Tailscale: the marvellous tool that became indispensable to my tech life reddit / selfhosted ---------------------------------------------------------------------- yarov3so · 2023-11-26 11:48 I can't praise Tailscale and its developers enough... I discovered this do-it-yourself VPN solution about half a year ago and boy has it improved my life... Here is what I managed to accomplish with this. I am running Tailscale on my old macbook air, henceforth referred to as my "server", my two firesticks, and my phones. \*remotely=outside of LAN, so over internet\* \-I can access my SMB shares remotely from my phones with OwlFiles and from my M1 Macbook air seamlessly through Finder. All I had to do was enter a simple command on my server in Terminal to add TCP/445 to "Services". Tailscale then forwards incoming TCP connections on port 445 from within my tailnet to port 445 on my mac’s server. The result is that I am able to mount my 2TB share from anywhere I have internet and manage my files as though I was on my home network. I also have access to my entire media library from VLC installed on all my devices (once again, through SMB). If only I could somehow add my remote SMB shares to Kodi... But Kodi doesn't seem to allow me to type in custom IP addresses when trying to add SMB shares. Let me know in the comments if you know how to add remote SMB shares to Kodi (the ones it does not detect automatically). \-Similarly, by adding a suitable HTTPS port to my server's Tailscale services, I am able to manage the Transmission torrent client installed on my server remotely through Transmission's web interface (while connected to Tailscale, of course). \-I can back up to Time Machine remotely and accessing my Time Machine backups remotely as well. There are a few caveats though. On my server, I had to add a shared folder (from Settings), allow access to it via SMB and mark it as a Time Machine backup destination. The process is pretty straightforward. The trick is to add it as a backup destination THROUGH TAILSCALE by typing in the Tailscale IP of your server or the Magic-DNS domain name. Also, you will not be able to access pre-existing time machine backups through Tailscale! Only the destinations that you initially add through Tailscale. This is why I have two backup destinations on my server - one that I back up to from my LAN and one that I use over Tailscale remotely. Works like a charm!!! \-I can control my server through VNC remotely and seamlessly as if I was connected to LAN. To do that, I had to add TCP/5900 to my server's Tailscale services (which is akin to opening up TCP port 5900 to incoming connections from within the tailnet). This is particularly useful when I don't have my M1 mac with me, but need to run Python code inside Spyder. I just turn on my bluetooth/trackpad combo, connect it to my S10+, jack myself into my tailnet, MultiVNC my way into my server and BAM. \-MagicDNS deserves its own praiseful review. Not only did it assign a permanent, simple domain name to all my Tailscale-enabled devices, but it allowed me to configure my own DNS server for Tailscale-connected devices. I was then able to choose custom DNS servers for specific domains, which let me block FireTV updates without compromising my security (The DNS server used for that looks a little sketchy so I don’t want all of my traffic to go through it) and also use AdGuard DNS without breaking Doordash’s Dasher app by routing doordash- specific DNS requests to Google’s DNS and not AdGuard’s. Solid win here, as Adguard's DNS bricks the Dasher app. Let me know in the comments if you want to see my Magic-DNS configuration. \-FUNNEL: By running a funnel (proxy) on my home server, I am able to access my dad's Bell Fibe TV channels through their web interface from anywhere on Earth - Bell treats my traffic as if it was coming from my home network! It will NOT work if you use the mobile app, but works flawlessly from within Samsung Internet, Safari (on mac) and Grazing 3 (on iOS). Also, it’s quite neat to browse with my Canadian IP even when I am travelling (no more annoying "cookie consent" notices when in the EU). I suspect Netflix users could use this sort of setup to get around password-sharing restrictions. I am also running funnels on my firesticks just in case I need more bandwidth. \-SUBNETS: I am running a subnet on my home server so that I could adb into my firesticks and manage them remotely with scrcpy (update apps, install tweaks, etc). Yes, I am not a huge fan of the command line \^\^' . I can also access my wifi cameras remotely from my mac. The desktop app for the cheap chinese ones only allows you to manage them over LAN, but Tailscale takes care of that. Works like a charm! I am beyond pleased with everything Tailscale enables me to do. It baffles me that this technology is somehow free to use. I am extremely grateful to be a part of the Tailscale community. Thank you!! Share your ideas and questions in the comments. ---------------------------------------------------------------------- -SHINSTER007 · 2023-11-26 11:53 thanks for the effort write-up, I'm still trying to wrap my mind around how this works beyond its just magic ---------------------------------------------------------------------- ElevenNotes · 2023-11-26 11:59 Wait till you learn about Wireguard. ---------------------------------------------------------------------- freshmeat09 · 2023-11-26 12:08 I set it up in the last couple months as well, but am using headscale as my controller on a small vps. ---------------------------------------------------------------------- emhc1218 · 2023-11-26 12:17 Serious question, what makes tailscale so great? Isn't it just vpn? I have been using wireguard for years and am now seeing everyone saying how great tailscale is but I can't see any difference between them. If I already have wireguard setup and running, is there any point to look into setting up tailscale? ---------------------------------------------------------------------- XTJ7 · 2023-11-26 12:25 Not really, no. Tailscale uses wireguard under the hood. It has a nice user interface and makes setting up a split VPN super easy. It alsl provides relatively easy ways to do ACL between devices. If you already got wireguard set up, you can skip tailscale. ---------------------------------------------------------------------- emhc1218 · 2023-11-26 12:27 I see. Thanks for explaining ---------------------------------------------------------------------- ech1965 · 2023-11-26 12:40 to the best odf my understanding: wireguard is point to point. tailscale creates a "mesh" by creating point to point wirguards tunnels on an as needed basis. it takes care of keeping a register of the public keys for each participant and sets up tunnels. of course there is a lot of bells & whistles but the basis is this. ---------------------------------------------------------------------- cfouche · 2023-11-26 12:43 Tailscale uses wireguard under the hood ---------------------------------------------------------------------- SEND_NUKES_PLS · 2023-11-26 12:50 Tailscale is glorified Wireguard ---------------------------------------------------------------------- yarov3so · 2023-11-26 12:56 Yep I am familiar - I just prefer the simplicity and ease of use of Tailscale ---------------------------------------------------------------------- kurosaki1990 · 2023-11-26 12:59 TLDR: Tailscale it just work. ---------------------------------------------------------------------- Stetsed · 2023-11-26 13:00 Honestly I do love tailscale, but every time when I start using it I am just like... meh. I don't need a bunch of interconnected as I have 1 homelab, and for other stuff like my backup system it goes over v6 so there is no NAT to speak off(just a firewall). And for any remote devices I just use plain wireguard including my always on VPN on my devices. However I will continue to recommend Tailscale to people who are new to selfhosting and don't want to deal with all the networking bullshit, and hey if you want to not be reliant on the tailscale control server host headscale. ---------------------------------------------------------------------- numblock699 · 2023-11-26 13:02 It is great but ZT solutions like twingate is just so much easier and faster. ---------------------------------------------------------------------- madroots2 · 2023-11-26 13:08 I love Tailscale and it became business critical for me. I just love their generosity with their free plan, and that shit just works. I love it too man. ---------------------------------------------------------------------- Ci7rix · 2023-11-26 13:16 Care to elaborate why it’s safer and simpler ? ---------------------------------------------------------------------- lilolalu · 2023-11-26 13:20 Boy, can "guerilla" marketing get more obvious? ---------------------------------------------------------------------- Ystebad · 2023-11-26 13:23 "The result is that I am able to mount my 2TB share from anywhere I have internet and manage my files as though I was on my home network. I also have access to my entire media library from VLC installed on all my devices (once again, through SMB)." This just gives me the heebie-jeebies. I am afraid. Sticking with Wireguard VPN because it's what I know. Opening up my whole SMB filesystem to the WAN without feeling like I REALLY know how to secure and lock it down: 😟 ---------------------------------------------------------------------- radakul · 2023-11-26 13:29 Been a techy since a kid, IT "professional" for 12+ years. In undergrad, I had a professor tell me something I will never forget for as long as I live... "What I'm teaching you is 95% science (physics, electronic engineering theory, FFT, etc.) and 5% magic" It's absolutely true that no matter how well you understand *how* and *why* something is working, there is still that absolutely small percentage of "holy shit, I can beam a picture of a cat across the *entire planet* in a fraction of a second while pooping". If that isn't magic, I truly don't know what is. ---------------------------------------------------------------------- chaplin2 · 2023-11-26 13:31 You could install Wireguard on a VPS, and access all your devices from anywhere! This solution has existed forever (which is how you access your email, Gdrive etc). ---------------------------------------------------------------------- karlthemailman · 2023-11-26 13:31 I don't think this is opening up smb to the WAM anymore than just using wireguard directly. ---------------------------------------------------------------------- lilolalu · 2023-11-26 13:33 Just for clarification, the idea of mesh vpn is nothing new, and Tailscale did not invent this. in fact there are several implementations of this idea that are quite old - meshVPN - tinc VPN ---------------------------------------------------------------------- CAP_NET_ADMIN · 2023-11-26 13:36 I have a customer pushing 15Gbit/s of their production traffic in a microservices setup through Tailscale - it works fucking great and they've never had issues with it. ---------------------------------------------------------------------- blackstar2043 · 2023-11-26 13:42 For the time being, their recent additions to wireguard-go have increased its performance by nearly double when compared to the kernel version. From what I've read, the patches are currently under revision by zx2c4 for the kernel version. ---------------------------------------------------------------------- blackstar2043 · 2023-11-26 13:44 There is also Slack's Nebula. ---------------------------------------------------------------------- AlaskaInWinter · 2023-11-26 13:50 Access SMB… what’s the speed you generally get? I have tried it, and I’d be lucky if it gets 8-16 Mbps over 1Gbps up/down on both sides. ---------------------------------------------------------------------- Charming-Molasses-22 · 2023-11-26 13:52 Tailscale doesn't respect local traffic and they have refused to add split tunneling on their Android VPN client. For that reason, I would never take this product seriously. ---------------------------------------------------------------------- idontmeanmaybe · 2023-11-26 14:06 I tried Tailscale a while back, but it had a fatal flaw: it chewed through battery on iOS. Maybe they fixed that by now. I switched to wireguard so I haven't had a need to go back to it. ---------------------------------------------------------------------- survivallama · 2023-11-26 14:10 sure. but tailscale is doing it better. ---------------------------------------------------------------------- survivallama · 2023-11-26 14:11 way easier to just use tailscale ---------------------------------------------------------------------- lilolalu · 2023-11-26 14:11 Marketing bs ---------------------------------------------------------------------- SecretaryOfDefensin · 2023-11-26 14:12 I mean, if you're giving up on self-hosting, sure. ---------------------------------------------------------------------- XTJ7 · 2023-11-26 14:14 Oh, that is crazy! I think I should do a bit of performance testing then :) ---------------------------------------------------------------------- pthsim · 2023-11-26 14:15 What? Is recommending a product you like marketing? Or is OP affiliated with them in any way? ---------------------------------------------------------------------- mtx0 · 2023-11-26 14:15 how is this giving up on self-hosting? ---------------------------------------------------------------------- ProbablePenguin · 2023-11-26 14:17 It's just the ease of use, Tailscale sets everything up for you, keeps track of IPs so you don't need to manually define endpoints, and handles NAT negotiation. ---------------------------------------------------------------------- SecretaryOfDefensin · 2023-11-26 14:18 Personally, I don't like to rely on any services that require a third- party server for it to work. Admittedly, I'm a bit fanatical about it. If you're comfortable relying on their uptime, by all means, enjoy. ---------------------------------------------------------------------- blackstar2043 · 2023-11-26 14:18 There's an in-depth write-up with some performance results here: https://tailscale.com/blog/quic-udp-throughput/ ---------------------------------------------------------------------- lilolalu · 2023-11-26 14:21 After all this is /r/selfhosting. There are several well working, self hostable open source mesh vpn solutions, but someone enthusiastically advertises a commercial service here, in a wording that makes you wonder if he might be hired by the company to do so. ---------------------------------------------------------------------- byronsucks · 2023-11-26 14:25 I started using tailscale a while ago and it is quite nice tbf ---------------------------------------------------------------------- Oujii · 2023-11-26 14:30 You can self host your Tailscale server. ---------------------------------------------------------------------- yarov3so · 2023-11-26 14:33 exactly! that's precisely what im doing ---------------------------------------------------------------------- [deleted] · 2023-11-26 14:37 [deleted] ---------------------------------------------------------------------- intelatominside · 2023-11-26 14:39 I was also using Wireguard (and OpenVPN) until my ISP let's me share the ipv4 with my neighbors. Now I need Talescale. ---------------------------------------------------------------------- SecretaryOfDefensin · 2023-11-26 14:39 So, no connections to Tailscale's corporate servers at all? Apologies, I was thrown off by the per-user monthly fees. But how do they authenticate your account if you don't rely on their servers? ---------------------------------------------------------------------- Point-Connect · 2023-11-26 14:51 Take this with a grain of salt as I'm still a novice, but for me, part of self hosting is being able to easily, and "securely" access my homelab away from home. I personally use tailscale because it works extremely easily and I'm not confident enough in my own abilities to lockdown external access without constantly worrying I've left some major opening. Granted, I only use it to access media and my file server mainly, but it took like 10 minutes to set that up and have zero problems with it... And it's entirely free for my purposes. I get the enthusiasm of the post, it brings accessibility to a complex task, but I also get the skepticism as someone who likes to employ a healthy amount. ---------------------------------------------------------------------- XTJ7 · 2023-11-26 14:53 Thanks a lot, very interesting read. ---------------------------------------------------------------------- FritzSchnitz · 2023-11-26 14:54 Fire tv sticks are useful? ---------------------------------------------------------------------- Tekrion · 2023-11-26 14:56 If you're already running wireguard, there isn't much that you're missing out on except for convenience when it comes to device management and routing, automatic hostname DNS resolution, and also getting access to more advanced features like meshing and failover LAN/subnet sharing without needing to figure out how to do it in bare wireguard. Honestly though, it's free and makes for a great hassle-free backup VPN that just works. I use wireguard as my primary because it's fully self-hosted, runs at the kernel level instead of within the userspace so it's faster, and is more native than installing third-party solutions; with that said, I still run tailscale on all my servers as well in case I bork something while editing wireguard configs at any point. ---------------------------------------------------------------------- Oujii · 2023-11-26 15:01 If I understood correctly, you would have to host your own DERP relay servers (I think it can be the same as the headscale server). You can even NOT use their DERP servers and host your own on their cloud solution, basically you would be relaying through a node of your own and authentication is done using Google, Microsoft, Github and other services, not directly on them. They have a pretty good free tier now, but 3 users might be low for some people, I run mine with one user only. If you run Headscale (which is the selfhosted Tailscale server), I think the 3rd party login is still available, but you can use OpenID if you don't want to rely on 3rd party login. ---------------------------------------------------------------------- Oujii · 2023-11-26 15:04 Nice! Are you using OpenID or the embbed 3rd party apps? If you don't host your DERP servers (I read it's embbed), do they go through Tailscale's? Do you need to disable it via ACLs? Also, have you tested performance over your own DERP, I assume they throttle traffic on theirs for obvious reasons, but I was wondering the performance of one they don't own, just the raw performance. ---------------------------------------------------------------------- dbpcut · 2023-11-26 15:10 I'm a long time user and will ride or die for Tailscale. It's good enough to evangelize. ---------------------------------------------------------------------- yarov3so · 2023-11-26 15:13 The speed is pretty good - I can watch 1080p mkv video stored on my server with no issues at all when I'm in Europe (my server is in Canada). I tried watching 4K and didn't encounter any stuttering either. ---------------------------------------------------------------------- therealjeku · 2023-11-26 15:16 I am not as network savvy as most of you probably are, and I would love a way to have my home server’s docker containers accessible outside my home. Is this something Tailscale can help me with? Anytime I think about opening up my home server to the internet I get worried that someone smarter than me will be able to access my server and its files. ---------------------------------------------------------------------- clarksonswimmer · 2023-11-26 15:16 Don't knock it before you try it ---------------------------------------------------------------------- clarksonswimmer · 2023-11-26 15:17 You must be a very serious person ---------------------------------------------------------------------- yarov3so · 2023-11-26 15:17 They are pretty darn good and versatile once you get rid of all the bloatware and ads, and remap the remote buttons. For instance, with AirReceiver installed, they become as good as an appleTV for screen mirroring (mac and iphone). Also, the ability to seamlessly sideload is paramount for me, which is why I will never own an appleTV. I remapped my app buttons to the apps I want, as well as the home button to Wolf Launcher and it's mint now. I keep Tailscale running continuously on both of my firesticks. I used to bring my firestick along for the ride when I travel, but these days, I just run Wolf Launcher through Samsung DeX on my S10+. With the right settings, it does everything the firestick can do and more. ---------------------------------------------------------------------- clarksonswimmer · 2023-11-26 15:19 > headscale is an open source, self-hosted implementation of the Tailscale control server. https://headscale.net/ ---------------------------------------------------------------------- PirateParley · 2023-11-26 15:21 Zerotier is preety good as well. I like how zerotier has different networl so you can put them with in that network and they talk to each other. I believe or didn't find anywhere that zerotier can't advertise subnet. ---------------------------------------------------------------------- yarov3so · 2023-11-26 15:21 Haha if I was affiliated with them, I would not be talking about my collection of torrented material LOL ---------------------------------------------------------------------- ElevenNotes · 2023-11-26 15:29 I think you know that I and everyone else knows that. ---------------------------------------------------------------------- ElevenNotes · 2023-11-26 15:31 I know what you mean. I also prefer Netflix and Disney+, the simplicity and ease of use is way better than Jellyfin. ---------------------------------------------------------------------- Fragrant_Profile_522 · 2023-11-26 15:31 I don’t know how but the data rates/speeds I get are much closer to the advertised by my provider and they are significantly faster than others I’ve used/tried. I only use the free tier. MagicDNS is nice. For smb shares not sure if you’ve got an Apple TV laying around but the infuse app has been a huge improvement for media and I think it’s compatible. Definitely WebDAV and FTP mounts are seamlessly integrated. I’m sure any of these have FOSS alternatives, but these worked well for me ---------------------------------------------------------------------- lilolalu · 2023-11-26 15:33 Don't need it ---------------------------------------------------------------------- yarov3so · 2023-11-26 15:35 If I had chosen IT instead of pure maths as my major, then maybe I would be working for Tailscale and not relying so much on GUI solutions. Tbh I've always had an allergy to reading books, so figuring out networking theory just to be able to do what tailscale enables me to do relatively painlessly is not really up my alley... I like simple solutions ---------------------------------------------------------------------- secopsx · 2023-11-26 15:38 😂 ---------------------------------------------------------------------- FritzSchnitz · 2023-11-26 15:41 I was more a chromecast fan but I bet FireTv sticks are more unlocked and fun. ---------------------------------------------------------------------- american_desi · 2023-11-26 15:42 Ageed. I would also recommend getting/building a NAS like Synology/freenas and it will make your life much much better. Am using synology drive and paperless-ngx (on Docker) within a synology along with Tailscale. This has made me get rid of google drive/dropbox that i used to pay for. Also now i use synology photos to backup my photos and videos from my (and my family’s) phones no matter where they are. ---------------------------------------------------------------------- Ursa_Solaris · 2023-11-26 15:43 May as well just set up Wireguard then. ---------------------------------------------------------------------- yarov3so · 2023-11-26 15:53 Anything but a Roku haha... No sideloading? Not interested ---------------------------------------------------------------------- clarksonswimmer · 2023-11-26 15:57 Then you're not qualified to determine that it's "marketing bullshit" ---------------------------------------------------------------------- yarov3so · 2023-11-26 15:58 Those solutions might be better if you have the ability to open up your router's ports, which I do not. Trust me if I was the network admin, I would want to host my own NAS to share my movie collection with my friends, but for now, Tailscale at least allows me to access my collection myself remotely ---------------------------------------------------------------------- lilolalu · 2023-11-26 16:00 Ah, sure ---------------------------------------------------------------------- billgarmsarmy · 2023-11-26 16:02 This is so weird. Google cards keeps pushing Tailscale articles on me. Most recently earlier this morning. The timing of this post is really interesting. I'll agree with what others have said after having read one of the aforementioned articles: wireguard exists. ---------------------------------------------------------------------- pthsim · 2023-11-26 16:07 That's a very good point 😀 Anyway, I enjoy reading about what people use, proprietary or not, so kudos for the post! ---------------------------------------------------------------------- yarov3so · 2023-11-26 16:08 > > >I think so. I am a pretty big fan of SMB. You are not opening up your home server to the internet - you can only access Tailscale-specific IP addressed of your devices once you are connected to your tailnet (for that, they have 2FA). This is in stark contrast to solutions like ngrok where your traffic is routed through a server and no VPN encryption is required to make a connection (in Tailscale's case, a WireGuard tunnel). Also, ngrok throttles traffic quite a bit... A few people on here raised objections to the use of a third party for authentication, as is most commonly done in Tailscale, but I don't really concern myself with the pitfalls of that. I feel like getting a VPS to handle authentication yourself is overkill for me. ---------------------------------------------------------------------- soapymoapysuds · 2023-11-26 16:13 Yes, you can do that with Tailscale. If you set up subnets with Tailscale, you can access your entire network from outside. I’d suggest searching on YouTube on how to set it up. You can also set up a reverse proxy like nginx PM with Cloudflare to access your services you’re hosting on docker from outside. But that’s not as secure as using a VPN. ---------------------------------------------------------------------- root_switch · 2023-11-26 16:15 I think some of the bigger differences others didn’t mention is that tailscale uses relays, which sits between your two devices, which also means you don’t have to open any ports in your router, and easily works behind CGNAT. This is a major advantage over your traditional VPN server, although the drawback is tailscale hosts the relays, so you have to trust tailscale to a degree but it’s also all open source which is a major plus for many of us self hosted folks and you can always set up your own relay server say in a public cloud VPS if you don’t want to trust tailscale to be the relay. ---------------------------------------------------------------------- yarov3so · 2023-11-26 16:15 it's all good! Just wanted to share my experience with this tech. I am not a networking expert at all - just a tinkerer and a lifehacker who is a sucker for simple and elegant solutions. I am not above putting in some elbow grease when necessary though (like when I had to painstakingly modify coffeescript code in my Ubersicht widgets to make them just right without knowing anything about coffeescript haha) ---------------------------------------------------------------------- FritzSchnitz · 2023-11-26 16:16 I’m learning all kinds of things today, I’ve thought about Roku too guess I’ll steer clear! ---------------------------------------------------------------------- yarov3so · 2023-11-26 16:19 Yup subnets are pretty neat! I just wish the Android Tailscale app would allow subnet routing... Unfortunately, it's only supported on macos/windows/linux ---------------------------------------------------------------------- yarov3so · 2023-11-26 16:24 Roku is a walled garden... much like Apple I like my linux ISOs without the linux ;) ---------------------------------------------------------------------- Oujii · 2023-11-26 16:26 To get the same behaviour you have with Tailscale requires a lot more effort with Wireguard alone, but whatever floats your boat. ---------------------------------------------------------------------- Oujii · 2023-11-26 16:28 Analogy is my passion ---------------------------------------------------------------------- SuperLucas2000 · 2023-11-26 16:34 Why tailscale over twingate? ---------------------------------------------------------------------- jack3308 · 2023-11-26 16:34 One of the biggest things that it helps with is the double Nat dilemma that folks can run into if they're either behind cgnat or don't have control of their network management. ---------------------------------------------------------------------- cyrus2kg · 2023-11-26 16:41 They don't do split tunneling? That's dumb. I ended up going with netmaker a year or so ago instead of tail scale because I didn't think tailscale was completely selfhost. Then netmaker put their relay functionality behind a paywall so now I'm stuck on an old version and have to decide to update or not. ---------------------------------------------------------------------- megastary · 2023-11-26 16:48 You can also use default secret authentication with no 3rd party/own OIDC provider. ---------------------------------------------------------------------- MagazineSilent6569 · 2023-11-26 16:48 Tailscale = Cloud, Headscale = selfhosted ---------------------------------------------------------------------- cyrus2kg · 2023-11-26 16:53 There's ways to punch through cgnat with tailscale, netmaker ---------------------------------------------------------------------- numblock699 · 2023-11-26 16:56 I didn’t say it was safer. It is easier though, and faster. ---------------------------------------------------------------------- Oujii · 2023-11-26 17:02 Nice, thank you! ---------------------------------------------------------------------- Tripanafenix · 2023-11-26 17:08 Thanks but I pass I think. Proprietary software is against the mindset of self-hosting if one asks me. But if it works for you, it's just fine I guess. It's just not for me ---------------------------------------------------------------------- I_EAT_THE_RICH · 2023-11-26 17:08 I found setting up wireguard super simple and did not need tailscale at all. Why involve a business when the technology just works. ---------------------------------------------------------------------- I_EAT_THE_RICH · 2023-11-26 17:10 Yeah as long as you want to be tied to a business forever. Just like youtube and netflix increasing rates, it's only a matter of time. This is the business plan of technology unfortunately. Charge for software that is free to use. ---------------------------------------------------------------------- Jonteponte71 · 2023-11-26 17:10 FYI: I read this while pooping :) ---------------------------------------------------------------------- Ursa_Solaris · 2023-11-26 17:30 It doesn't need to be identical in how it accomplishes it, it just needs to get the designated job done correctly. The behavior most people are looking for is the ability to securely connect to local resources that aren't exposed to WAN. What more do you need, exactly? ---------------------------------------------------------------------- survivallama · 2023-11-26 17:31 Once it starts to cost anything it will be easy to swap away. ---------------------------------------------------------------------- Oujii · 2023-11-26 17:33 To be able to do that without port forwarding, for example. There are more examples, but this is the biggest reason people use it. ---------------------------------------------------------------------- Ursa_Solaris · 2023-11-26 17:37 You can't do that without portforwarding if you're self-hosting locally. You have to set up a server and forward the ports whether you use Tailscale or Wireguard, unless you tether yourself to third party services. ---------------------------------------------------------------------- Oujii · 2023-11-26 17:40 Yes, that is true. Maybe the person is more familiarized with the software, there are reasons to do it and you don't have to agree with any of them if you don't like, you can do the way you prefer it. ---------------------------------------------------------------------- polarpam · 2023-11-26 17:46 It’s not so much that they’re different. But with Tailscale you can get up and running within minutes. ---------------------------------------------------------------------- AdministrativeBug0 · 2023-11-26 17:52 The bit I’ve always been confused about by Tailscale is the business model. They spend a fortune (i guess)in advertising on every podcast. If something is free then you’re the product. Assuming they’re not evil incarnate and harvesting personal data, I can only assume that a high proportion of self-hosters work in IT and have purchasing power. Actually that would be a fair sized IT department because 100 devices would cover a fairly modest office environment. I hope that’s working for them because I fulfill neither of those criteria but as a noob I do find it jolly useful! ---------------------------------------------------------------------- noseshimself · 2023-11-26 17:53 I've started to put tailscale clients inside docker containers. That way services can move freely from continent to continent and I just don't care... ---------------------------------------------------------------------- noseshimself · 2023-11-26 17:55 > If I understood correctly, you would have to host your own DERP relay servers No. At hast not if you do not explicitly block their servers. ---------------------------------------------------------------------- KittensInc · 2023-11-26 17:56 The only thing which bothers me is their lack of proper user accounts. I don't mind registering for a service like Tailscale, but I **definitely don't** want use a Google/Microsoft/whatever account for it! Headscale might be a solution to that, but for something designed to essentially punch through most of my security I would rather prefer something well-supported by a larger player, tbh. ---------------------------------------------------------------------- Ursa_Solaris · 2023-11-26 18:09 You can do whatever you want, but if you become dependent on an unnecessary third-party service, you will get squeezed eventually. "Generous free tiers" are just covert marketing campaigns, and eventually they always dry up eventually once they need to actually become profitable and pay back the loans. The goal is to trick you into justifying the monthly fee because you like them so much after getting all comfy and complacent in their free tier. People keep saying you can self-host it, but that's not really the whole truth. Tailscale's core server isn't open source [by their own admission](https://tailscale.com/opensource/). There's an independent server that is *compatible* with Tailscale's client software, *for now*. That won't last either. If they actually wanted you to have an open source self-hostable server, they would have just released their own. The fact that they didn't speaks volumes to what their priorities are. If you're *actually* self-hosting, you should probably just use an industry standard tool rather than a community re-implementation of a proprietary service. I don't see any rational justification for this over plain Wireguard for a home user actually trying to self-host. But again, you can do whatever you want. I'm not a cop. I'm just tired of seeing people fall for the same tricks over and over. ---------------------------------------------------------------------- Znoot · 2023-11-26 18:09 Since you were most definitely just referring to torrenting your fine selection of exquisitely curated Linux distros, I guess we can let that slide. 😇 ---------------------------------------------------------------------- djdadi · 2023-11-26 18:19 Way easier? only if you're setting up dozens of endpoints. I just have my home network as a server, so it was just as easy to use Wireguard ---------------------------------------------------------------------- djdadi · 2023-11-26 18:20 So you're tried to set up wireguard and it was too complex? It seems just as hard as almost anything in the self-hosted realm seems. ---------------------------------------------------------------------- djdadi · 2023-11-26 18:21 Try NFS, it's usually faster ---------------------------------------------------------------------- ZenoArrow · 2023-11-26 18:23 Why not use Headscale instead? https://github.com/juanfont/headscale ---------------------------------------------------------------------- junkleon7 · 2023-11-26 18:24 It's been a game changer for me also. One feature that no one seems to address is the tailnet lock function. A common complaint is that tailscale being a 3rd party service could see your data (not true). The more valid concern that tailnet lock addresses is the situation where a hacker could add a malicious node -- if they were to get access to the control plane. Tailnet lock addresses this by giving complete control plane approval to you. The alternative is to go full self hosted with the headscale implementation, but I personally don't feel any need to switch at this point. ---------------------------------------------------------------------- junkleon7 · 2023-11-26 18:27 Tailscale + tailnet lock feature = somewhere in between ---------------------------------------------------------------------- radakul · 2023-11-26 18:28 Or even a $45 Raspberry Pi 4 - and I'm sure host even more on the recent Pi 5... Technology is incredible ---------------------------------------------------------------------- Oujii · 2023-11-26 18:33 Okay, that's what I thought. The headscale github page mentions an embbeded DERP server, so I imagine you can just do that. ---------------------------------------------------------------------- TLShandshake · 2023-11-26 19:07 >I am running a subnet on my home server so that I could adb into my firesticks and manage them remotely with scrcpy Have you set them up over IP, or are they plugged into a device that you manage them from? If IP, are you concerned about people having unrestricted development access to them if they find themselves on that LAN? If they are plugged in, why do you need a subnet for them? ---------------------------------------------------------------------- parski · 2023-11-26 19:19 Hand over the keys to your LAN and I'll set up this slick Wireguard config for you my friend. 😎 ---------------------------------------------------------------------- yarov3so · 2023-11-26 19:23 Nope - they are just connected to my WiFi. I know their IP addresses. I am running subnets on my server, which enables me to access ALL of the devices connected to my home LAN using the SAME ip addresses that I would use while on my LAN! And no, I am not concerned about unrestricted development access from within my LAN. I don't have any private info on them anyway. Also, to access them, you either need to be on my LAN or connected to my tailnet. ---------------------------------------------------------------------- LookOnTheDarkSide · 2023-11-26 19:26 Can you? I know headscale exists, but I didn't think that tailscale allows you to host the control plane? ---------------------------------------------------------------------- Wreid23 · 2023-11-26 19:32 For your media files in kodi I recommend hosting a jellyfin docker or app on your device of choice and then adding jellyfin sync to your kodi once you connect to tailscale you should have a nice front end of all your media. Check it out ---------------------------------------------------------------------- bondaly · 2023-11-26 19:34 Could you explain what you mean by respecting local traffic and split tunneling please? ---------------------------------------------------------------------- Tim7Prime · 2023-11-26 19:58 I actually end up using tailscale for games with my younger brothers. It's super easy to set up for youth too. I do keep an install on my klipper vm in case I need to remotely cancel a print or something. ---------------------------------------------------------------------- yarov3so · 2023-11-26 20:28 Thanks! Will try ---------------------------------------------------------------------- tiredofitdotca · 2023-11-26 20:33 Also, Zerotier. Zerotier allows you to connect to multiple networks as well, where as Tailscale can only connect to one at the same time, which makes things difficult if I want to run a VPN for personal use and a VPN in an organization. ---------------------------------------------------------------------- noseshimself · 2023-11-26 20:48 You can use the embedded DERP server, too, in case Tailscale ever stops providing them. ---------------------------------------------------------------------- nightmareFluffy · 2023-11-26 21:32 What a deal! ---------------------------------------------------------------------- dinosaurdynasty · 2023-11-26 21:34 It's end-to-end encrypted. Also tailscale will NAT punch if at all possible, avoiding using the relays. ---------------------------------------------------------------------- Gabe_Isko · 2023-11-26 22:06 The thing about tailscale is that they provide you with a hosted endpoint that let's you hook up to your wireguard vpn. So you have a cloud account where you manage the locations of all your selfhosted networks. Tailscale makes it very easy to connect to your Wireguard vpns from anywhere because they take care of the hosting and all that. This is the dilemma I have about how often Tailscale is discussed on this sub. It is fundamentally not a self-hosted service, even if it is a service that makes self hosting your software a lot easier. Not that I mind if people are using it. I am not dogmatic about this kind of thing, I get why you would want to use a service like this or cloudflare tunnels. But I don't like the idea of trusting something other than DNS, or any kind of commercial entity to route you to your hardware. I really think they are going to stop providing the service for free at some point. ---------------------------------------------------------------------- root_switch · 2023-11-26 22:30 Yes, although I thought their nat traversal uses a “coordination server” which handles ip/port info as well as the key exchanged used for communication. ---------------------------------------------------------------------- dinosaurdynasty · 2023-11-26 22:32 That's how NAT punching works. ---------------------------------------------------------------------- Oujii · 2023-11-26 22:41 Well, headscale is a control plane. The actual Tailscale control plane it’s not open, but you can use headscale as that, similar to Vaultwarden. ---------------------------------------------------------------------- DWLeveller · 2023-11-26 22:42 Its just another thing that could go down ---------------------------------------------------------------------- LookOnTheDarkSide · 2023-11-26 23:04 Right, then technically it is not hosting tailscale, just an open source drop in, but without the actual company backing. ---------------------------------------------------------------------- Oujii · 2023-11-26 23:12 Yes, same as Vaultwarden. ---------------------------------------------------------------------- BitterSparklingChees · 2023-11-26 23:48 > I discovered this do-it-yourself VPN solution It's not really DIY. you are using a hosted service that may or may not charge more at any point in time. ---------------------------------------------------------------------- MrHaxx1 · 2023-11-26 23:57 I think you can sign in with just passkeys now ---------------------------------------------------------------------- MrHaxx1 · 2023-11-26 23:59 >I can only assume that a high proportion of self-hosters work in IT and have purchasing power. I believe that's the case with Bitwarden. They're making the big bucks from organizations. Can't see why it wouldn't be the same with Tailscale. ---------------------------------------------------------------------- MrHaxx1 · 2023-11-27 00:01 Unlike YouTube and Netflix, Tailscale is a business oriented product. And as some of the others say, it'll be easy to switch away from it, if push comes to shove. ---------------------------------------------------------------------- Bruceshadow · 2023-11-27 00:14 any downsides to running tailscale? seems like it might just be adding risk (though minor) with little upside. ---------------------------------------------------------------------- blkwolf · 2023-11-27 00:21 I have been running wireguard for a couple of years now, with a DigitalOcean VPS setup as the main server. One thing I've noticed, is that specific wg clients will occasionally lose their connection to the wireguard network, and I'll have to find some way to get to that machine and then a simple ping will re- establish it's connection, and I can access that system again. Started using tailscale a few months ago, parallel to the wg network, and have never ran into that issue with the tailscale daemons. I started using ts, as my backend remote to the wg locked out systems to get wg working again, but ts has been so reliable vs straight wg, that I'm now making it my preferred connection preference. ---------------------------------------------------------------------- Conscious-Calendar37 · 2023-11-27 00:23 Tailscale is amazing, I have websites running in docker in my home network exposed to the internet through HAproxy in a CloudVPS LXC container connected to Tailscale with the backend being the HAproxy in my home network using magic dns. Works amazingly well without opening holes in my home network. Also able to let my friends kids play with my kids on an internal Minecraft server through Tailscale. Friends kids are only allowed to connect to Minecraft server on specific ports in case their machine is ever compromised. Tailscale is not your typical VPN! ---------------------------------------------------------------------- I_EAT_THE_RICH · 2023-11-27 00:25 good to know, thanks. ---------------------------------------------------------------------- Arxae · 2023-11-27 00:30 > If something is free then you’re the product Not always true. Having a free tier for individuals is a free foot in the door with companies. The people who use it for free at home (and never take it into a company) is just a cost for that. Sorta the same reason why Adobe doesn't take action against pirated versions of photoshop and the rest of their suite. People pirate it and learn how to work with it. This creates an sizable group of people who know PS and an incentive (sort off) for companies to go with PS because onboarding people becomes easier since they are already familiar with it. I have used tailscale for free for a bit, and the features are nice and it works well for me. If the company i work for ever switches VPN and asked me for an opinion, i would probably mention it. And that's what they want ---------------------------------------------------------------------- ConceptNo7093 · 2023-11-27 00:36 Sorry for this stupid question but how is this different from let’s say an L2TP with IPSec VPN remote access that I have with my Peplink router? ---------------------------------------------------------------------- Ironicbadger · 2023-11-27 00:41 You're looking for custom OIDC providers. https://tailscale.com/blog/custom-oidc/ ---------------------------------------------------------------------- XTJ7 · 2023-11-27 01:07 To be clear: I too am using tailscale for its convenience and reliability. While I havent had any issues with wireguard clients, it is interesting to see that there may be cases where switching from wireguard to tailscale can actually still make sense. ---------------------------------------------------------------------- root_switch · 2023-11-27 01:08 And I thought that “coordination server” is considered the “relay”, ergo tailscale relies on a relay and the default is hosted by tailscale? Maybe I misunderstood. ---------------------------------------------------------------------- themedleb · 2023-11-27 01:19 The 1st and main reason I use it for, is to avoid port forwarding. ---------------------------------------------------------------------- phillibl · 2023-11-27 01:24 I know, right. When does the rug pull come ---------------------------------------------------------------------- 4rt3m0rl0v · 2023-11-27 01:31 Here's an alternative: Buy a Firewalla Gold router at home, and a Firewalla Purple for travel. Set up a site-to-site VPN on them. (This is easy to do.) Then, whenever you're remote, any device that connects to the Firewalla Purple's Wi-Fi radio will have a VPN to home. This means that you'll have full access to your home network and all of the devices on it, transparently. Also, instead of vnc, I suggest a somewhat better take on it: Jump Desktop, which consists of a server and a client component, and is cross-platform. The standout feature is audio, so you can literally stream Spotify from home to wherever you are. Even better, if you're running Audiobookshelf at home, you can stream audiobooks to your iPhone whenever the latter is connected to your Firewalla Gold at home through WireGuard. NB: You don't need a Firewalla Purple. You can install WireGuard on any client device you like, and then connect it to your Firewalla Gold at home. Having a Purple is nice, though, because everything goes through a single point, and you don't need to worry about configuring a variety of devices with WireGuard. ---------------------------------------------------------------------- american_desi · 2023-11-27 01:38 Not necessarily. I have not opened up a single port in my router. Look up “VPN on demand” within Tailscale. As soon as i leave my home network, Tailscale gets connected and i have access to photos and all my files on Synology. Even if you don’t want to use Tailscale all the time, you can manually enable at which point all photos will sync/backup. You know whats better for your use case. Just my 2 cents. ---------------------------------------------------------------------- american_desi · 2023-11-27 01:38 Not necessarily. I have not opened up a single port in my router. Look up “VPN on demand” within Tailscale. As soon as i leave my home network, Tailscale gets connected and i have access to photos and all my files on Synology. Even if you don’t want to use Tailscale all the time, you can manually enable at which point all photos will sync/backup. You know whats better for your use case. Just my 2 cents. ---------------------------------------------------------------------- zzhhbyt1 · 2023-11-27 01:39 Could KeepAlive be a solution to your original problem? ---------------------------------------------------------------------- dontevendrivethatfar · 2023-11-27 01:54 I worry about this too. I really like tailscale but I don't want to depend on a for profit third party for a critical part of my home infrastructure. I haven't bothered looking at how to replace it yet but I want to stop using it before the inevitable monetization changes that will make the free tier unusable for my needs. ---------------------------------------------------------------------- Gabe_Isko · 2023-11-27 02:03 Yeah. I'm not going to fault other people for using it because it actually kind of makes sense to have one service to connect you to your private network. Even if it is not technically self hosting. It would be cool to have an option where a DNS record returns an encrypted address or something. It looks like there is already some stuff that [encrypts the resolution](https://blog.cloudflare.com/dns- encryption-explained/) sent to a client, but I mean send an encrypted address that can only be resolved if you have the correct private key or something. ---------------------------------------------------------------------- Tekrion · 2023-11-27 02:12 For my situation, as a backup/secondary VPN? I haven't really noticed any downsides. It's come in handy couple of times when I messed up the wireguard config on my wireguard server - it's on an oracle cloud VM and it's harder to get a local terminal in there in case you lose SSH/remote access, which I did. ---------------------------------------------------------------------- angelflames1337 · 2023-11-27 02:42 How do you hosted the relay server? Is that the headscale solution or does tailscale allow you to host your own server? ---------------------------------------------------------------------- Micex · 2023-11-27 02:48 Yes it is not completely that. It solves one main issue which is hosting the wireguard server in a location that I trust all my traffic’s to pass through as I am behind a cgnat. ---------------------------------------------------------------------- dinosaurdynasty · 2023-11-27 03:06 Tailscale uses both relays and NAT punching, relays forward packets between nodes, NAT punching gets the nodes to send packets directly to each other even behind non-insane NATs. ---------------------------------------------------------------------- highedutechsup · 2023-11-27 03:20 TLDR: I run Tailscale on: laptops, firesticks, and phones. It allows me to access my SMB shares remotely from my phones. I can control my server through VNC. MagicDNS assigns domain names to my Tailscale-enabled devices and configure AdGaurd DNS for some devices. Funnel proxy treats my traffic as if it's coming from my home network. ---------------------------------------------------------------------- brando56894 · 2023-11-27 03:24 Welcome to the world of VPNs. ---------------------------------------------------------------------- root_switch · 2023-11-27 03:26 You can run your own DERP server: https://tailscale.com/kb/1118/custom-derp-servers/#why-run-your-own- derp-server ---------------------------------------------------------------------- Charming-Molasses-22 · 2023-11-27 03:42 Sure. So local traffic is how devices in one network communicate. E.g say you have two computers in your home network, as long as they are joined to your wi-fi they can "talk" to each other without any intermediary between them. Since VPN clients take over your device network, they also setup special rules to bypass your local network so that your device can continue to talk to other devices in your home network. Tailscale doesn't setup these rules and instead expects you install Tailscale to the other devices to continue this inter-connectivity. Could be a malevolent move so that they can jack up the number of installs but I think it's totally dumb. Split tunneling is a way to tell the VPN client to bypass an app so that the app does not use the VPN network and uses your local network instead. ---------------------------------------------------------------------- OneTime_AtBandCamp · 2023-11-27 03:54 Lets skip the middle steps and go straight to assscale. ---------------------------------------------------------------------- spanky_rockets · 2023-11-27 04:12 Was gonna say this, sounds like you may have disabled keepalive packets. ---------------------------------------------------------------------- blkwolf · 2023-11-27 04:18 I setup keep alive, and actually created a cron job on each system to ping the remote server every 10 minutes or so. It's helped, but I do still have issues where the wg interface loses its connection now and then on random servers. ---------------------------------------------------------------------- zzhhbyt1 · 2023-11-27 04:21 I remember having this issue before, too. But it never happens to me recently. I suspect it's some time mismatch problem? Anyway, glad you found tailscale helped you. ---------------------------------------------------------------------- ListenLinda_Listen · 2023-11-27 05:03 Not convinced. I can do all that with wireguard or openvpn. ---------------------------------------------------------------------- Nathoufresh · 2023-11-27 05:44 What also makes it great it's the NAT traversal techniques. I've had trouble escaping my school network with plain wireguard (tried different ports and ideas). With tailscale I have never find a network I can't escape. ---------------------------------------------------------------------- bondaly · 2023-11-27 05:54 Thank you! ---------------------------------------------------------------------- robberviet · 2023-11-27 06:31 It is simple. One click and done. ---------------------------------------------------------------------- HuDiNi27 · 2023-11-27 06:43 What can Tailscale do that Zerotier can't? ---------------------------------------------------------------------- lilolalu · 2023-11-27 09:05 If you can do maths, I am sure you can do hobbyist grade networking. ---------------------------------------------------------------------- Jonteponte71 · 2023-11-27 09:16 Sure, if you can get one for $45 or even get one period :) I ordered an old Dell minipc instead. With an 128GB SSD and 8GB memory for around $160 ---------------------------------------------------------------------- KittensInc · 2023-11-27 09:45 I don't **want** a custom OIDC provider, I want to log in with a regular username and password! Setting up OIDC might make sense when you're a larger business, but when you're a hobbyist with *one* account and a handful of machines having to jump through such hoops is a massive PITA. ---------------------------------------------------------------------- KittensInc · 2023-11-27 09:48 You can only create passkeys as an admin for *additional* accounts. If you're just signing up, passkeys is not an option. Besides, passkeys have their own drawbacks. They are not a mature replacement for a regular username+passport+2FA. ---------------------------------------------------------------------- xzaz · 2023-11-27 11:57 But it is not opensouce and free? ---------------------------------------------------------------------- noaccess · 2023-11-27 12:17 I'm running a cloud linux vps with the WAN IP dropping all traffic, even ssh. I got tailscale running on it and connects to a tailscale instance running on my UDM which allows the VPS to access all IP's / netwoks on the UDM allowing me to access the WAN VPN via tailscale. ​ I have wireguard server running on the UDM but cant figure out how to hell to get the VPS to cleanly connect to it without issue allowing the same functionality. Ideally I want this configuration so I am not running tailscale on the UDM hardware but upon connecting I essentially lose access to the VPS. If there is any good documentation out there, please sent it my way. I run docker on the VPS for all the apps. ---------------------------------------------------------------------- radakul · 2023-11-27 12:20 They're coming back into stock now that the pi 5 has been released. I personally use a beelink mini pc that I got for black Friday last year...it's insanely fast for what I need it to do. ---------------------------------------------------------------------- XTJ7 · 2023-11-27 12:27 The client is not, no. Wireguard is open source and you can selfhost headscale, which is an open source server for tailscale, provided by tailscale themselves. ---------------------------------------------------------------------- justlikeyouimagined · 2023-11-27 14:08 Can you go into more detail about your Bell Fibe TV setup? Does it only work in a browser or did you find a way to make it work with an Arris box or Android TV device (which, if it's on the Bell network, should let you watch any channel you subscribe to)? I'm wondering how IGMP snooping/multicast would work through the tunnel if I wanted to put a box elsewhere. ---------------------------------------------------------------------- yarov3so · 2023-11-27 14:54 So the thing is, my dad pays for Bell Fibe Internet and TV and when I am on LAN, I can watch all the channels that the subscription includes from virtually ANY device (firesticks, iphones, androids, laptops, etc.) either by downloading the Bell Fibe TV app from the appstore or by going to [https://tv.bell.ca/home](https://tv.bell.ca/home). Bell detects automatically that I am connected to the internet through them, as well as my dad's subscription (no need to log in or anything). I can trick Bell into thinking that I am at home by running a funnel on my server with the help of Tailscale. Now, when I am away from home, the app will only work when I am on wifi AND connected to Tailscale AND using my server at the exit node (funnel). If I am on cellular, I have to use the website I mentioned earlier. The best browsers for that are Samsung Internet on android and Grazing 3 on iOS, since they allow the picture to fill the entire screen. In principle, you should be able to access your subscription from any device that has a web browser and can run Tailscale. ---------------------------------------------------------------------- yarov3so · 2023-11-27 15:02 Can, but why should I? Unless the need presents itself, that is ---------------------------------------------------------------------- blkwolf · 2023-11-27 18:21 That gives me something to look at, thanks! ---------------------------------------------------------------------- BlueEye9234 · 2023-11-27 20:10 They have a lot to say about it, https://tailscale.com/blog/free-plan/ I tend to overall believe what they put in this article, even if at times they're a bit grandiose with stuff like "Fix the internet". ---------------------------------------------------------------------- BlueEye9234 · 2023-11-27 20:17 Tailscale does not stop a device from talking locally. I am, as I type this message, transferring a 15GB file from my computer that has tailscale installed, to another machine on my local network, using local IP addresses. I also have tailscale on hundreds of edge devices which then interact with IP cameras and speakers on local networks. Unless I'm misunderstanding you, this just seems completely false. ---------------------------------------------------------------------- ra66i · 2023-11-27 21:05 The core client code is open source at github.com/tailscale/tailscale. That repository contains the complete source code for the Linux client, and the core code used in all of the other clients. In general our clients are open source for open source platforms and closed source for closed source platforms, but all of them use that same core code. The closed source parts are essentially just signed GUI's that talk to the same core. ---------------------------------------------------------------------- ZenoArrow · 2023-11-27 21:09 > Headscale might be a solution to that, but for something designed to essentially punch through most of my security I would rather prefer something well-supported by a larger player, tbh. Firstly, why do you want something from a larger player? The whole idea of self-hosting is to avoid relying on the work of large players. Secondly, Tailscale isn't a large player. If you look at how many people it has on its GitHub page, it's got 20 people able to make commits. This isn't a large organisation, it's a small company: https://github.com/orgs/tailscale/people Thirdly, Tailscale uses Wireguard at its core, which isn't something from a "larger player". If you can't trust Wireguard, how are you going to trust Tailscale? ---------------------------------------------------------------------- Charming-Molasses-22 · 2023-11-27 22:34 > Tailscale does not stop a device from talking locally. It does on Android for sure last I checked. And IIRC it blocks local connection on Linux too as I could not ssh to any device that had Tailscale service on. Maybe confirm if your devices are connected via the Tailscale network or if they connect via internet instead of local network. ---------------------------------------------------------------------- BlueEye9234 · 2023-11-27 22:49 scp -o PreferredAuthentications=password files.zip user@10.20.253.186:C:/Users/user/Documents/ It is absolutely using the local network, because I am feeding the SCP command a local IP address. I've been using Tailscale for like 2 years now on Linux and Windows, never been blocked from talking to anything local ever, ssh included. I will agree that tailscale on android does seem to block. I installed the app, connected, and now cannot ping 10.20.253.186 in termux. ---------------------------------------------------------------------- AdministrativeBug0 · 2023-11-27 23:40 Makes sense. I didn’t honestly believe they were selling data, more that it might be unsustainable. But they seem pretty confident so here’s hoping! ---------------------------------------------------------------------- XTJ7 · 2023-11-27 23:53 Thanks for clarifying that :) ---------------------------------------------------------------------- DevelopedLogic · 2023-11-28 00:28 Attract tech furries with it's name ---------------------------------------------------------------------- jmtamere · 2023-12-01 00:25 How did you setup Funnel for Bell? I don’t quite get how you did it. Thanks ---------------------------------------------------------------------- Untreated3763 · 2023-12-05 22:43 Can you explain more about how you're using tailscale to access transmission? Did you have to set up the remote settings inside of transmission for it to work first? Are you using the username and password authentication built into transmission as well? ---------------------------------------------------------------------- yarov3so · 2023-12-06 06:49 It's not that I set up a funnel specifically for Bell - it's rather than I am running a funnel at home through which I can access Bell's Fibe TV website as if I was at home. Once you set up the funnel on your home device, it may act as an exit node. Then, upon connecting to tailscale, you may route all your internet traffic through that device and make it seem to any website you are visiting (including Bell's Fibe TV) like you are at home. ---------------------------------------------------------------------- yarov3so · 2023-12-06 06:52 No password required - I just activated Tailscale's web server in settings and ran a command in Terminal to tell tailscale to serve the appropriate port. ---------------------------------------------------------------------- jmtamere · 2023-12-06 22:16 Yeah ok, I get it. Thanks!