Choosing Between ZeroTier, HeadScale, and Netmaker for Selfhosting reddit / selfhosted ---------------------------------------------------------------------- No-Firefighter2532 · 2023-10-16 20:53 I find myself a bit confused, as I'm not an expert in this field. I'm looking for advice on what to use: ZeroTier, HeadScale, or Netmaker. My goal is to place my services behind a VPN for added security. I'm wondering which of these options is better and more secure. Is it worth comparing Netmaker to HeadScale and ZeroTier, or are they best suited for different purposes? If I opt for ZeroTier, is self-hosting a better choice, or should I go with their free plan? ---------------------------------------------------------------------- gsusgur · 2023-10-16 21:30 Free plan ZeroTier is the easiest to get started. But selfhosting I would recommend Headscale. Only ACL for many users are a bit tricky to get right, but if it is only you then it should be very straight forward if you know Docker etc. ---------------------------------------------------------------------- TinyMicron · 2023-10-16 21:32 If you goal is to get your services behind a VPN (assuming web services), I'd take a look at Cloudflare Tunnels. It's really simple to configure, and it gives you multifactor authentication, access controls and other nice things. :) It's also free! Otherwise I'd give Netmaker or plain Wireguard a try. ---------------------------------------------------------------------- talent_deprived · 2023-10-16 21:33 Plain, standard, Wireguard is the best option. ---------------------------------------------------------------------- hekermon · 2023-10-16 22:14 get a static public IP from your ISP and use Wireguard ---------------------------------------------------------------------- ffimnsr · 2023-10-16 22:41 Wireguard its default, and already part of of kernel just needs proper config and config tools ---------------------------------------------------------------------- -vwv- · 2023-10-16 22:56 I use ZeroTier's free plan to connect all my devices (notebooks, cell phone, pc, server, VMs). Easy to set up, maintenance free. I can recommend it, if you want to network a set of devices over which you have total control, because you need to have ZT installed on each device and once running there isn't really much of any extra authentication going on. Not a good choice if you need to access your network from third party devices or give any kind of granular access to a third party. ---------------------------------------------------------------------- needadvicebadly · 2023-10-17 00:49 Personally after using headscale for a while, I ended up going with Netbird. I prefer the UI of Netbird, plus it's been extremely stable and straightforward to setup and configure. my main issue with headscale was headscale-ui though, not headscale itself. So if the former works for you, then you I'd say go with it. ---------------------------------------------------------------------- xkcd__386 · 2023-10-17 02:05 my take: zerotier has weird licensing, and possibly other issues. I like tailscale best, which means headscale in your list. I've never tried netmaker but I've settled on (a) straight wireguard for one of my networks, (b) yggdrasil for a different network where I can't use a VPS / can only use public relays (my usage on that is mostly ssh type stuff; low bandwidth, so far it has worked fine) here's an excellent, and very *comprehensive*, review of various mesh VPNs: https://changelog.complete.org/archives/10478-easily-accessing- all-your-stuff-with-a-zero-trust-mesh-vpn ---------------------------------------------------------------------- Butthurtz23 · 2023-10-17 04:06 I had good experience with netbird and firezone ---------------------------------------------------------------------- msic · 2023-10-17 04:36 Wireguard is the fastest since it is based off the kernel. Headscale is slower as it uses the Go implementation. Unless you needing ACL, wireguard is your best bet. ---------------------------------------------------------------------- gioco_chess_al_cess · 2023-10-17 05:18 I tried netmaker, nebula, and ended up using netbird. My issue with all the others was traversing my corporate network. Netmaker and Nebula UDP hole punching failed while Netbird just did it without issues by relying on coturn. I did not test headscale, which could have worked by using DERP relays, because user space wireguard on Linux clients and registry editing to make the client work on Windows are a setback for me. Also, access control is far less user friendly with respect to what netmaker and netbird developed. The only thing to know before selfhosting netbird is that it requires an identity provider, zitadel as installed by default or any other selfhostable solutions take a lot of resources so if running on a base VPS one should look instead for a managed IDP. ---------------------------------------------------------------------- Rahul159359 · 2023-10-17 05:22 try using mistborn and customise it the way you want. ---------------------------------------------------------------------- lilolalu · 2023-10-17 05:38 BTW unless you are behind a cgnat you don't need any of these solutions, neither a VPS with wireguard. Its weird that nobody uses the simplest solution anymore, which is a dynamic DNS. if you additionally want to have a domain pointing at your server, just set CNAME for the ddns name in your dns settings. I think besides the very minor advantage of having a fixed IP (unless you want to run mailserver) instead of a fixed domain name, most people think they don't have to take care of security anymore because cloudflare does it for them. ---------------------------------------------------------------------- signed- · 2023-10-17 05:49 I would just use Tailscale, especially with the builtin quality of life features (Airdrop-like, SSH MFA...) ---------------------------------------------------------------------- mirisbowring · 2023-10-17 06:40 Or even DDNS and wireguard if static IP is no option ---------------------------------------------------------------------- phein4242 · 2023-10-17 07:24 Objectively you reduce your attack surface if you actually self-host wireguard, since you dont control 3rd party products, and cannot give any guarantees wrt their security. Unpopular opinion, yes, but security > convenience ;-) ---------------------------------------------------------------------- chaplin2 · 2023-10-17 09:06 Does Wireguard accept domain name instead of Ip? ---------------------------------------------------------------------- r0zzy5 · 2023-10-17 09:29 Yes, that's how I have mine set up since my ISP does not offer static IPs ---------------------------------------------------------------------- Accomplished-Lack721 · 2023-10-17 10:49 In my case, I run a Wireguard server on my router. Not every router firmware has that option, though (and some people may have the option and not realize it). I think there are some people who worry about opening up the port for the VPN. But it's not a particularly high security risk, and services like Tailscale aren't automatically better just because they initiate outbound connections. People overestimate what something like Cloudflare does for them. It can be helpful for a number of use cases and includes some good risk mitigation options, but it a service is still available to the outside world, it's still a potential vulnerability point that needs to be hardened reasonably at the level of the application and one's own network, too. ---------------------------------------------------------------------- survivallama · 2023-10-17 11:31 sure... but if you are really lazy tailscale works very well. ---------------------------------------------------------------------- mrpink57 · 2023-10-17 12:16 [https://github.com/wg-easy/wg-easy](https://github.com/wg-easy/wg- easy) Even so, this is for the lazy. ---------------------------------------------------------------------- 4LAc · 2023-10-17 12:36 Contented lazy person confirming. wg-easy very handy, and wireguard is a how I self-host (with duck- dns). And I cleanse my mobile devices browsing through my home's adguard at the same time too. ---------------------------------------------------------------------- DIBSSB · 2023-10-17 14:05 Netmaker Netbird Headscale/tailscale with your own drep server This sequence ---------------------------------------------------------------------- zt-joy · 2023-10-17 18:44 For your consideration in this convo... With self-hosted community ZeroTier, you get 1) Unlimited nodes 2) Unlimited networks 3) Unlimited admins