Need help setting up split tunnel VPN reddit / selfhosted ---------------------------------------------------------------------- RushTfe · 2023-10-21 13:50 Hello everyone! I'm fairly new to this selfhosting stuff, and I've been learning a lot of stuff from all of you, so first of all, thank you for your awesome contributions, guides and help. ​ First, some context of what I have. ​ \- I've everything working under a ubuntu server. I mainly use it for nextcloud, Jellyfin + ARRs and transmission for my linux isos. ​ \- I also use NPM as a reverse proxy to access all of my stuff from outside. ​ \- All of my services, are installed through docker compose. ​ \- I have a google domain pointing to my router, so I need to keep it working. ​ \- I want to use a VPN server to protect some of my services. ​ \- Last but not least, I need some of my services (jellyfin and nextcloud at least) outside the VPN as my family uses them, and I dont want them to be installing vpns and stuff to use it. ​ Few days ago, I had a problem with transmission where someone was downloading games, and some of you suggested me I should use a VPN with split tunneling. Mullvad seems to cover this, and I read a lot of people saying good things about it, so I think I should go there. ​ I've been reading a bit about this, but I'm totally confused on how to do this. I've read a lot of info, and it looks overwhelming to start from 0. Might end up being easy, but I'm lost and don't know where to start. 1. Do i need to install mullvad server directly inside my linux? (I haven't seen much on installing it through docker, but I would prefer this way if possible). I have seen a docker mullvad web browser but I'm sure it is not what I'm looking for. 2. Do I have to create an account in mullvad outside my server? 3. what does tailscale have to do with all of this? and why people encourage its use so much? 4. how should I start with this? 5. Do I have to port forward If using VPN? 6. Do I have to still port forward for the services I want outside the VPN? (Jellyfin and Nextcloud) or is it the only way to reach them? 7. Can I keep all my services under my google domain even when some of them are through VPN and the others dont? 8. Do I have to change settings on my reverse proxy in order to make this all work? ​ Sorry if those are too much questions, but I'm about to hurt myself in confusion. ​ Thank you all in advance!! ---------------------------------------------------------------------- PaintDrinkingPete · 2023-10-21 14:36 so...my guess is that your transmission web interface is open to the world somehow? It's a bit tough without knowing exactly what your setup is, but you may be making it all too complicated...? first, I'd make sure your web proxy open to the internet ONLY proxies appropriate services, such as nextcloud and jellyfin, and NOT anything else, such as Transmission and the -arrs. what I would do: if you need access to that stuff from outside of your network, setup your Ubuntu server as a Wireguard "host", and then connect to it that way (yes, you'd likely need to forward the wireguard UDP port on your home router). wireguard supports split- tunneling almost effortlessly, as you can set the "allowed IPs" on your connecting devices to be limited to your server, and all other traffic will route over the internet. you can also host a private wireguard interface on your server while still using a public VPN service for your Transmission torrent downloads. ---------------------------------------------------------------------- Tip0666 · 2023-12-23 15:54 Tailscale is awesome as a vpn/server coordinator. (Period) it will handle all communication protocols with all clients/submets. It’s preferable to install tailscale on all devices, (but not necessary) as long as other devices advertise subnet routes. (As of now 12/23 ubiquity/vlan/interface=conventionalvpn[mullvad],all clients to outside wan=tailscaleexitnode/vlan(mullvad)/ubiquity.