6. Remote access options

Choosing a Remote Access Method#

Before making your MyFin server available over the Internet, it is important to understand the different ways remote users can connect and the security implications of each option.

Exposing any service to the Internet means that it will eventually be discovered by automated scanners and bots. These systems continuously search for publicly accessible websites and services, looking for known vulnerabilities, weak passwords, or configuration mistakes.

For this reason, simply forwarding ports on your router and exposing MyFin directly to the Internet is not recommended unless you have experience securing public-facing servers with firewalls, intrusion detection systems, monitoring, and strong authentication policies.

The following sections describe the three most common methods of providing remote access.

Tunnels (Recommended)#

Examples:

• Cloudflare Tunnel
• Tailscale Funnel
• NetBird
• Headscale
• Pangolin
• Similar secure tunnelling solutions

For most users, Cloudflare Tunnel provides the best balance between security, ease of use, and accessibility.

Instead of exposing your server directly to the Internet, your server creates an outbound encrypted connection to Cloudflare. Remote users connect to Cloudflare, which securely forwards the traffic to your MyFin server.

This provides several advantages:

• No router port forwarding required.
• Your public IP address is never exposed.
• Works even if your ISP uses Carrier Grade NAT (CGNAT).
• Works with dynamic public IP addresses.
• Traffic is encrypted between Cloudflare and your server.
• Easy to set up and maintain.

One of the biggest advantages of Cloudflare Tunnel is the ability to place an authentication layer in front of your MyFin instance using Cloudflare Access.

For example, you can configure Cloudflare so that only specific email addresses are allowed to access your server.

The login process works like this:

User
   │
   ▼
Cloudflare
   │
   ▼
Enter Email Address
   │
   ▼
One-Time Passcode (OTP) sent by email
   │
   ▼
User enters OTP
   │
   ▼
Access Granted
   │
   ▼
MyFin

This means that even if someone discovers your domain name, they cannot reach your MyFin login page unless they first pass Cloudflare’s authentication.

This provides an additional layer of protection before MyFin is even contacted.

Dynamic IP Addresses#

Many Internet Service Providers assign dynamic public IP addresses, meaning your public IP may change periodically.

If you are using traditional port forwarding, you will typically need a Dynamic DNS (DDNS) service to keep your domain updated.

Cloudflare Tunnel removes this requirement entirely.

Because your server initiates the outbound connection to Cloudflare, it does not matter if your public IP address changes. As long as your server has Internet access, Cloudflare automatically reconnects the tunnel.

VPN (Most Secure)#

If the same group of trusted users regularly need access to your MyFin server, a VPN is generally the most secure solution.

Rather than exposing your server to the public Internet, users first connect securely to your private network. Once connected, they can access MyFin exactly as if they were sitting in your office.

Advantages include:

• Highest level of security.
• MyFin is never publicly accessible.
• No public reverse proxy required.
• Full access to your internal network (if desired).

The downside is that every remote user must:

• Install VPN software.
• Be issued VPN credentials.
• Be managed by an administrator.

This works very well for:

• Employees
• Business owners
• Long-term accountants
• Permanent remote staff

However, it can become inconvenient when granting temporary access to:

• Auditors
• Consultants
• External accountants
• Contractors

who may not wish to install VPN software or manage VPN connections.

WireGuard#

WireGuard is an excellent VPN solution and is widely regarded as one of the easiest and fastest VPN protocols available.

Many modern routers already include built-in WireGuard support, including several business-grade firewalls and routers.

Before installing a separate VPN server, check whether your existing router already supports WireGuard.

Learn more:

https://www.wireguard.com/

Port Forwarding (Not Recommended)#

Port forwarding makes your server directly accessible from the Internet by forwarding ports on your router to your MyFin server.

Typical ports include:

• TCP 80 (HTTP)
• TCP 443 (HTTPS)

While this is simple to configure, it is also the least secure option.

Your public IP address becomes visible, and your server will quickly begin receiving automated traffic from bots scanning the Internet.

If you choose this method, you should ensure that you have:

• Strong passwords.
• Multi-factor authentication where possible.
• Regular software updates.
• A properly configured firewall.
• Intrusion detection or intrusion prevention systems.
• Good monitoring and logging.
• Regular backups.

You should also consider using:

• Fail2Ban
• CrowdSec
• Cloudflare Proxy
• Geo-blocking
• Rate limiting

to reduce the likelihood of successful attacks.

If your ISP provides a dynamic IP address, you will also need to configure a Dynamic DNS (DDNS) service so that your domain name continues to point to your home or office connection after your IP address changes.

Because every router has a different interface, consult your router manufacturer’s documentation for instructions on configuring port forwarding.

Which Method Should I Choose?#

Our Recommendation#

For most home users and small businesses, Cloudflare Tunnel offers the best balance between security, simplicity, and ease of access.

If your remote users are permanent staff members and you are comfortable managing VPN users, a WireGuard VPN is the most secure solution.

Direct port forwarding should generally only be used if you fully understand the security implications and have appropriate protections in place.