On: SSH into private machines from anywhere using Cloudflare Tunnel

[72deluxe]

Why not just run Wireguard on a raspberry pi, set up DDNS to send your home IP to a Dynamic DNS provider (if you're on a dynamic IP), and then SSH to your machines at home using keys (instead of passwords)?

Setting up a Pi and running the Wireguard install script is about half an hour of work.

[apitman → 72deluxe]

If you're using ddns why do you need WireGuard at all?

[Skunkleton → apitman]

I use a similar setup. The VPN is needed because it is the only port accessible outside my network. Wireguard is easy to setup right, and I already need it for accessing other stuff on my home network.

[philjohn → apitman]

Wireguard needs an endpoint

[apitman → philjohn]

If I understand GP correctly, the goal is to SSH into an RPi on a home network. Since they mention DDNS, it's implied that they're connecting directly to their home router. What I'm saying is why not port forward directly to the RPi?

[72deluxe → apitman]

Yes you are right. If just connecting to the Pi, port forwarding is fine (and I use this).

When adding more devices at home (IP cameras etc.) and not connecting just to the Pi then the Wireguard VPN comes in.