When you first start building a homelab, the natural instinct is to go to your router, open port 80 and 443, and point them to your Nginx or Traefik reverse proxy so you can access your services away from home.
We have all done it. And in 2026, it is a terrible idea.
Within minutes of opening port 443, your IP address is hit by automated scanners looking for vulnerable WordPress instances, exposed administrative panels, or zero-day exploits in your proxy software.
In enterprise environments, the industry has shifted entirely to Zero Trust Architecture. Instead of allowing incoming traffic through a firewall, you run a daemon inside your network that creates an outbound tunnel to a secure edge. The firewall stays completely closed.
Here is how I implemented a complete Zero Trust architecture for my homelab using two distinct tools: Cloudflare Tunnels (for public web traffic) and Netbird (for private administrative access).
The Public Edge: Cloudflare Operator
For services that I want to be publicly accessible (like my blog or certain shared media services), I use Cloudflare. But I don't use traditional DNS A-records pointing to my home IP.
Instead, I deployed the Cloudflare Kubernetes Operator directly into my cluster.
(Note: I wrote a deep-dive on configuring the Cloudflare Operator here).
When I want to expose a new web service, I create a TunnelBinding Custom Resource in Kubernetes. The Cloudflare Operator spins up a lightweight cloudflared pod that connects outward to Cloudflare's edge network.
Cloudflare assigns a public URL to that tunnel. When a user visits the URL, Cloudflare proxies the traffic through the outbound tunnel directly to my internal K8s Service.
The Result:
- My home IP address is completely hidden.
- DDoS protection and Web Application Firewalls (WAF) are handled at Cloudflare's edge, before the traffic ever reaches my house.
- My router has zero open inbound ports.
The Private Edge: Netbird Mesh
Cloudflare Tunnels are fantastic for HTTP/HTTPS web traffic. But what about SSH? What about accessing Proxmox nodes, Ceph storage arrays, or raw database ports? You cannot (and should not) push those through a public Cloudflare Tunnel.
For private administrative access, I rely on Netbird, a WireGuard-based Zero Trust overlay network.
Unlike traditional VPNs like OpenVPN where you dial into a central server, Netbird creates a peer-to-peer mesh. My laptop, my phone, and my servers all connect directly to each other using WireGuard encryption.
High Availability Routing
If I am at a coffee shop and I want to access my internal 10.x.x.0/24 network, I don't want to install the Netbird client on every single smart home device or IoT switch. Instead, I use Netbird's Network Routes feature to turn specific nodes into subnet routers.
Because losing access to my lab while traveling is my worst nightmare, I built a 3-tier High Availability (HA) routing setup in Netbird:
- Tier 1 (Metric 1): A dedicated ARM Single Board Computer. This is the primary gateway. It stays online even if the hypervisors are rebooting.
- Tier 2 (Metric 2): A Docker container running on my main Proxmox host (
vpn-node). If the SBC dies, Netbird instantly fails over to this VM. - Tier 3 (Metric 9999): A fallback pod running deep inside my Kubernetes cluster.
If node 1 goes offline, Netbird's control plane detects it and instantly updates the WireGuard routing tables on my laptop to route 10.x.x.0/24 traffic through node 2. It is enterprise-grade HA routing that took five minutes to configure.
Bridging the Legacy Gap (ZeroTier)
The true power of this Mesh architecture became apparent when I needed to connect to a legacy remote site that was entirely built on ZeroTier.
Instead of installing ZeroTier on my laptop and running two different VPN clients, I installed ZeroTier on my Netbird routing nodes and enabled IP forwarding for the 192.168.w.0/24 subnet.
Now, Netbird announces the ZeroTier subnet to my devices. My laptop sends a packet to the Netbird overlay, it hits my SBC, and the SBC seamlessly bridges the packet over into the ZeroTier network. It is an overlay bridging another overlay, completely transparent to me as the end user.
Conclusion
By splitting my traffic into two distinct paths, using Cloudflare for public web and Netbird for private admin, I achieved a true Zero Trust setup.
My router firewall drops 100% of inbound connections. My internal subnets are completely isolated from the internet. Yet, I can access any internal IP securely from my phone anywhere in the world, and my public websites load blazing fast via Cloudflare's edge cache.
If you are still using port forwarding in your homelab, it is time to close the ports.