Selfhosted

Before you go too far into it and spend lots of time, I think most VPS services let you installed a new OS on their admin site so you can start again from scratch. If you're not sure that is the right linux flavour, go for something else more mainstream so you can find lots of support online. Looking at the OS, I'm sure it might be good but I'm also sure you can install all the features very easily yourself, especially if it's just using docker mainly.

I second UFW. I found this guide useful: https://www.digitalocean.com/community/tutorials/ufw-essentials-common-firewall-rules-and-commands. You might want to try tailscale as others use it for easily setting up vpn access but not used it myself. Also go for fail2ban or, for more assurance but harder work, try crowdsec too.

You could also use cloudflare dns and add IP and/or country restrictions to block all traffic before it gets to your VPS. I have a country filter and it's crazy how many bots get blocked from all over!

zerotier.

Use ufw to only allow certain ports as needed

You can set up firewall rules that limit connections to certain ports. For example, you can disallow connections to everything but port 22 (which ssh runs on) to only allow access to the ssh server from outside. Same with VPN.

Read up on ufw (or iptables if you want to do it lower level and have a drink on hand).

What's the point of renting a VPS if you only access it from your own network? I understand why a large company would do it (risk mitigation) but I don't understand why a self-hoster wouldn't just use an old computer at home. Your costs would be reduced and you could more easily control access.

Now that being said, most Cloud VPS providers have a firewall that you can configure from their web portal. If you whitelist your home network public IP then you can be sure that anyone connecting to your VPS will have to be doing so from your home network. You could do the same thing with UFW or Iptables on the VPS but I recommend using the external firewall because it won't take resources from your VPS while defending against a DDOS.

Acronyms, initialisms, abbreviations, contractions, and other phrases which expand to something larger, that I've seen in this thread:

3 acronyms in this thread; the most compressed thread commented on today has 12 acronyms.

[Thread #142 for this sub, first seen 17th Sep 2023, 13:05] [FAQ] [Full list] [Contact] [Source code]

My preferred option is to have the VPS inside a VPC that blocks all external traffic by default. Then I can open up specific ports for specific IP ranges.

The reason I prefer this over a firewall configuration on the VPS itself is that the latter seems far more error-prone to me. For example, I've had problems in the past with ufw and Docker where container ports were still reachable even though access was denied via ufw.