The entire point of selfhost is to host private services not available to the public
Probably your entire point, a lot of self hosters self host services that family members and friends can reach most of the time without the need of a VPN. This very community is full of examples.

It’s infinitely more secure

I’m with you about that.

There’s simply no room for an argument.

As stated in the other post, I’m sorry about that, I’m here to discuss and learn, if you don’t have room for an argument, our discussion ends here.

VPN is objectively better in all possible situations.

Exactly! in all possible situation!!!

Only a hardware firewall would do this. If it’s software, like implied in your post, no traffic is filtered and all connections are accepted.

Talking abut netfilter, since it manages also the forwardning, it for some strange reason it should crash, NO IP traffic is flowing

VPN is the least amount of work for the most secure setup. There’s nothing to even argue, its superior in every way.

If there’s nothing to even argue, then I say goodby to you since I’m here to discuss. All the best!

Well…if you edit your post after someone has replied to it at least specify what’s you’ve edited and don’t pretend that the answer that somebody else has already given you wasn’t about your non edited post!
If you (my mistake) wrote VPS instead of VPN, you can’t pretend that I’ve answered about VPN!
If you can convince your family member and your friends to use a VPN to use your service, that’s good for you, and I mean it!
But saying that it’s quite impossible to do that, I think that I’m speaking for 99% of the self hoster (is this correct in English? Bah, you got me!)

If for whatever reason your firewall is down, there’s unrestricted access to your server…

I don’t know what kind of firewall you use, but if my firewall is down there is NO traffic at all passing through!

And by the way, since I’ve replied to someone that don’t want to use VPN because he doesn’t want to give access to the whole network, I meant that he could use a VPN AND iptables to restrict the guest access to single services instead of the whole network.

Again, this is the reason VPS’ exist.

What? What’s the difference between a VPS and your home server? You may say that’s a good practice to separate things, so maybe have a a VM with public facing services and another with more private stuff reachable only with a VPN. But for something like Nextcloud, it needs to be public (if you’re not the only one using it), but it contains personal stuff and then comes the OP request!

You’re right! I’ve seen the offer and usually they’re just for the first piece, but for that item there are no limits.

ChatGPT summary:
The podcast episode “Byebye Raspberry Pi” discusses the evolving role of Raspberry Pi devices in 2025. The host evaluates self-hosting options, the growing appeal of thin clients over Raspberry Pi due to cost and performance, and the use of containers for flexible testing environments. They also touch on repurposing older hardware and share personal experiences with self-hosting and audio editing. The episode covers modern alternatives to Raspberry Pi, such as x86 computers, and invites audience feedback on their use of devices for hosting services. The discussion includes tips on managing disk space and remote access with WireGuard.

Just out of curiosity, why do you disconnect from your home VPN?

For that, you can restrict access to a single service with iptables.

Well, the price is 16€. I don’t know when the promotion apply

With Wireguard there’s really no reason.

Well, that’s kinda of a personal choice. If somebody needs to have services accessible by someone else besides him, that service can’t be behind a VPN (let’s face the truth: we know that we can’t ask all out relatives and friends to use a VPN).

No no, what I meant is that if I connect to your server without the certificate installed don’t I just get the warning and I can still get through?

Beside the fact that you would like to understand if you’ve done everything properly (that’s good, but I can’t help you here), a VPN on a smartphone can be always active. Mine is always on and I’ve never noticed any battery problem. If you prefer something simpler there’s Tailscale.

I don’t know much about certificates, but doesn’t that just alert the browser that the certificate is not trusted and you can decide if keep going or not?

I love ZigBee sensors basically because they can run years with a coin battery, and I don’t dislike WiFi devices that are connected to the power, I just put them in a VLAN with no Internet access.

I’ve never virtualized OpenWRT, but with hardware passthrough I don’t see why it shouldn’t work.

@[email protected]