDP port, which does not respond to unauthenticated packets.<\/li>\r\n<\/ul>\r\n\n\n<div class=\"lw-faq\">\n<h2>Questions and answers<\/h2>\n\n<h3>Why do internal hostnames not resolve through a WireGuard or Tailscale tunnel while addresses work?<\/h3>\n<p>This is expected: DNS is a separate step that many guides skip. The tunnel carries packets; it says nothing about which resolver the client should ask, so the phone keeps using the one from the coffee shop&#8217;s network, which has never heard of those internal names.<\/p>\n<p>There are two ways to fix it, depending on the tool. A plain WireGuard configuration can name a DNS server in its interface section, pointing at the internal resolver; the resolver then has to be reachable through the tunnel, and the restricted policy for the VPN subnet has to allow port 53 to it. A mesh service can do the same more selectively, resolving one internal domain through the internal resolver and leaving everything else alone, which is the better behavior on a phone that switches networks all day.<\/p>\n<p>Worth deciding deliberately at the same time is whether all traffic should go through the tunnel or only the internal routes. Routing everything is useful on an untrusted network and costs bandwidth, battery and the local geography of every service the phone talks to. Routing only what belongs at home is the quieter default, and it is the one that keeps the tunnel switched on rather than being turned off when it gets in the way.<\/p>\n<\/div>\n\n<div class=\"lw-quellen\">\n<h2>Sources<\/h2>\n<ul>\n<li><a href=\"https:\/\/www.wireguard.com\/\" target=\"_blank\" rel=\"noopener noreferrer\">WireGuard documentation<\/a><\/li>\n<\/ul>\n<\/div>","protected":false},"excerpt":{"rendered":"<p>Why eliminating public port forwarding (80\/443) and NAT exposure in favor of encrypted point-to-point WireGuard or Tailscale VPN tunnels is essential for modern home server security.<\/p>\n","protected":false},"author":1,"featured_media":13983,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[5],"tags":[91318,91365,91321,91237,91121,91141],"class_list":["post-423","post","type-post","status-publish","format-standard","hentry","category-smart-home","tag-firewall","tag-home-assistant","tag-network-security","tag-self-hosting","tag-vpn","tag-wireguard"],"yoast_head":"<!-- This site is optimized with the Yoast SEO plugin v28.1 - https:\/\/yoast.com\/product\/yoast-seo-wordpress\/ -->\n<title>WireGuard &amp; Tailscale DMZ: Secure External Access to Home Assistant and Self-Hosted Servers | Lukas Wojcik<\/title>\n<meta name=\"description\" content=\"WireGuard and Tailscale for home servers: remote access, DMZ separation and restricted network permissions versus port forwarding.\" \/>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/www.lukaswojcik.com\/blog\/en\/smart-home\/wireguard-tailscale-dmz-secure-external-access-to-home-assistant-and-self\/\" \/>\n<meta property=\"og:locale\" content=\"en_US\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"WireGuard &amp; Tailscale DMZ: Secure External Access to Home Assistant and Self-Hosted Servers | Lukas Wojcik\" \/>\n<meta property=\"og:description\" content=\"WireGuard and Tailscale for home servers: remote access, DMZ separation and restricted network permissions versus port forwarding.\" \/>\n<meta property=\"og:url\" content=\"https:\/\/www.lukaswojcik.com\/blog\/en\/smart-home\/wireguard-tailscale-dmz-secure-external-access-to-home-assistant-and-self\/\" \/>\n<meta property=\"og:site_name\" content=\"Lukas Wojcik - Blog\" \/>\n<meta property=\"article:published_time\" content=\"2026-08-29T06:30:00+00:00\" \/>\n<meta property=\"article:modified_time\" content=\"2026-10-09T20:51:00+00:00\" \/>\n<meta property=\"og:image\" content=\"https:\/\/www.lukaswojcik.com\/blog\/wp-content\/uploads\/2026\/09\/hero-423-wireguard-tailscale-dmz-secure-acces-g.png\" \/>\n\t<meta property=\"og:image:width\" content=\"1200\" \/>\n\t<meta property=\"og:image:height\" content=\"630\" \/>\n\t<meta property=\"og:image:type\" content=\"image\/png\" \/>\n<meta name=\"author\" content=\"Lukas Wojcik\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:label1\" content=\"Written by\" \/>\n\t<meta name=\"twitter:data1\" content=\"Lukas Wojcik\" \/>\n\t<meta name=\"twitter:label2\" content=\"Est. reading time\" \/>\n\t<meta name=\"twitter:data2\" content=\"2 minutes\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\\\/\\\/schema.org\",\"@graph\":[{\"@type\":\"Article\",\"@id\":\"https:\\\/\\\/www.lukaswojcik.com\\\/blog\\\/en\\\/smart-home\\\/wireguard-tailscale-dmz-secure-external-access-to-home-assistant-and-self\\\/#article\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/www.lukaswojcik.com\\\/blog\\\/en\\\/smart-home\\\/wireguard-tailscale-dmz-secure-external-access-to-home-assistant-and-self\\\/\"},\"author\":{\"name\":\"Lukas Wojcik\",\"@id\":\"https:\\\/\\\/www.lukaswojcik.com\\\/blog\\\/#\\\/schema\\\/person\\\/895f7604f9b6b71aad9bba33af28d0f9\"},\"headline\":\"WireGuard &amp; Tailscale DMZ: Secure External Access to Home Assistant and Self-Hosted Servers\",\"datePublished\":\"2026-08-29T06:30:00+00:00\",\"dateModified\":\"2026-10-09T20:51:00+00:00\",\"mainEntityOfPage\":{\"@id\":\"https:\\\/\\\/www.lukaswojcik.com\\\/blog\\\/en\\\/smart-home\\\/wireguard-tailscale-dmz-secure-external-access-to-home-assistant-and-self\\\/\"},\"wordCount\":721,\"commentCount\":0,\"publisher\":{\"@id\":\"https:\\\/\\\/www.lukaswojcik.com\\\/blog\\\/#\\\/schema\\\/person\\\/895f7604f9b6b71aad9bba33af28d0f9\"},\"image\":{\"@id\":\"https:\\\/\\\/www.lukaswojcik.com\\\/blog\\\/en\\\/smart-home\\\/wireguard-tailscale-dmz-secure-external-access-to-home-assistant-and-self\\\/#primaryimage\"},\"thumbnailUrl\":\"https:\\\/\\\/www.lukaswojcik.com\\\/blog\\\/wp-content\\\/uploads\\\/2026\\\/09\\\/hero-423-wireguard-tailscale-dmz-secure-acces-g.png\",\"keywords\":[\"Firewall\",\"Home Assistant\",\"Network Security\",\"Self-Hosting\",\"VPN\",\"WireGuard\"],\"articleSection\":[\"Smart Home\"],\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"CommentAction\",\"name\":\"Comment\",\"target\":[\"https:\\\/\\\/www.lukaswojcik.com\\\/blog\\\/en\\\/smart-home\\\/wireguard-tailscale-dmz-secure-external-access-to-home-assistant-and-self\\\/#respond\"]}]},{\"@type\":\"WebPage\",\"@id\":\"https:\\\/\\\/www.lukaswojcik.com\\\/blog\\\/en\\\/smart-home\\\/wireguard-tailscale-dmz-secure-external-access-to-home-assistant-and-self\\\/\",\"url\":\"https:\\\/\\\/www.lukaswojcik.com\\\/blog\\\/en\\\/smart-home\\\/wireguard-tailscale-dmz-secure-external-access-to-home-assistant-and-self\\\/\",\"name\":\"WireGuard &amp; Tailscale DMZ: Secure External Access to Home Assistant and Self-Hosted Servers | Lukas Wojcik\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/www.lukaswojcik.com\\\/blog\\\/#website\"},\"primaryImageOfPage\":{\"@id\":\"https:\\\/\\\/www.lukaswojcik.com\\\/blog\\\/en\\\/smart-home\\\/wireguard-tailscale-dmz-secure-external-access-to-home-assistant-and-self\\\/#primaryimage\"},\"image\":{\"@id\":\"https:\\\/\\\/www.lukaswojcik.com\\\/blog\\\/en\\\/smart-home\\\/wireguard-tailscale-dmz-secure-external-access-to-home-assistant-and-self\\\/#primaryimage\"},\"thumbnailUrl\":\"https:\\\/\\\/www.lukaswojcik.com\\\/blog\\\/wp-content\\\/uploads\\\/2026\\\/09\\\/hero-423-wireguard-tailscale-dmz-secure-acces-g.png\",\"datePublished\":\"2026-08-29T06:30:00+00:00\",\"dateModified\":\"2026-10-09T20:51:00+00:00\",\"description\":\"WireGuard and Tailscale for home servers: remote access, DMZ separation and restricted network permissions versus port forwarding.\",\"breadcrumb\":{\"@id\":\"https:\\\/\\\/www.lukaswojcik.com\\\/blog\\\/en\\\/smart-home\\\/wireguard-tailscale-dmz-secure-external-access-to-home-assistant-and-self\\\/#breadcrumb\"},\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\\\/\\\/www.lukaswojcik.com\\\/blog\\\/en\\\/smart-home\\\/wireguard-tailscale-dmz-secure-external-access-to-home-assistant-and-self\\\/\"]}]},{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\\\/\\\/www.lukaswojcik.com\\\/blog\\\/en\\\/smart-home\\\/wireguard-tailscale-dmz-secure-external-access-to-home-assistant-and-self\\\/#primaryimage\",\"url\":\"https:\\\/\\\/www.lukaswojcik.com\\\/blog\\\/wp-content\\\/uploads\\\/2026\\\/09\\\/hero-423-wireguard-tailscale-dmz-secure-acces-g.png\",\"contentUrl\":\"https:\\\/\\\/www.lukaswojcik.com\\\/blog\\\/wp-content\\\/uploads\\\/2026\\\/09\\\/hero-423-wireguard-tailscale-dmz-secure-acces-g.png\",\"width\":1200,\"height\":630,\"caption\":\"WireGuard & Tailscale DMZ: Secure External Access to Home Assistant and Self-Hosted Servers\"},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\\\/\\\/www.lukaswojcik.com\\\/blog\\\/en\\\/smart-home\\\/wireguard-tailscale-dmz-secure-external-access-to-home-assistant-and-self\\\/#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Home\",\"item\":\"https:\\\/\\\/www.lukaswojcik.com\\\/blog\\\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"WireGuard &amp; Tailscale DMZ: Secure External Access to Home Assistant and Self-Hosted Servers\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\\\/\\\/www.lukaswojcik.com\\\/blog\\\/#website\",\"url\":\"https:\\\/\\\/www.lukaswojcik.com\\\/blog\\\/\",\"name\":\"Lukas Wojcik - Blog\",\"description\":\"\",\"publisher\":{\"@id\":\"https:\\\/\\\/www.lukaswojcik.com\\\/blog\\\/#\\\/schema\\\/person\\\/895f7604f9b6b71aad9bba33af28d0f9\"},\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\\\/\\\/www.lukaswojcik.com\\\/blog\\\/?s={search_term_string}\"},\"query-input\":{\"@type\":\"PropertyValueSpecification\",\"valueRequired\":true,\"valueName\":\"search_term_string\"}}],\"inLanguage\":\"en-US\"},{\"@type\":[\"Person\",\"Organization\"],\"@id\":\"https:\\\/\\\/www.lukaswojcik.com\\\/blog\\\/#\\\/schema\\\/person\\\/895f7604f9b6b71aad9bba33af28d0f9\",\"name\":\"Lukas Wojcik\",\"image\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\\\/\\\/www.lukaswojcik.com\\\/blog\\\/wp-content\\\/uploads\\\/2026\\\/07\\\/lw-x2.jpg\",\"url\":\"https:\\\/\\\/www.lukaswojcik.com\\\/blog\\\/wp-content\\\/uploads\\\/2026\\\/07\\\/lw-x2.jpg\",\"contentUrl\":\"https:\\\/\\\/www.lukaswojcik.com\\\/blog\\\/wp-content\\\/uploads\\\/2026\\\/07\\\/lw-x2.jpg\",\"width\":424,\"height\":636,\"caption\":\"Lukas Wojcik\"},\"logo\":{\"@id\":\"https:\\\/\\\/www.lukaswojcik.com\\\/blog\\\/wp-content\\\/uploads\\\/2026\\\/07\\\/lw-x2.jpg\"},\"sameAs\":[\"https:\\\/\\\/www.lukaswojcik.com\\\/blog\"]}]}<\/script>\n<!-- \/ Yoast SEO plugin. -->","yoast_head_json":{"title":"WireGuard &amp; Tailscale DMZ: Secure External Access to Home Assistant and Self-Hosted Servers | Lukas Wojcik","description":"WireGuard and Tailscale for home servers: remote access, DMZ separation and restricted network permissions versus port forwarding.","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/www.lukaswojcik.com\/blog\/en\/smart-home\/wireguard-tailscale-dmz-secure-external-access-to-home-assistant-and-self\/","og_locale":"en_US","og_type":"article","og_title":"WireGuard &amp; Tailscale DMZ: Secure External Access to Home Assistant and Self-Hosted Servers | Lukas Wojcik","og_description":"WireGuard and Tailscale for home servers: remote access, DMZ separation and restricted network permissions versus port forwarding.","og_url":"https:\/\/www.lukaswojcik.com\/blog\/en\/smart-home\/wireguard-tailscale-dmz-secure-external-access-to-home-assistant-and-self\/","og_site_name":"Lukas Wojcik - Blog","article_published_time":"2026-08-29T06:30:00+00:00","article_modified_time":"2026-10-09T20:51:00+00:00","og_image":[{"width":1200,"height":630,"url":"https:\/\/www.lukaswojcik.com\/blog\/wp-content\/uploads\/2026\/09\/hero-423-wireguard-tailscale-dmz-secure-acces-g.png","type":"image\/png"}],"author":"Lukas Wojcik","twitter_card":"summary_large_image","twitter_misc":{"Written by":"Lukas Wojcik","Est. reading time":"2 minutes"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"Article","@id":"https:\/\/www.lukaswojcik.com\/blog\/en\/smart-home\/wireguard-tailscale-dmz-secure-external-access-to-home-assistant-and-self\/#article","isPartOf":{"@id":"https:\/\/www.lukaswojcik.com\/blog\/en\/smart-home\/wireguard-tailscale-dmz-secure-external-access-to-home-assistant-and-self\/"},"author":{"name":"Lukas Wojcik","@id":"https:\/\/www.lukaswojcik.com\/blog\/#\/schema\/person\/895f7604f9b6b71aad9bba33af28d0f9"},"headline":"WireGuard &amp; Tailscale DMZ: Secure External Access to Home Assistant and Self-Hosted Servers","datePublished":"2026-08-29T06:30:00+00:00","dateModified":"2026-10-09T20:51:00+00:00","mainEntityOfPage":{"@id":"https:\/\/www.lukaswojcik.com\/blog\/en\/smart-home\/wireguard-tailscale-dmz-secure-external-access-to-home-assistant-and-self\/"},"wordCount":721,"commentCount":0,"publisher":{"@id":"https:\/\/www.lukaswojcik.com\/blog\/#\/schema\/person\/895f7604f9b6b71aad9bba33af28d0f9"},"image":{"@id":"https:\/\/www.lukaswojcik.com\/blog\/en\/smart-home\/wireguard-tailscale-dmz-secure-external-access-to-home-assistant-and-self\/#primaryimage"},"thumbnailUrl":"https:\/\/www.lukaswojcik.com\/blog\/wp-content\/uploads\/2026\/09\/hero-423-wireguard-tailscale-dmz-secure-acces-g.png","keywords":["Firewall","Home Assistant","Network Security","Self-Hosting","VPN","WireGuard"],"articleSection":["Smart Home"],"inLanguage":"en-US","potentialAction":[{"@type":"CommentAction","name":"Comment","target":["https:\/\/www.lukaswojcik.com\/blog\/en\/smart-home\/wireguard-tailscale-dmz-secure-external-access-to-home-assistant-and-self\/#respond"]}]},{"@type":"WebPage","@id":"https:\/\/www.lukaswojcik.com\/blog\/en\/smart-home\/wireguard-tailscale-dmz-secure-external-access-to-home-assistant-and-self\/","url":"https:\/\/www.lukaswojcik.com\/blog\/en\/smart-home\/wireguard-tailscale-dmz-secure-external-access-to-home-assistant-and-self\/","name":"WireGuard &amp; Tailscale DMZ: Secure External Access to Home Assistant and Self-Hosted Servers | Lukas Wojcik","isPartOf":{"@id":"https:\/\/www.lukaswojcik.com\/blog\/#website"},"primaryImageOfPage":{"@id":"https:\/\/www.lukaswojcik.com\/blog\/en\/smart-home\/wireguard-tailscale-dmz-secure-external-access-to-home-assistant-and-self\/#primaryimage"},"image":{"@id":"https:\/\/www.lukaswojcik.com\/blog\/en\/smart-home\/wireguard-tailscale-dmz-secure-external-access-to-home-assistant-and-self\/#primaryimage"},"thumbnailUrl":"https:\/\/www.lukaswojcik.com\/blog\/wp-content\/uploads\/2026\/09\/hero-423-wireguard-tailscale-dmz-secure-acces-g.png","datePublished":"2026-08-29T06:30:00+00:00","dateModified":"2026-10-09T20:51:00+00:00","description":"WireGuard and Tailscale for home servers: remote access, DMZ separation and restricted network permissions versus port forwarding.","breadcrumb":{"@id":"https:\/\/www.lukaswojcik.com\/blog\/en\/smart-home\/wireguard-tailscale-dmz-secure-external-access-to-home-assistant-and-self\/#breadcrumb"},"inLanguage":"en-US","potentialAction":[{"@type":"ReadAction","target":["https:\/\/www.lukaswojcik.com\/blog\/en\/smart-home\/wireguard-tailscale-dmz-secure-external-access-to-home-assistant-and-self\/"]}]},{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/www.lukaswojcik.com\/blog\/en\/smart-home\/wireguard-tailscale-dmz-secure-external-access-to-home-assistant-and-self\/#primaryimage","url":"https:\/\/www.lukaswojcik.com\/blog\/wp-content\/uploads\/2026\/09\/hero-423-wireguard-tailscale-dmz-secure-acces-g.png","contentUrl":"https:\/\/www.lukaswojcik.com\/blog\/wp-content\/uploads\/2026\/09\/hero-423-wireguard-tailscale-dmz-secure-acces-g.png","width":1200,"height":630,"caption":"WireGuard & Tailscale DMZ: Secure External Access to Home Assistant and Self-Hosted Servers"},{"@type":"BreadcrumbList","@id":"https:\/\/www.lukaswojcik.com\/blog\/en\/smart-home\/wireguard-tailscale-dmz-secure-external-access-to-home-assistant-and-self\/#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https:\/\/www.lukaswojcik.com\/blog\/"},{"@type":"ListItem","position":2,"name":"WireGuard &amp; Tailscale DMZ: Secure External Access to Home Assistant and Self-Hosted Servers"}]},{"@type":"WebSite","@id":"https:\/\/www.lukaswojcik.com\/blog\/#website","url":"https:\/\/www.lukaswojcik.com\/blog\/","name":"Lukas Wojcik - Blog","description":"","publisher":{"@id":"https:\/\/www.lukaswojcik.com\/blog\/#\/schema\/person\/895f7604f9b6b71aad9bba33af28d0f9"},"potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/www.lukaswojcik.com\/blog\/?s={search_term_string}"},"query-input":{"@type":"PropertyValueSpecification","valueRequired":true,"valueName":"search_term_string"}}],"inLanguage":"en-US"},{"@type":["Person","Organization"],"@id":"https:\/\/www.lukaswojcik.com\/blog\/#\/schema\/person\/895f7604f9b6b71aad9bba33af28d0f9","name":"Lukas Wojcik","image":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/www.lukaswojcik.com\/blog\/wp-content\/uploads\/2026\/07\/lw-x2.jpg","url":"https:\/\/www.lukaswojcik.com\/blog\/wp-content\/uploads\/2026\/07\/lw-x2.jpg","contentUrl":"https:\/\/www.lukaswojcik.com\/blog\/wp-content\/uploads\/2026\/07\/lw-x2.jpg","width":424,"height":636,"caption":"Lukas Wojcik"},"logo":{"@id":"https:\/\/www.lukaswojcik.com\/blog\/wp-content\/uploads\/2026\/07\/lw-x2.jpg"},"sameAs":["https:\/\/www.lukaswojcik.com\/blog"]}]}},"_links":{"self":[{"href":"https:\/\/www.lukaswojcik.com\/blog\/wp-json\/wp\/v2\/posts\/423","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.lukaswojcik.com\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.lukaswojcik.com\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.lukaswojcik.com\/blog\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/www.lukaswojcik.com\/blog\/wp-json\/wp\/v2\/comments?post=423"}],"version-history":[{"count":5,"href":"https:\/\/www.lukaswojcik.com\/blog\/wp-json\/wp\/v2\/posts\/423\/revisions"}],"predecessor-version":[{"id":21904,"href":"https:\/\/www.lukaswojcik.com\/blog\/wp-json\/wp\/v2\/posts\/423\/revisions\/21904"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.lukaswojcik.com\/blog\/wp-json\/wp\/v2\/media\/13983"}],"wp:attachment":[{"href":"https:\/\/www.lukaswojcik.com\/blog\/wp-json\/wp\/v2\/media?parent=423"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.lukaswojcik.com\/blog\/wp-json\/wp\/v2\/categories?post=423"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.lukaswojcik.com\/blog\/wp-json\/wp\/v2\/tags?post=423"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}