Access Gladys remotely via a VPN (without Gladys Plus ☹)

[lmilcent]

Hello,

First of all, don’t forget that it is really very important to support [financially / in time] the open-source projects you use. This is how free and privacy-respecting alternatives can become mainstream and replace the famous GAFAM (Google, Apple, Facebook, Amazon, Microsoft) products.

So, I remind you that the simplest and most secure way to access Gladys from anywhere in the world is to go through Gladys Plus: Gladys Plus | Gladys Assistant.
And the cherry on top: it allows you to support this great project and push @pierre-gilles to spend even more time on it!

If for any reason you do not wish to (yet) support the project via Gladys Plus, there are solutions to securely access your instance.

Required « computer » knowledge level: medium.

Prerequisites

• Have a Gladys instance
• Know how to connect via SSH to your Raspberry Pi (part « Connect to your Raspberry Pi »)
• Have your internet box credentials to create a « NAT » (the links are below)

Method

In summary:

1. Install a Wireguard VPN server on your Raspberry Pi thanks to the PiVPN* project
2. Assign a static IP to the Raspberry Pi (and thus to Gladys)
3. Open certain ports in your internet box (a direct access to the VPN on the Raspberry Pi in a way) to connect from anywhere in the world.
4. Install an application on your phone or computer to connect via VPN
5. You will now be able to access Gladys as if you were at home. Nothing is exposed on the internet and you remain completely safe.

A VPN?
In simple terms: it is a software solution that allows you to act as if you were on your home local network, but from anywhere in the world via the internet.

Example:
You have left the house. By connecting your phone to the VPN at home, all your data will first go through your box before going to the internet. You will then be able to access Gladys via its name gladys.local or its private IP address (192.168.1.53 for example).
For internet browsing, there are more steps to go through with the VPN, so it is a bit slower.

What to remember:

1. Only the VPN is exposed to the internet
2. Gladys is not exposed on the internet
3. Once on the VPN, no one can intercept your flows to the internet or Gladys (practical for public wifi)

Tutorial to assign a static IP to your Raspberry Pi

To begin with, by default each device at home connected to WiFi or by cable has an IP address. This can vary from time to time and this is a problem when you want to expose a server on the internet.

In our case, we want to expose only a Wireguard VPN server on the internet (and not Gladys directly). You must therefore configure the operator box so that the Raspberry Pi always has the same IP address.

Here is a list of tutorials I found for each operator box. To begin with, to find the administration interface of your box: Savoir gérer sa Box – info.rueducoq.fr

• Freebox Revolution (Freebox OS): Freebox Revolution DHCP assigner une ip fixe - Astuces Pratiques.
• Old Bouygues Box: https://www.01net.com/actualites/configurez-correctement-votre-bbox-552354.html or general procedure: https://forum.bouyguestelecom.fr/questions/1008859-configuration-baux-dhcp-permanents
• Livebox: Comment attribuer une adresse IP statique à un équipement connecté à la Livebox - Aide et Contact Orange
• Old SFR box: Définir une IP statique pour le Raspberry Pi chez SFR

Tutorial to install PiVPN

You can follow the instructions here: https://korben.info/comment-installer-le-vpn-wireguard-facilement.html

Otherwise here are the important extracts.

• Connect to the RaspberryPi via SSH

• Install git by typing:
  sudo apt-get install git -y

• Run the PiVPN installation script:
  git clone https://github.com/pivpn/pivpn.git sudo bash pivpn/auto_install/install.sh

• Then follow the installation process
  

  
  
  Then choose « Wireguard ».
  
  
  
  The script will then install all the dependencies necessary for Wireguard. Then it will ask you for a port. Leave the default.
  
  
  
  Then choose your preferred DNS provider (Quad9 and OpenDNS are well known for privacy).
  
  
  
  Then leave the default choice for the connection to the server IP by the client:
  
  
  
  Keys will then be generated, allowing you to connect to the VPN from a computer or phone.
  
  
  
  The installer then recommends enabling « unattended » updates for more security and also indicates that you will need to restart.
  
  
  
  

• Restart to apply the changes.

• To create a user authorized to connect to the VPN (user « iMac » in the example): pivpn -a
  

  

• Download the Wireguard application for Android or iOS.

• Generate a QR code to « flash » it with the Wireguard mobile application for the user created previously (example in the image « PiMyLifeUp »: pivpn -qr piMyLifeUp
  

  

Create a NAT

You need to configure the operator box to open the Wireguard port on the internet (which will be redirected to Wireguard on the Raspberry Pi) and allow you to connect from anywhere in the world. This is called NAT!

I tried to find you guides for each operator (non-exhaustive list )

General explanations: Nouveaux Casinos en Ligne 2026 - Meilleurs sites fiables

• Freebox Revolution: https://www.cartelectronic.fr/blog/?p=2167
  If you get an error that the chosen port is outside the limits, you need to check an option « IP Full Stack » on your free subscriber account: Freebox : l'option "vraie IP fixe" en ZMD est disponible.
• Livebox: Livebox 4 : configurer les règles Nat pour pouvoir utiliser un jeu ou une application serveur - Aide et Contact Orange
• Bouygues: https://forum.bouyguestelecom.fr/questions/1049142-ouvrir-ports-nouvelle-interface-bbox
• SFR: https://service.somfy.com/downloads/fr_v4/paramtrage_sfr-neufbox_nb6_.pdf

Conclusion

I hope the tutorial is clear enough, otherwise do not hesitate to ask your questions and I will complete this tutorial.

[Jean34]

Nice tutorial , having some knowledge in this area, I still prefer to pay (pay) 10 bucks a month and be quiet with the gateway provided by @pierre-gilles, not to see to update, modify or break my head with multiple installations that will eventually make the pi… drop. After all, it’s just my way of seeing things

[pierre-gilles]

Thanks for this tutorial, very complete

Indeed, for tinkerers, this can be a good alternative, more secure than just opening a port.

@Jean34

Nice tutorial , having knowledge in this area, I still prefer to pay (pay) 10 bucks per month and be quiet with the gateway provided by @pierre-gilles, not to see to update, modify or break my head with multiple installations that in the end will make the pi drop

100%! I spend a lot of time on the gateway to ensure continuity/stability of the service, that’s also the promise of the gateway.

But I can understand that some people like to tinker on their side, it’s cool that there are several choices

[lmilcent]

Is Gladys Gateway not self-hostable for the moment after all?

[pierre-gilles]

Yes, it always has been, but it’s not interesting. The server part of the gateway is designed to be a « commercial » platform that manages many different accounts, the payment part, etc…

If you just want to access your personal Gladys, it doesn’t make sense to host the gateway, you might as well just access your instance directly via a VPN as you described here.

The gateway is open-source for two reasons:

• So that the code is public, auditable, and readable by everyone.
• So that if I ever stop the project or disappear for any reason (life accidents happen) Gladys users are not left helpless like when a cloud platform closes its doors.

But in my opinion, I never made the gateway open-source for people to try to launch it at home, it doesn’t really make sense

[lmilcent]

Thanks for the explanations, it’s much clearer

I had tried to create my instance based on the repo, but I quickly realized that dependencies on S3 (Vultr I think), a payment system, etc. were needed.