Recently installed tailscale. Amazing reddit / selfhosted ---------------------------------------------------------------------- TXAGZ16 · 2023-09-27 02:56 I have heard things like “ready in under 5 minutes”. After hours of struggling with a wireguard VPN to my home network (something I have always struggled with, even though port forwarding settings seems right) I decided to give Tailscale a try. It’s amazing. I installed the client on a NAS I’m going to deploy as an offsite backup and it just works. Super simple, I appreciate them. Anything else it can do besides connect devices? I am just started to scratch the surface of their capability ---------------------------------------------------------------------- weischin · 2023-09-27 03:07 [Advertising subnet routes](https://tailscale.com/kb/1019/subnets/) useful for network devices without Tailscale ---------------------------------------------------------------------- thedthatsme · 2023-09-27 05:13 Taildrop sounds awesome but I haven't setup home server yet. ---------------------------------------------------------------------- ElevenNotes · 2023-09-27 06:13 That you struggled to setup wireguard, which has literally like 4 lines of config, speaks volumes and is the reason why Tailscale exists. I’m not shitting on you, but you are the perfect example why a VC backed company like Tailscale gets pushed on this sub like crazy. Why did you give up on wireguard? Did you ask for help on this sub? ---------------------------------------------------------------------- GolemancerVekk · 2023-09-27 07:01 It's not 4 lines of config lol. People use Tailscale because you say "tailscale up" and that's it. Meanwhile, here's the "quick" setup for wg: https://www.wireguard.com/quickstart/ ---------------------------------------------------------------------- ElevenNotes · 2023-09-27 07:02 Yes. Using Netflix is easier than Plex, do you see people saying only use Netflix and forget about Plex, becaue Plex is more complex to setup? ---------------------------------------------------------------------- GolemancerVekk · 2023-09-27 07:02 Also [exit nodes](https://tailscale.com/kb/1103/exit-nodes/), so you can use a Tailscale device like a regular VPN. ---------------------------------------------------------------------- GolemancerVekk · 2023-09-27 07:17 You can connect to a Tailscale device with SSH even if it doesn't have SSH installed. You can use Tailscale devices as a regular VPN exit-through. There's also an option to tie it into Mullvad VPN. You can use a Tailscale device to reach other non-Tailscale devices on the LAN beside them (subroutes). You can use RustDesk to remotely assist people on their computers if they have Tailscale active. You can use Tailscale Funnel to expose a service on a Tailscale device to the internet (it's a reverse proxy that comes with a ts.net subdomain). You can easily Tailscale-enable any docker container with their [docker mod](https://tailscale.dev/blog/docker-mod-tailscale) so you can easily expose dockerized apps to your entire Tailscale network (or to the internet, with Funnel). ---------------------------------------------------------------------- GolemancerVekk · 2023-09-27 07:24 >do you see people saying only use Netflix and forget about Plex, because Plex is more complex to setup? Um, yes? 😂 Netflix has 238M customers and Plex 16M? ---------------------------------------------------------------------- ElevenNotes · 2023-09-27 07:24 I mean on this sub. ---------------------------------------------------------------------- GolemancerVekk · 2023-09-27 08:24 Ok but we don't self host for the sake of it, we do it to solve specific problems in a cost-effective and privacy-oriented way. If I need a VPN service the first option is to use Mullvad not to rent a VPS and spin my own. Same for mail service, DNS service, hosting etc. In the time I would spend on setting up WireGuard to only tie 2 points I can have Tailscale tie a dozen points with more features and also do other stuff. ---------------------------------------------------------------------- ElevenNotes · 2023-09-27 08:39 >In the time I would spend on setting up WireGuard to only tie 2 points I can have Tailscale tie a dozen points with more features and also do other stuff. In the time I would spend on setting up Plex to only work on 2 clients I can have Netflix work on a dozen clients with more features and also do other stuff. ---------------------------------------------------------------------- GolemancerVekk · 2023-09-27 09:24 And many people do exactly that. You use Plex/Emby/Jellyfin/Kodi and so on only after you've weighed the pros and cons, including costs and setup. Typically it's people with a private collection of films/series/music that you can't get from streaming services. Putting together a NAS is not exactly cheap. ---------------------------------------------------------------------- KoppleForce · 2023-09-27 10:00 These instructions are shit and never worked for me. Trying to follow other guides (like digital ocean), there seems to be a dozen steps not mentioned on their own website that need to happen. Have you tried using wg-easy? Or if you prefer to not use docker, the pivpn script is also incredibly simple. ---------------------------------------------------------------------- ludacris1990 · 2023-09-27 11:13 The only problem with tailscale is, that everything runs trough their infrastructure. ---------------------------------------------------------------------- TXAGZ16 · 2023-09-27 11:52 Yes! I think I saw something called “no scale” or something like that, that tries to solve that issue I believe ---------------------------------------------------------------------- wdaburu · 2023-09-27 11:55 Or wg-easy on github. ---------------------------------------------------------------------- TXAGZ16 · 2023-09-27 11:55 I didn’t know of all these other services, I’ll check them out. Thanks :) ---------------------------------------------------------------------- Apart_Ad_5993 · 2023-09-27 11:58 How is that a problem? So does your email, your phone, your banking information, your credit card. It all runs through other parties. ---------------------------------------------------------------------- TXAGZ16 · 2023-09-27 12:05 Thanks for the starting point. I was trying to do everything with docker, but couldn’t get it up. I recently made changes to my homelab and had it running perfectly fine in an lxc container. Just got to tinker with it more. I also wanted an excuse to mess with Tailscale since I have heard a lot about it ---------------------------------------------------------------------- GolemancerVekk · 2023-09-27 12:20 I was half-joking about that guide being quick btw. 🙂 Look up wg-easy on github if you really need a simple way to set up wireguard. ---------------------------------------------------------------------- Horfire · 2023-09-27 12:27 Here is my quick start guide: curl -L https://install.pivpn.io | bash pivpn -a -n ---------------------------------------------------------------------- HuskyPlayz48 · 2023-09-27 12:30 pivpn is the shittz ---------------------------------------------------------------------- primevaldark · 2023-09-27 12:32 My mobile provider CGNATs IPv4 traffic and allocates direct IPv6 and my home provider allocates a semi-static IPv4 but does not support IPv6 at all. In these conditions, Wireguard just does not work, no matter the number of lines in the configuration. Tailscale went through its bag of tricks and connected me via DERP without me lifting a finger. Now, in the spirit of this community, one could say I could rent a cheap VPS from Hetzner or whatever for Headscale etc, but this is my “mañana” item. ---------------------------------------------------------------------- primevaldark · 2023-09-27 12:38 Headscale ---------------------------------------------------------------------- primevaldark · 2023-09-27 12:47 “But we do not self-host for the sake of it”. You must be new here :-) I agree with you in principle but specifically on this sub, the amount of “what new interesting thing can I self-host” posts says otherwise. ---------------------------------------------------------------------- GolemancerVekk · 2023-09-27 13:00 Yeah wg-easy is probably the better example if you need a 2-point connection. Headscale is probably the better for multi-point. Let's face it, VPNs have never been easy to set up. ---------------------------------------------------------------------- GolemancerVekk · 2023-09-27 13:03 I like those posts but I read them for fun and move on, it's like window shopping. I have my work cut out for me making the services I actually need work properly, I'm not gonna services I don't. ---------------------------------------------------------------------- ElevenNotes · 2023-09-27 13:08 I said it multiple times on this sub: For your usecase tailscale is fine, because your ISP has put restrictions on you, but if you don't have these restrictions, no need for Tailscale. ---------------------------------------------------------------------- zurzat · 2023-09-27 13:08 >The only problem with not true unless NAT traversal isn't working. e.g. UDP is completely blocked. https://tailscale.com/blog/how-tailscale-works/ ---------------------------------------------------------------------- pandupewe · 2023-09-27 13:59 You can install headscale tho. And use your own server ---------------------------------------------------------------------- mrmclabber · 2023-09-27 14:18 It's a risk. If I run wireguard\openvpn\ipsec\etc on my hardware, if tailscale, google, or someone else goes down my VPN stays up. I am the one in sole control of my VPNs availability, well, that and my ISP. Then for the privacy minded folks, having another company in the middle of your VPN is a concern for them. It's not that it's inherently a problem, but you are now at the mercy of that company. Say, maybe they decide to neuter their "free" tier. Now you have your entire infra setup on TS, and now you have to migrate off. May not be much of a concern, but it's something to at least be cognizant of. ---------------------------------------------------------------------- chaplin2 · 2023-09-27 14:31 It’s a code that they control. They can toggle a button and serve you with a different code. ---------------------------------------------------------------------- nonodontdoit · 2023-09-27 15:31 If you wanted to try wireguard again I could help you out iyl. ---------------------------------------------------------------------- GolemancerVekk · 2023-09-27 18:18 And even when it runs through them, it's encrypted and they don't have the node keys. The problem in that case is that the bandwidth is limited, not that they spy on you. ---------------------------------------------------------------------- d4nm3d · 2023-09-27 20:13 this is the big winner for me.. seeing as how they now allow unlimited subnet routers on the free tier... I have 3 sites and i run 3 subnet routers in each for failover (which is automatic btw).. Tailscale is the one thing that makes me able to self host for not only myself but for my mum too and have a very easy management plane. ---------------------------------------------------------------------- d4nm3d · 2023-09-27 20:15 I would love to use wireguard natively as not being able to use the wireguard client is the one thing that i wish Tailscale allowed.. but.. I need to mesh 3 sites together and have the entire network on each site available to all clients.. ---------------------------------------------------------------------- talent_deprived · 2023-09-27 21:04 I found [https://www.linuxbabe.com/](https://www.linuxbabe.com/) to be the best for Wireguard, and several other topics. ---------------------------------------------------------------------- thehoffau · 2023-09-27 21:08 You can install headscale and your own deep/Nat gateway if you want, it uses the same tailscale client and has most of the core capabilities. Then all traffic including your magic Nat traversal stuff is on your gear. I have the smallest linode possible as my central deep and secondary exit node :) ---------------------------------------------------------------------- lucassou · 2023-09-27 21:26 Most of what is on my plex is not available on Netflix, also plex is kind of a bad example since it requires access to their servers anyway. Currently my ISP uses shared ipv4 for multiple routers and while I could setup headscale on a rented vps it's currently more hassle than using tailscale for not much gains ---------------------------------------------------------------------- mpw-linux · 2023-09-28 00:00 I use Tailscale all the time on all my computers. I think it works great and easy to install. ---------------------------------------------------------------------- TXAGZ16 · 2023-09-28 02:06 Sorry for a delayed reply, thank you a lot for offering to help. I will give it another stab. Many people have suggest wg-easy. I added a container in portainer and everything is up and running. the web gui works and the logs look fine. I scanned the QR code with my phone, however it cannot reach the internet once i turn wifi off. I have a TPLink router. Under NAT Forwarding I clicked on virtual servers. I entered the External and Internal Port to be 51820 with the UDP protocol with my internal IP being [192.168.0.166](https://192.168.0.166) (my server). Since that didnt work, I went to port triggering where I did a similar exercise but it doesnt have a way to specify the internal IP ​ Do you know what I could do different? ---------------------------------------------------------------------- nonodontdoit · 2023-09-28 07:11 First off, have you confirmed you're not on a cgnat? Sorry if I ask questions you've answered in other places. ---------------------------------------------------------------------- nonodontdoit · 2023-09-28 08:46 I'll want to do this myself at some point. ChatGPT gives this advice/example: [https://chat.openai.com/share/378cd4b2-e4ae-45cc- 8b95-07fe286e6c3f](https://chat.openai.com/share/378cd4b2-e4ae-45cc- 8b95-07fe286e6c3f) As it says at the bottom. Routing tables and firewalls need configuring too. Just as a test, say you're on network X and connect to server/network A, can you still access resources on network X? If not then that's where the ip/routing tables come in. ---------------------------------------------------------------------- TXAGZ16 · 2023-09-28 12:05 I just confirmed, I am not on a cgnat:) ---------------------------------------------------------------------- nonodontdoit · 2023-09-28 14:12 Could you sanitise and paste in your docker, wg0 and tplink configs. Imgur link/paste/dm whichever you prefer. ---------------------------------------------------------------------- TXAGZ16 · 2023-09-28 14:51 This is the docker container layout I followed, i changed the environment variables to match my own. [https://hub.docker.com/r/weejewel/wg- easy](https://hub.docker.com/r/weejewel/wg-easy) Here is a link to Imgur for the other configs [https://imgur.com/a/JZCBH8W](https://imgur.com/a/JZCBH8W) the wg0.config screen shot is inside of the docker container. The wg0.conf location that the docker is mapped to on the host machine, is empty. I am guessing I should start there? I hadnt checked that before ---------------------------------------------------------------------- nonodontdoit · 2023-09-28 16:20 Well if it's empty then I think we've found a clue at least lol. Are you using docker run or docker compose? What files do you have inside /.wg-easy? Is the folder located at root or in home/TX../.wg-easy? I not certain if all these questions are relevant but they certainly help me build a picture of your situation. ---------------------------------------------------------------------- TXAGZ16 · 2023-09-28 16:24 I populated wg0.conf on the host machine with the same file as the docker machine and it still wouldnt connect. I am doing this as a docker compose stack inside of portainer but have tried it as a standalone docker container, without a compose file and gotten similar results. the only files in /.wg-easy are wg0.conf and wg0.json the folder is in the root directory thank you again for trying to help me trouble shoot! thank you ---------------------------------------------------------------------- TXAGZ16 · 2023-09-28 16:56 I notice on the client side, my iphone, that the endpoint changes when going from wifi to cellular. the enpoint on wifi is internalip:51820 the endpoint on cellular is a long string of characters:51820 ---------------------------------------------------------------------- nonodontdoit · 2023-09-28 19:06 So my theory here is that you've got a folder own by root trying to be accessed by portainer/container not running as root. I might be wrong. I did it the docker compose way feel free to try it yourself. * Make the folder home/USER/wireguard * cd into folder nano compose.yml * \`version: '3.8' services: \####################### wg-easy wg-easy: container\_name: wireguard image: weejewel/wg-easy restart: unless-stopped volumes: \- /home/USER/wireguard:/etc/wireguard environment: WG\_HOST: YOURIP PASSWORD: PASSWORDHERE ports: \- 51820:51820/udp \- 51821:51821/tcp cap\_add: \- NET\_ADMIN \- SYS\_MODULE sysctls: \- net.ipv4.ip\_forward=1 \- net.ipv4.conf.all.src\_valid\_mark=1\` * save it * docker compose up -d Can you manage docker as a non-root user? [https://docs.docker.com/engine/install/linux- postinstall/](https://docs.docker.com/engine/install/linux- postinstall/) ---------------------------------------------------------------------- TXAGZ16 · 2023-09-28 20:32 I did everything you suggested, including add my user to the docker group. I tried putting the config files on the mounted drive like all my other containers, still nothing. I changed the port to see if my ISP was blocking it, it didnt work still. Its no big deal man, i really appreciate the time you put into this and helping