I've been running Node-RED on my home network for a while now, controlling various ham station functions and monitoring gear remotely. The problem? Accessing it from outside my network meant either opening it directly to the internet (yikes) or dealing with VPN clients on every device I wanted to use.
VPNs work, sure, but they're a pain. You need to install clients, manage configurations, deal with connection drops and if you want to give access to other hams in your club? Good luck walking everyone through VPN setup on their computers. Plus, most free VPN solutions limit you to a handful of users.
I wanted something better. A secure web portal that I could access from anywhere with just a browser. No client software, no complicated setup for users, but still locked down tight with proper authentication and encryption.
That's when I decided to build out a proper web portal on 44Net using Traefik and Authelia. After getting it working, I packaged the whole thing into an automated setup script so other hams could use it too.
Here's the project: https://github.com/n3bkv/44Net-Secure-Portal
What This Actually Does
The setup creates a reverse proxy on a Raspberry Pi that sits on your 44Net address (or any public IP). Here's the flow:
1. Someone hits https://portal.yourcall.org
2. Traefik intercepts the request and redirects them to: https://auth.yourcall.org
3. Authelia presents a login page
4. Once authenticated, Traefik forwards the request to your internal service (like Node-RED at 192.168.1.100:1880)
Your internal services never touch the internet directly. Everything goes through the authenticated proxy. And it all happens over HTTPS with automatic Let's Encrypt certificates being generated and maintained.
Why This Works Great for Ham Applications
I'm using this to expose a Node-RED dashboard that controls our remote club station. Other hams in my club can log in and check station status and control various functions. No VPN required - just a bookmark and their credentials.
This same setup works perfectly for: - Grafana dashboards showing propagation data - Home Assistant instances for station automation - Custom web apps for contest logging - Club repeater monitoring dashboards - Really anything running on your local network
The key advantage over VPN is simplicity for users. I can give someone access by just creating them an Authelia account. They bookmark the URL, log in with their credentials, and they're in. No app installs, no configuration files, no troubleshooting why their VPN keeps dropping.
The One-Command Setup
I spent way too much time getting Traefik and Authelia configured correctly the first time. Docker networking, Let's Encrypt challenges, bcrypt password hashing - there are a lot of moving parts. So I automated the entire thing into a single setup script.
SSH into your Raspberry Pi (that already has a 44Net IP configured) and run:
curl -fsSL https://raw.githubusercontent.com/n3bkv/portal-docker/main/setup-portal-docker.sh -o setup-portal-docker.sh
chmod +x setup-portal-docker.sh
sudo ./setup-portal-docker.sh
The script walks you through a series of prompts:
Portal domain: This is where users will actually go. Example portal.yourcall.org
Auth domain: Where the login page lives. Example auth.yourcall.org
Let's Encrypt email: For certificate expiration notices (though Traefik auto-renews them)
Internal server URL: Where your actual service lives. For me that's http://192.168.1.100:1880 for Node-RED
Timezone: Important for Authelia's logs
Username/password/email: Your initial admin account
The script also asks about login lockout settings. I enabled this feature - it temporarily bans IPs after 5 failed login attempts within 10 minutes. The ban lasts an hour. This stops brute force attempts.
What Happens Behind the Scenes
The script handles everything:
1. Installs Docker if it's not already present
2. Generates secrets and hashes your password with bcrypt
3. Creates the entire Docker Compose configuration under /opt/portal-docker
4. Sets up Traefik with Let's Encrypt certificate resolvers
5. Configures Authelia with your user database
6. Launches both containers on an isolated Docker network
7. Validates the Authelia configuration
Within a minute or two, you've got a production-ready secure portal.
The DNS Setup You Need
Before running the script, you need two DNS A records pointing to your 44Net IP:
portal.yourcall.org A 44.xx.xxx.xxx
auth.yourcall.org A 44.xx.xxx.xxx
Both point to the same IP - Traefik uses the hostname to route traffic internally.
You also need ports 80 and 443 open on your firewall. Port 80 is only used for Let's Encrypt's HTTP challenge, then Traefik redirects everything to HTTPS.
My Experience Running This
I set this up about two months ago and it has been rock solid in my testing. Let's Encrypt certificates renew automatically. The login page is fast and works perfectly on mobile. I've started giving access to other hams for testing and nobody has had any issues.
The login lockout feature has already blocked a few bots that found the portal and started trying default credentials. Check your Authelia logs sometime - it's educational how much garbage traffic hits any public-facing web service.
One thing I really appreciate is that my Node-RED instance stays on my internal network. It has no idea it's accessible from the internet. All the security happens at the Traefik/Authelia layer. If there's ever a Node-RED vulnerability, attackers still can't reach it without valid credentials.
Adding More Users
When you want to add users, you edit /opt/portal-docker/authelia/users_database.yml. The format is specific, so follow the example in the README carefully. The indentation matters in YAML files.
Generate a bcrypt hash for the new password:
docker run --rm authelia/authelia:latest authelia crypto hash generate bcrypt --password 'their-password'
Add their entry to the file, then restart Authelia:
docker compose -f /opt/portal-docker/docker-compose.yml restart authelia
The new user can log in immediately. No need to restart Traefik or anything else.
Some Gotchas I Learned
Certificate rate limiting: Let's Encrypt will rate limit you if you request too many certificates in a short time. During testing, I hit this a few times since I wanted to test with production certs. Just wait an hour and try again. Once it's working, Traefik handles renewals smoothly.
Internal URLs with paths: If your internal service needs a specific path (like http://192.168.1.100:1880/ui), you can't make Traefik auto-append that path. The workaround is to include it in your portal URL: portal.yourcall.org/ui
Formatting the users database: Be careful with YAML indentation when adding users. One misplaced space can break authentication for everyone. I keep a backup copy of the file just in case.
Why Not Just Use Cloudflare Zero Trust Access?
Some folks ask why not use Cloudflare Zero Trust Access for this. That works too, but:
You're dependent on Cloudflare's infrastructure
a. You're routing all your traffic through their network
b. Some hams prefer keeping things under their own control
c. This solution teaches you about reverse proxies and authentication
d. That said, Cloudflare Zero Trust Access is totally valid if you prefer that approach. I wanted something I fully controlled and understood but I am experimenting with it as well.
Security Reminders
Even though this setup is secure, remember you're putting services on the open internet. Some best practices:
• Use strong, unique passwords for Authelia accounts
• Enable the login lockout feature
• Use SSH keys instead of password auth for the Pi itself
• Run a proper firewall (I use my nftables-firewall-builder script for this - https://github.com/n3bkv)
• Consider network segmentation - maybe your portal Pi is on a separate VLAN
• Install fail2ban for additional SSH protection
• Keep your Pi updated with security patches
The Bottom Line
This setup gives me secure, easy access to our club statioj setup. No VPN client needed, proper HTTPS with real certificates and user management is straightforward.
The automated setup script takes the pain out of configuration. What would have taken me several hours of reading Docker documentation and troubleshooting now takes about five minutes.
If you're running anything on your home network that you want to access remotely - especially if you want to share it with other hams - this is worth setting up. It's been a game-changer for our remote station operations.
The project is open source and available here:
https://github.com/n3bkv/44Net-Secure-Portal
Big thanks to the developers of Traefik and Authelia for building such solid software. And if you use this setup, let me know how it goes!
73 and stay secure!
Note: If you don't have a 44Net IP yet but want to set one up, check out my other project for getting 44Net Cloud working with Wireguard on a Raspberry Pi: https://github.com/n3bkv/44net-cloud-wireguard-rpi
Comments
Post a Comment