If hardware is the foundation of a HomeLab, networking is what lets the pieces work together. After years of fighting port forwarding, dynamic DNS and residential networking in general, I'm confident we've found a setup that works.
We combine ZeroTier, Cloudflare DNS and Cloudflare Tunnel. Together they give us a secure network we can reach from anywhere in the world, without changing a single router setting or opening a single port.
This post walks through how we set it up, what each part does, and how it has changed the way we work with our distributed HomeLab.
How networking used to work
The "old days" were only two years ago for us.
You want to reach your home server from the office, so you forward port 22 for SSH, and maybe 80 and 443 for web services. Then you find out your ISP uses CGNAT, so you don't have a real public IP. Or you do, but it changes every few days. Opening ports to the internet feels unsafe, and VPNs are a pain to set up and maintain.
Then you want to reach services from your phone while travelling. That means more port forwarding, a different port for each service, and dynamic DNS that works only some of the time. A corporate firewall that blocks everything except HTTP and HTTPS makes it worse.
I spent countless hours on router configurations, debugging unreachable services, and explaining to family members why they couldn't reach the photo server away from home. I was sure there was a better way.
ZeroTier plus Cloudflare
Our current setup removes about 90% of those headaches, and it's more secure and reliable than anything I managed to cobble together the old way.
At a high level:
- ZeroTier creates an encrypted overlay network that connects all our devices.
- Cloudflare DNS resolves our domains quickly and reliably, with extra features we use.
- Cloudflare Tunnel exposes selected services to the internet without opening ports.
Every device in the HomeLab can talk securely to every other device, whatever its physical location, NAT setup or firewall rules. The services we choose to publish are on the public internet with Cloudflare's security and performance in front of them.
ZeroTier
ZeroTier is what I always wanted VPNs to be. A traditional VPN uses a client-server model. ZeroTier builds a peer-to-peer mesh where every device can talk directly to every other device.
Why we picked it over a traditional VPN:
- There's no central server; devices connect to each other directly when they can.
- It works behind any NAT, including CGNAT.
- If a direct connection fails, traffic routes through ZeroTier's infrastructure.
- There are clients for every major OS, including ARM Linux.
- The free tier covers up to 25 devices on unlimited networks.
Our ZeroTier network
We run a single ZeroTier network (call it "alphabits-lab") with all our devices on it:
- All the Raspberry Pis and Orange Pis
- The dedicated server
- Our laptops and workstations
- Mobile devices, when needed
- Some client devices, for testing
Each device gets a static IP in the 10.147.x.x range (ZeroTier's default). The IP stays the same wherever the device is and whatever local network it's on.
Installation
# On Ubuntu/Debian
curl -s https://install.zerotier.com | sudo bash
sudo zerotier-cli join [NETWORK_ID]
# On Raspberry Pi OS (same commands)
curl -s https://install.zerotier.com | sudo bash
sudo zerotier-cli join [NETWORK_ID]
That's all. The device shows up in your ZeroTier Central dashboard, you authorise it, and it's on your network. There are no configuration files or certificates to manage.
I often work from Hoi An, a lantern-lit ancient town in Central Vietnam where $2 gets you a bowl of phở and $6 gets you a full dinner with drinks. Last month I sat on a balcony overlooking the Thu Bồn river, SSH'd into our lab Pi, opened the Node-RED interface and debugged a client's sensor data pipeline, all over ZeroTier. The connection was faster and more reliable than the café's WiFi. That's when I realised the setup let me work in a way most people would consider impossible.
The same network stack runs our I.C.E. Battery monitoring system. Sensor nodes at several physical sites connect back to a central dashboard through ZeroTier, with no per-site VPN configuration and no port forwarding. To add a monitoring node, we join it to the ZeroTier network and we're done.
Cloudflare DNS
We use Cloudflare as our DNS provider for more than domain resolution.
It's fast and reliable: a global anycast network with sub-10ms responses, 99.99% uptime and built-in DDoS protection. Beyond basic DNS, we use DNS over HTTPS for encrypted queries, geographic routing, health checks with automatic failover, and fine-grained record management across our many devices.
How we lay out DNS records
We keep both internal and external DNS records:
- Internal services point to ZeroTier IPs (10.147.x.x).
- Public services point to Cloudflare Tunnel endpoints.
- Development and testing subdomains point to specific lab devices.
For example:
- pi-main.lab.alphabits.team → 10.147.17.101 (ZeroTier IP)
- blog.alphabits.team → Cloudflare Tunnel
- dev-api.alphabits.team → 10.147.17.103 (development server)
Cloudflare Tunnel: public access without port forwarding
Cloudflare Tunnel (formerly Argo Tunnel) lets you expose services to the internet without opening a single port on your router. It works like this:
- You run the cloudflared daemon on your server.
- It opens an outbound connection to Cloudflare's edge.
- Cloudflare routes traffic for your domain to your service through that tunnel.
- Nothing comes in through your router, so there are no inbound ports to forward or secure.
Our tunnels
We run separate tunnels for different purposes:
- Main tunnel: the public website, blog and contact forms
- API tunnel: client project APIs and webhooks
- Development tunnel: temporary access for client demos
Installation and configuration
# Install cloudflared
wget https://github.com/cloudflare/cloudflared/releases/latest/download/cloudflared-linux-arm64.deb
sudo dpkg -i cloudflared-linux-arm64.deb
# Authenticate with Cloudflare
cloudflared tunnel login
# Create a tunnel
cloudflared tunnel create alphabits-main
# Configure the tunnel
# ~/.cloudflared/config.yml
tunnel: alphabits-main
credentials-file: /home/pi/.cloudflared/[UUID].json
ingress:
- hostname: blog.alphabits.team
service: http://localhost:3000
- hostname: api.alphabits.team
service: http://localhost:8080
- service: http_status:404
Our services are reachable from anywhere on the internet, while the servers themselves stay hidden behind Cloudflare. Our home IP address is never exposed, so no one can attack it directly.
What we gained
We can work from anywhere
At the office, travelling or at a client site, I have full access to the whole lab. SSH, web interfaces, databases and monitoring tools all work the same wherever I am.
Client demos look professional
If a client wants to see their IoT dashboard during a meeting, the demo environment is on a clean URL with an SSL certificate. Nobody has to hear "please ignore the port number" or "this might be slow because it's running on my home connection."
Development is simpler
I can start coding on my laptop, continue on a Pi 400 and test on the main server, all with the same URLs and configurations. There are no environment-specific settings or connection strings.
Security improved
Our network is more secure now than when everything was "locked down" behind NAT. ZeroTier encrypts traffic end to end, Cloudflare handles DDoS protection and SSL termination, and we have detailed logs of every access attempt.
The family can use it
My family can reach the photo server, media collection and home automation from anywhere without me troubleshooting the network. The URLs are simple and the connections are reliable.
Configuration tips and lessons learned
Plan your IP ranges
ZeroTier assigns random IPs by default, but you can, and should, give your servers static IPs. Our scheme is simple:
- 10.147.17.100-109: Raspberry Pis
- 10.147.17.110-119: Orange Pis
- 10.147.17.120-129: Dedicated servers
- 10.147.17.200+: Laptops and mobile devices
Use DNS names instead of IPs
Even though ZeroTier IPs are static, use DNS names in your configurations. It makes moving services between devices easier, and the names document what runs where.
Monitor your tunnels
Cloudflare's analytics for tunnel traffic are excellent. Set up alerts for unusual activity or connection failures. Those notifications have helped us catch several issues early.
Test failure scenarios
What happens if your main Pi goes down, or your internet connection fails? Test those cases and have a backup plan. ZeroTier's mesh helps, but you still need to plan for service redundancy.
Document everything
Keep a network diagram that shows which services run where, which DNS names point where, and how traffic flows. You'll rely on it when troubleshooting or onboarding new team members.
What it costs
The cost is one of the best parts:
- ZeroTier: free for up to 25 devices
- Cloudflare DNS: the free tier covers everything we need
- Cloudflare Tunnel: free, with no bandwidth limits
- Domain registration: about $12/year
Total networking cost: $12/year.
Business VPN services, static IP addresses from an ISP or enterprise networking gear would all cost far more.
Next up: CasaOS
With the network in place, we can get to the applications and services. The next post covers CasaOS, a Docker management interface that makes deploying and managing services pleasant instead of a chore.
It covers installation and configuration, and why CasaOS became our go-to tool for managing containers in the HomeLab.
If you're fighting port forwarding or CGNAT right now, try ZeroTier. It took us 10 minutes to set up and solved problems we'd been wrestling with for months.
Next up: "CasaOS: The Beautiful Face of Docker Management"