I'm checking the possibility to use Wireguard as a VPN tunnel to connect to my HA instance.
Since you cant have a HTTPS certificate for an internal IP address, I'm left with the HTTP connection.
Wireguard has the option for split tunnelling and on-demand VPN, which means whenever the connection to HA is being established, it goes over the VPN tunnel.
Now thats sounds awesome, but my question is, is there experience how reliable that is?
Because, in the fine print of the connection security it states:
If you set your local (HTTP) address as the external URL and forget to connect your VPN on a public network, this may expose your Home Assistant credentials.
If I only set the internal URL, I can use it already with Wireguard. Why would I even need to set the external URL?
I assume though that when I only configure the internal URL, it would still send the credentials to any network and try to connect?
Is anyone using this setup with Wireguard and Split-Tunnel with a HTTP connection? If so, any reliablity experiences?
I have that for my private IP addresses, including my HA server.
You have mixed it up a bit.
Certificates do not relate to IP addresses, but to domain names.
The domain name in the certificate is checked against the domain name you connect to in the browser/app.
A certificate can be moved around once you get it from the certificate authority, like Let's Encrypt.
The first "limitation" is that Let's Encrypt only approve certificates for public domains, which can be public webservers or even public DNS servers.
Move the certificate or get it directly on the HA server in the first place.
The second "limitation" is that your internal server do not reply to the correct domain name.
Set up an internal DNS server that handle that and let the clients use that when internally or VPN-connected.
I already have an internal DNS and also a HTTPS cert for a my duckdns domain. Doesnt solve the problem because that cert is for the external duckdns domain and its IP. So I need a cert for an internal domain? Even if I would have that internal cert, wireguard would not know where to go because a public DNS would not resolve to an internal domain. My ultimate goal is quite simple but technically difficult as it seems? HTTPS traffic through Wireguard.
Ahh, you use duckDNS.
I use my own public authorative domain.
It is still possible to do it with duckDNS, but you need to have a DNS server internally that can do a rewrite, because only your subdomain can be rewritten.
The normal duckDNS entries have to reply normally or you will not be able to keep your duckDNS entries for your subdomain updated.
I have a Pihole and it can do DNS rewrites.
If I have the cert for the subdomain, how would you tell a split tunnel VPN to send this very traffic through the tunnel? I think this is only possible when you would NOT use a public DNS resolver, instead always use the DNS at home, even for a split tunnel VPN scenario, right?
I have an internal only subdomain for the home. If you're not vpn’d in through my provider I can't even resolve the names let alone hit them. Split tunnel on my phone and the homebound traffic resolves and works and my non homebound traffic goes through the default gateway. It just works.
I know Wire guard and Unifi both work I use the all the time.
Has to be configured, but split tunneling is just infrastructure now.
Well my split tunnel works too but split DNS is something that cant be done with Wireguard from what I understand.
I dont want to rely on my homebound DNS server for reliability reasons.
What I wanted was a HTTPS connection to HA through my VPN tunnel.
Looks like on VPN its only possible either via a full VPN tunnel or via split tunnel with DNS resolution at home.
Self signed certs is the third option which seems quite some effort, let alone on an iPhone.