The guy who wrote up the praise for Tailscale changed my life reddit / selfhosted ---------------------------------------------------------------------- agent-bagent · 2023-11-29 19:05 I had heard of Tailscale, vaguely knew it was low-touch VPN, but I never bothered to look into it because I had Cloudflare tunnels and DNS/routing that I was satisfied with. But that post got me to finally look into Tailscale. And just - wow. I can't believe how dead simple this is. No more messing with cloudflare cli for tunneling. Easiest user management I could ask for. AND I can 1-click designate exit nodes?? So I can watch xfinity stream on my apple tv outside my home now?? I fucking love Tailscale. Someone out there surely can relate to my first paragraph. If you are that person - this is your sign to go look into Tailscale NOW ---------------------------------------------------------------------- skyrunner15 · 2023-11-29 19:16 or wireguard to diy... ---------------------------------------------------------------------- OneTime_AtBandCamp · 2023-11-29 19:39 I guess tailscale is even easier to setup than Wireguard? Wireguard isn't hard to setup though. And many routers (OpnSense-based, for example) have Wireguard baked in. Since routers tend to me very reliable, implementing it there lets you access your network even if something is wrong with your server. ---------------------------------------------------------------------- Mint_Fury · 2023-11-29 19:52 Agreed. I needed a quick set up VPN before leaving for a two week trip in case I needed to reboot the media server and finally looked into tailscale. 20 minutes of reading and maybe 5 clicks and i had access to my internal services, local DNS and everything. Absolutely love tailscale ---------------------------------------------------------------------- Simplixt · 2023-11-29 19:56 Prefer Wireguard, especially in combination with a 1€ VPS als VPN- Gateway with fixed IP. For beginners Tailscale is nice, but plain Wireguard is more flexible, and implemented in more routers etc. ---------------------------------------------------------------------- agent-bagent · 2023-11-29 19:59 Admittedly I haven't dug into Wireguard setup/config/management, just like I hadn't (up until recently) looked at Tailscale. I understand Tailscale is Wireguard under the hood, but I'm back to square 1 of "no motivation to investigate anything else" :D ---------------------------------------------------------------------- SeVere666 · 2023-11-29 20:01 I really want to love tailscale. But sadly it often leaks ip/dns when I switch it on. ---------------------------------------------------------------------- forsakenchickenwing · 2023-11-29 20:08 Tailscale *is* Wireguard, just with automated setup and NAT punching. ---------------------------------------------------------------------- Hot_Pomegranate_4165 · 2023-11-29 20:53 It makes setting up WireGuard soooo much easier ---------------------------------------------------------------------- SammyDavidJuniorJr · 2023-11-29 20:56 It's also pretty easy to spin up a container on a cloud host, add it to your tailscale, then set it up as an exit node. Just choose the region you want it to be in when you set it up and you can browse from anywhere. All done, tear it down and delete it. ---------------------------------------------------------------------- vnprc · 2023-11-29 21:15 I looked into tailscale for about 15 minutes. I couldn't get past the mandatory identity provider. I don't want google or microsoft or anyone else narcing on my VPN connections. Hard pass. ---------------------------------------------------------------------- NelsonMinar · 2023-11-29 21:16 Tailscale is awesome. The downside is it doesn't really route networks, just individual hosts that are running Tailscale's software. With a real VPN you just need to set up once on a router for, say, your home network. With Tailscale each device is running its own software. ---------------------------------------------------------------------- vnprc · 2023-11-29 21:17 I looked into tailscale for about 15m. I couldn't get past the mandatory identity provider. I don't want google or microsoft or anyone else narcing on my VPN connection. Hard pass. ---------------------------------------------------------------------- trisanachandler · 2023-11-29 21:18 So as a cloudflare tunnel lover, why do you find tailscale preferable? My largest issue is that I use cloudflare for SSL upgrades so I don't have to worry about an additional proxy/SSL certs except for 1 item that I use locally only. ---------------------------------------------------------------------- piano1029 · 2023-11-29 21:20 It's not (by default) a VPN that also proxies all your traffic, it just allows you to talk to other machines. I haven't had any issues with it not proxying correctly, but make sure the exit node is actually enabled ---------------------------------------------------------------------- piano1029 · 2023-11-29 21:21 Just enable node approval? ---------------------------------------------------------------------- Mintfresh22 · 2023-11-29 21:27 You should give them a hand job. ---------------------------------------------------------------------- nutterbg · 2023-11-29 21:28 This! Probably the only reason why I haven't pulled the trigger on Tailscale yet. ---------------------------------------------------------------------- vnprc · 2023-11-29 21:28 Not sure what that means. This is the sign up page. There is no option that doesn't require you to doxx yourself. https://i.imgur.com/nvPcw30.jpg ---------------------------------------------------------------------- rschio · 2023-11-29 21:33 Tailscale has subnet routers function so you can access any device from your network, even IOT things. Installing Tailscale in each device is the recommend, but for those IOT devices the subnet works great. ---------------------------------------------------------------------- Factual_Signage · 2023-11-29 21:36 I kept reading about it and figured "ahh i should probably be familiar with this tool". Went to the site, saw this exact situation and closed that tab forever. Wireguard is so simple once you put some time into it, there's no reason for tailscale to exist in the form that it does and god knows they are making money hand over first with their usage data. So, no thanks to tailscale. ---------------------------------------------------------------------- Greyhammer316 · 2023-11-29 21:39 Care to explain "leaks ip/dns"? ---------------------------------------------------------------------- hillz · 2023-11-29 21:39 What's the difference between tailscale and zerotier ? I'm using zerotier right now and I'm pretty satisfied with it ---------------------------------------------------------------------- willharwell · 2023-11-29 21:42 It will work that way with pfSense. https://www.youtube.com/watch?v=Fg\_jIPVcioY ---------------------------------------------------------------------- agent-bagent · 2023-11-29 21:46 Issue your own OIDC cred? ---------------------------------------------------------------------- blackstar2043 · 2023-11-29 21:49 Instead of Tailscale, I chose a combination of WireGuard and Nebula. The network is entered through WireGuard, with Nebula providing the underlying mesh. The routing of traffic between WireGuard and Nebula involves IPtables. It consumes very little resources and doesn't need much configuration. ---------------------------------------------------------------------- moiz41510 · 2023-11-29 21:53 Haha I love this. I felt this before with Tailscale too. It’s just magic! ---------------------------------------------------------------------- wrath_of_reaper · 2023-11-29 21:53 Just sign up with your own OIDC? It‘s literarly listed there. ---------------------------------------------------------------------- mtx0 · 2023-11-29 22:00 Any recommended guides for someone who is willing to switch from tailscale? ---------------------------------------------------------------------- wrath_of_reaper · 2023-11-29 22:00 Again, dangerous half-knowledge… * You can use your own OIDC and don‘t need to rely on Google etc. * Tailscale —is— Wireguard, but with a nice frontend and some extra magic like (external) user management and NAT. * Since Tailscale is Wireguard, a mesh VPN, how do you imagine Tailscale can make money with your data, when all data is end-to-end- encrypted? Tailscale is just the route manager for both parties, they don‘t know your keys or save any relevant or sensitive data. ---------------------------------------------------------------------- zfa · 2023-11-29 22:03 Same as me. Keep thinking I should maybe move to a single WG mesh to remove the hub-and-spoke nature but it's working so well I can't be bothered. It'd take a lot of rework to put all the peers into stuff that only supports plain WG, and adding new peers would be a pain etc. Easier to keep the mix for now. ---------------------------------------------------------------------- wrath_of_reaper · 2023-11-29 22:03 Out of curiosity: 1€-VPS still exist? ---------------------------------------------------------------------- spacecowboy77453 · 2023-11-29 22:06 Can you explain a few cases where it is more flexible? ---------------------------------------------------------------------- Vogete · 2023-11-29 22:07 I'm behind a carrier grade nat, so plain wireguard is not an option for me. It's also not an option for my family since they are also behind carrier grade nat. Tailscale is a game changer for us, and it's so easy to use, anyone can do it. ---------------------------------------------------------------------- Vogete · 2023-11-29 22:08 That's....not what it was intended for. ---------------------------------------------------------------------- nosyrbllewe · 2023-11-29 22:12 My problem with Tailscale is getting a static IP for my docker container (so can use my domain name). It would keep changing, which kept breaking my DNS. So, I am looking into doing Wireguard directly instead. ---------------------------------------------------------------------- FritzSchnitz · 2023-11-29 22:18 I liked that thread too. I’m now tempted to see if I can get Bitcoin lightning node running over TLS. I think it will give me the IP masking/privacy that I was getting with cloud flare until they changed their stuff and no longer supported the port number I need ---------------------------------------------------------------------- Reverent · 2023-11-29 22:26 wireguard isn't a 1:1 replacement for tailscale, not even close. Wireguard is however useful for basic VPN requirements (such as relatively simple and secure access to an internal network). As soon as you start needing user authentication, or stuck behind CGNAT, or need to onboard someone who isn't your immediate family, wireguard stops being nearly as friendly. ---------------------------------------------------------------------- oxymo · 2023-11-29 22:27 I avoided vpn setup for the longest, found a guide for mikrotik and damn it was easy to setup. One click and I’m on my home network, and it’s fast enough for what I do. ---------------------------------------------------------------------- jovialfaction · 2023-11-29 22:28 lowendbox.com You'll sometime see offers for small VPS (1 vcpu, 256mb RAM, 10GB disk) for $10-15 a year ---------------------------------------------------------------------- noaccess · 2023-11-29 22:29 how are you running tailscale on the xfinity / apple tv side? ---------------------------------------------------------------------- predmijat · 2023-11-29 22:32 For those who missed it, MikroTik got "Back to Home" feature in the latest version: https://help.mikrotik.com/docs/display/ROS/Back+To+Home ---------------------------------------------------------------------- beesuptomyknees · 2023-11-29 22:45 What does Tailscale do that WireGuard doesn’t with a CGNAT? ---------------------------------------------------------------------- KevinCarbonara · 2023-11-29 22:47 Every post I read about tailscale sounds like an ad for an MLM ---------------------------------------------------------------------- mcr1974 · 2023-11-29 22:53 what is "it" ---------------------------------------------------------------------- algowolf · 2023-11-29 22:57 I’m in the same boat. ZeroTier has been flawless for me for about a year now. I like the simplicity of joining devices without needing a login; I believe Tailscale is more user based and requires something like a Google or MS account. But also ZeroTier doesn’t have any way to use it currently from AppleTV but Tailscale does. ---------------------------------------------------------------------- mcr1974 · 2023-11-29 23:05 say I have: HostA: remote, wireguard peer (server) 10.0.2.2 vpn address HostB1: local, wireguard peer 10.0.2.3 vpn address HostA has a number of (private) docker networks: HostA-DockerA: 192.168.2.0 HostA-DockerB: 192.168.3.0 can I access HostA-DockerA from HostB1? what's the best setup for that? additional question: if I have HostB1, HostB2, HostB3 on a local physical LAN network (192.168.10.2, 192.168.10.3, 192.168.10.4), can HostB2 and HostB3 access HostA though the vpn connection established between HostA and HostB1? would welcome recommendations. bonus points if I can run whatever software required in docker. ---------------------------------------------------------------------- MalcolmY · 2023-11-29 23:16 Look into Headscale. Host your own "Tailscale" network. ---------------------------------------------------------------------- vnprc · 2023-11-29 23:22 I was sold on a "dead simple" solution just like you said. I got to this page https://tailscale.com/kb/1240/sso-custom-oidc/ and realized it is not simple if you value your privacy. Like I said I spent 15 minutes on it because I didn't have 2 hours to waste. ---------------------------------------------------------------------- projeto56 · 2023-11-29 23:22 Would if I could. Tail scale is amazing ---------------------------------------------------------------------- Far-Donut-1177 · 2023-11-29 23:32 Wish Tailscale worked on Android tv. Their app just loads up a white screen then nothing... ---------------------------------------------------------------------- sowhatidoit · 2023-11-29 23:32 Wireguard or Tailscale? I'll be the only one ever to access my home network from outside my home. ---------------------------------------------------------------------- stupv · 2023-11-29 23:36 It cant route one network to another network per se, but it can route any number of networks to any number of individual clients ---------------------------------------------------------------------- agent-bagent · 2023-11-29 23:36 Your criticism is with OIDC, not Tailscale ---------------------------------------------------------------------- Simplixt · 2023-11-29 23:38 I have some devices that have WireGuard implemented, but no Tailscale support (e.g. my WiFi router) Also I'm using WireGuard in combination with OPNsense firewall, and here I have complete control over routing etc., can combine it with a reverse proxy, etc. Better if I you don't want an automatic mesh, but now can define for any WireGuard client individually over what gateway (e.g. ProtonVPN) the traffic goes, what DNS server it should use, etc. ---------------------------------------------------------------------- vnprc · 2023-11-29 23:40 Tailscale chooses to use OIDC so my criticism is squarely on target. ---------------------------------------------------------------------- Simplixt · 2023-11-29 23:40 In Germany e.g. Ionos, Stratos, Netcup ... All around 1 CPU Core / 1GB RAM / 40 GB SSD ... but good enough for many tasks, e.g. VPN-Gateway, Remote-Health-Monitoring via [healthcheck.io](https://healthcheck.io), etc. ---------------------------------------------------------------------- agent-bagent · 2023-11-29 23:44 > I have to buy a domain to host an email address and a text file so I can access my home network over a vpn? wat? Very common practice for DNS ownership/verification. That being your gripe is orthogonal to your desire for owning your idP. Idk what you expect ---------------------------------------------------------------------- Windows_XP2 · 2023-11-29 23:45 > You can use your own OIDC and don‘t need to rely on Google etc. Wait you can do that? How? I've been using my GitHub account, but it would be nice if I didn't need to rely on that. ---------------------------------------------------------------------- Windows_XP2 · 2023-11-29 23:47 Tailscale has automatic NAT punching, which allows it to work behind multiple layers of NAT. Working around CGNAT is possible with WireGuard, but it's not nearly as easy as Tailscale. ---------------------------------------------------------------------- centomila · 2023-11-29 23:47 Hi. If you are talking about this topic: [https://www.reddit.com/r/sel fhosted/comments/1835hns/seeking\_alternatives\_to\_zerotier\_for\_ios tohome/](https://www.reddit.com/r/selfhosted/comments/1835hns/seeking_ alternatives_to_zerotier_for_iostohome/) u/piano1029 is the hero to thanks. ---------------------------------------------------------------------- _risho_ · 2023-11-29 23:47 they don't want to be a honeypot for your identity so they choose to outsource it. you can either use one of the ones they support or host your own. it isn't unreasonable. ---------------------------------------------------------------------- capecodcarl · 2023-11-29 23:48 I like Tailscale but I wish you could make the Android app always default to using a certain exit node when it starts. You have to enable the tunnel them go into the menu and select an exit node every time. It's a pain. With my Wireguard client I can just start it with a shortcut and be running in a second or even default to always on with no interaction, but it won't tunnel over https like Tailscale will to get around restrictive network firewalls that only allow outbound port 443. ---------------------------------------------------------------------- Patient-Tech · 2023-11-29 23:49 Not for their MIPS devices, only ARM and x86 and other newer stuff with more horsepower ---------------------------------------------------------------------- Factual_Signage · 2023-11-29 23:54 Everything you said just agreed with what I posted. Thanks! Routing data is saleable data(ask me how I know). Encrypted or not, that data is extremely valuable. ---------------------------------------------------------------------- SeVere666 · 2023-11-29 23:54 Of course. But it's not wrong to expect it to behave like a normal wireguard vpn when using an exit node right? Especially when using its mullvad addons :( ---------------------------------------------------------------------- Roxelchen · 2023-11-29 23:55 Get one dollar VPS and route everything through that as a proxy? ---------------------------------------------------------------------- oxymo · 2023-11-29 23:58 That's actually a really nice feature, ubquiti like even. ---------------------------------------------------------------------- Factual_Signage · 2023-11-29 23:58 [https://docs.netgate.com/pfsense/en/latest/recipes/wireguard- ra.html](https://docs.netgate.com/pfsense/en/latest/recipes/wireguard- ra.html) This is what I used to figure it out, ymmv with your personal experience. Once you dig into it, it's simple to spin up a new connection but it will take time/usage to get there. Tailscale isn't *bad* it serves a viable service and takes a lot of work off of peoples table, but I just don't like trusting my networks with another entities services that could be taken down at a moments notice. Having the knowledge to spin up wireguard tunnels on your own is a valuable skill in the circumstance tailscale goes tits up. ---------------------------------------------------------------------- Factual_Signage · 2023-11-29 23:59 You have to jump through some hoops to get there, but it's possible. tailscale is 100% collecting usage data though, so be aware of your threat model. ---------------------------------------------------------------------- vnprc · 2023-11-29 23:59 That's fair. It sounded cool to access my home network from anywhere and I didn't know what was involved. Once I found out my two choices I realized it is not a very compelling service after all. ---------------------------------------------------------------------- mtx0 · 2023-11-30 00:01 works for me. running a pfsense firewall, just haven't tinkered with that part yet. i'll try it out this weekend, thank you. ---------------------------------------------------------------------- vnprc · 2023-11-30 00:02 Now this sounds interesting! Thx! ---------------------------------------------------------------------- Pretty-Bat-Nasty · 2023-11-30 00:04 Thank you, I will check out headscale. I tried tailscale and giving a third party control of my access control gave me the heebeejeebees ---------------------------------------------------------------------- Factual_Signage · 2023-11-30 00:05 That's even better! pfsense/opnsense are so fucking awesome. ---------------------------------------------------------------------- DaftPump · 2023-11-30 00:18 Been using ZT for over a year. I read lots of praise about TS but never made the switch...not sure I really need to. ---------------------------------------------------------------------- Mintfresh22 · 2023-11-30 00:20 Not really it is just wireguard. ---------------------------------------------------------------------- IsPhil · 2023-11-30 00:25 Can someone post the link OP is talking about? ---------------------------------------------------------------------- TechnologyBrother · 2023-11-30 00:26 Tailnet lock is supposed to largely mitigate those concerns, and on paper I think it should. ---------------------------------------------------------------------- Pretty-Bat-Nasty · 2023-11-30 00:31 Thanks, I will check it out. I have two distinct uses cases. Right now I am using WireGuard for both. However for one use case, tailscale is much much better. ---------------------------------------------------------------------- Ttylery · 2023-11-30 00:34 Maybe its my network setup and all the complexities Ive added to opnsense over the years, but I spent a few hours today trying to get WireGaurd to work unsuccessfully. I was able to access one IP on LAN, but a different one I was not able to. I also was unable to access my HAProxy'd sites, but Im not faulting WireGaurd for that, I have a probably unusual setup for HAProxy. I fI added a vpnnet to all rule, it just acted like I was on WAN and my HAProxy intercepted the traffic instead of the local DNS server routing it to the correct server. Oh well, nothing I have is critical enough that if it breaks that it cant wait at most a week if Im out of town. ---------------------------------------------------------------------- Fluffer_Wuffer · 2023-11-30 00:38 They both do the same job, each has its own pros and cons.. Tailscale seems to have more momentum with adding new features, and is the current coolaid. ---------------------------------------------------------------------- CactusBoyScout · 2023-11-30 00:49 Does anyone have experience with a self-hosted VPN that's actually reliable on iOS? I had a lot of issues with Wireguard failing to connect (was running PiVPN) and then Wireguard has this known issue where it stops working when you go from wifi to cellular data. If there's a better option for iOS, I'd love to hear it. ---------------------------------------------------------------------- acdcfanbill · 2023-11-30 00:51 I use headscale to set up my own coordination server in an AWS vm. It's not as user friendly, it's cli commands, but it works and is private. ---------------------------------------------------------------------- BandOfBroskis · 2023-11-30 01:04 I'm going to wait for the thank you response to this one and then I'm going to get on it. (I'm just really busy at work 😂) ---------------------------------------------------------------------- ObjectiveList9 · 2023-11-30 01:09 Tailscale feels so fucking sketchy to me ---------------------------------------------------------------------- eve-collins · 2023-11-30 01:16 I saw this guy’s post and didn’t get it. Can you help change my life too? My understanding of tailscale is it’s an ephemeral OS. You take out the usb from your computer and it’s all gone. What’s the deal with the VPN? Why can’t I just use a DigitalOceam instance with wireguard running on it? ---------------------------------------------------------------------- lestrenched · 2023-11-30 01:16 Time for headscale. Just one more VPS to manage ---------------------------------------------------------------------- lestrenched · 2023-11-30 01:18 TBH a wireguard server hosted in the cloud with your router/bastion host and your current device connected to it would be the exact same experience, just without much of a GUI to handle more users and maybe not a mesh. I find Tailscale/headscale to be overkill for my purposes. ---------------------------------------------------------------------- art_of_snark · 2023-11-30 01:21 tailscale is a thick candy shell around very similar tech. Lots of buzzwordy shit baked in, like SSH management, managed (and hosted) DNS zones with automatic TLS cert provisioning, etc. ZT has many of those features, but all with sharp edges. Last I checked, you can’t self-host TS derps like you can ZT moons. Which means the company that provides the service could decide to monetize your freeloading ass tomorrow. ---------------------------------------------------------------------- I_EAT_THE_RICH · 2023-11-30 01:25 Another random Tailscale praise post in a couple days!? I feel like this is advertising. It’s just WireGuard ---------------------------------------------------------------------- skyrunner15 · 2023-11-30 01:35 Try wg-easy docker and make sure the underlying system can use it - I have a raspberry pi configured with this and runs like a rock. ---------------------------------------------------------------------- shbatm · 2023-11-30 01:36 >Last I checked, you can’t self-host TS derps like you can ZT moons. https://headscale.net ---------------------------------------------------------------------- Initial-Repeat9146 · 2023-11-30 01:37 > Instead of Tailscale, I chose a combination of WireGuard and Nebula. The network is entered through WireGuard, with Nebula providing the underlying mesh. I've setup like this before. The only issue I had with native wireguard was I couldn't figure out a way a clean and sustainable way to setup a mesh with exit routing that I could write as infrastructure configuration. But it's likely I hit a wall and got frustrated ---------------------------------------------------------------------- madrascafe · 2023-11-30 01:39 What VPS is €1? Can you please share ---------------------------------------------------------------------- Windows_XP2 · 2023-11-30 01:47 My point is that Tailscale does all of that for you automatically, and you don't have to do that yourself. ---------------------------------------------------------------------- auzzlow · 2023-11-30 01:49 Tailscale uses the Wireguard protocol. Zerotier uses their own in- house protocol. I prefer the protocol and service to be developed by different groups, so I use Tailscale. ---------------------------------------------------------------------- internethostage · 2023-11-30 02:07 How do you know? ---------------------------------------------------------------------- p4ck3ts · 2023-11-30 02:17 tailscale is the bomb. i use it personally on my homelab its installed on my openwrt router. selfhosting is a breeze with all the available tech nowadays. ---------------------------------------------------------------------- Oujii · 2023-11-30 02:40 At least with Tailscale you don't have to actually spend money to try. ---------------------------------------------------------------------- Oujii · 2023-11-30 02:42 It's not random, this post is literally linked to the other one. Didn't you read the title? It might be an ad though, we might never know. ---------------------------------------------------------------------- phillibl · 2023-11-30 02:42 100% not to mention all the podcasts that shill it constantly ---------------------------------------------------------------------- dinosaurdynasty · 2023-11-30 02:44 Adds latency/throttles bandwidth through VPS/additional single point of failure ---------------------------------------------------------------------- phillibl · 2023-11-30 02:48 Wireguard 100% ---------------------------------------------------------------------- DIBSSB · 2023-11-30 03:22 Just few small features Taildrop Mullvad exit node Ability to expose your services via a subdomain ---------------------------------------------------------------------- PirateParley · 2023-11-30 03:32 I have used both and moved to tailscale. Zerotier has 25 device limit where tailscale has 100. I like how you can separate network in zerotier and put certain device in network in a way you like. Tailscale has it but it has steep learning curve and need to put in tag and once you tag, you can't remove without reauth and if you don't have a local access to reauth, you are more screwed. With tailscale, you can advertise subnet and I belive it can't be possible with zerotier or I don't know how. I like zerotier that I can assign my own subnet. So both had plus and minus. ---------------------------------------------------------------------- CorvetteCole · 2023-11-30 04:07 To be fair, tailscale uses wireguard. It will run anywhere wireguard exists, and supports userspace wireguard networking where it doesn't. You could def run tailscale on that router ---------------------------------------------------------------------- flecom · 2023-11-30 04:08 I remember looking into and and noping out, couldn't remember why, thanks for the reminder! ---------------------------------------------------------------------- 010010000111000 · 2023-11-30 04:17 This is what I did. Never have used tailscale. Took a bit of a learning curve to set up wireguard and learn iptables basics but after that there wasn't much more to it. ---------------------------------------------------------------------- thefpspower · 2023-11-30 04:18 Isn't the Oracle cloud free tier better than that? ---------------------------------------------------------------------- tubbana · 2023-11-30 04:37 Or get zero dollar tailscale? ---------------------------------------------------------------------- tubbana · 2023-11-30 04:39 In a mesh ---------------------------------------------------------------------- Unkn0wn_Node · 2023-11-30 04:55 While I love tailscale for remoting into home assistant and all of my local projects I've always had an issue with the exit node functionality. Works most of the time but there's sometimes a chance I'll choose a relay for no reason or just decide that the port I specified no longer matters and switches to something that I don't have port forwarded. Also when I connect another client to an exit node the 2nd client had unusable download speeds with fast upload and the 1st client just works. It's 80% there for my use case but it falls short by a little bit. Still using it though. ---------------------------------------------------------------------- ryanknapper · 2023-11-30 05:31 I love my https://pivpn.io/. ---------------------------------------------------------------------- Ursa_Solaris · 2023-11-30 05:33 I followed the [official guide](https://docs.opnsense.org/manual/how- tos/wireguard-client.html) to deploy Wireguard directly on OPNSense and it just worked for me. Took maybe 20-30 minutes to read through and set up. I have only a few VLANs though. ---------------------------------------------------------------------- Ttylery · 2023-11-30 05:36 Thats the one I followed too. ---------------------------------------------------------------------- Ursa_Solaris · 2023-11-30 05:42 Interesting. Sorry I couldn't be of more help, that sounds frustrating. The only thing that comes to mind is that if traffic is rerouting through the WAN interface, perhaps try turning off [NAT reflection/hairpinning](https://docs.opnsense.org/manual/how- tos/nat_reflection.html) and see if that breaks the flow. It might help you figure out what is actually happening. ---------------------------------------------------------------------- Whitestrake · 2023-11-30 05:43 > I believe Tailscale is more user based and requires something like a Google or MS account. You can use your own Authelia or Authentik on every plan tier, or any OIDC provider on any tier other than Starter (including Free tier - yes, you can use OIDC on Free but not the lowest paid tier for some reason). It's not the same as simply letting you sign up with an email and password, though. Tailscale is just allergic to managing user credentials themselves, it seems. Headscale is pretty great. ---------------------------------------------------------------------- Ttylery · 2023-11-30 05:46 Its all good, Ill just put it back at the bottom of the projects list and Ill circle back to it when I can. Theres plenty of other things that need doing; such as automating my acme certs from opnsense to my other servers. ---------------------------------------------------------------------- fukuro-ni · 2023-11-30 06:29 it’s not just wireguard, it’s wireguard with a built in set of relays and methods to defeat CGNAT. if you don’t want to deal with tailscale the company, just use head scale and host the control plane yourself. ---------------------------------------------------------------------- tiredofitdotca · 2023-11-30 06:48 Not being able to connect to two differnet tailnets at once is a problem. This limits someone from wanting to use Tailscale for "home" and "office". ---------------------------------------------------------------------- sekyuritei · 2023-11-30 06:59 /r/notreallyselfhosted ---------------------------------------------------------------------- wrath_of_reaper · 2023-11-30 07:18 > Everything you said just agreed with what I posted. Thanks! No? Why do you think companies like Tailscale, Twingate, ZeroTier, etc. still exist? Because they add features to and remove complexity from plain Wireguard. Is Wireguard a bad choice? Off course not, it depends on your needs. > Encrypted or not, that data is extremely valuable. Tell me more about how encrypted traffic, which you cannot decrypt, is valuable, if you only have a bunch of chars and numbers and only know, which IP is sending this data to which IP. What do you do with that metadata? ---------------------------------------------------------------------- oil1lio · 2023-11-30 07:20 Can confirm, Tailscale is fucking amazing. Simplifies so much and also has so many useful and well thought out features ---------------------------------------------------------------------- bwell1211 · 2023-11-30 07:45 You’re thinking of Tails, the operating system. Tailscale is something different. ---------------------------------------------------------------------- Marcosaurios · 2023-11-30 07:45 Someone here using exactly Cloudflare tunnels. My take it's because they allow me to not expose my IP as an entry point for any of my domains. Instead CF is in the middle, adding the extra layer of zero- trust policy ---------------------------------------------------------------------- Kir-01 · 2023-11-30 07:46 I have wireguard built in into my router, so I never looked about hosting myself a VPN. Do you think I should look into it? ---------------------------------------------------------------------- alex2003super · 2023-11-30 07:57 Yep... 24 GB of RAM, 4 ARM vCPUs, 200 GB disk. ---------------------------------------------------------------------- alex2003super · 2023-11-30 07:57 You can use Authentik ---------------------------------------------------------------------- Kenzijam · 2023-11-30 07:58 Zerotier is layer two. This means you can do a lot more with it without any other tunnelling. You can also join multiple networks at once, you can't with tailscale since every "network" uses the same IP range. Huge deal-breaker for me. ---------------------------------------------------------------------- alex2003super · 2023-11-30 08:00 Then Wireguard if you can bother setting it up. Tailscale is a commercial service primarily allowing you to traverse NAT and link remote devices together. ---------------------------------------------------------------------- eve-collins · 2023-11-30 08:02 Omg, thanks! 🤦‍♂️🤦‍♂️ ---------------------------------------------------------------------- thegreatincognitum · 2023-11-30 08:18 That must be new. When I was looking into tailscale last they only allowed big-tech auth, and I was like "then what even is the point". Might be worth another look now. How does it handle multiple users? Most of my wife's family and a few of our friends use services I host. ---------------------------------------------------------------------- Daniel15 · 2023-11-30 08:59 What's the advantage of Nebula? I hadn't heard of it. Tailscale uses Wireguard too. > involves IPtables. You should really switch that to nftables at some point. iptables is deprecated and will be removed in the future. We went through a similar deprecation many years ago during the switch from ipchains to iptables. ---------------------------------------------------------------------- Daniel15 · 2023-11-30 09:02 > wireguard isn't a 1:1 replacement for tailscale, Tailscale is built on top of Wireguard, so a direct comparison doesn't really make sense. *Every* system that's a overlay on top of Wireguard is going to have features that Wireguard itself doesn't have. ---------------------------------------------------------------------- TBT_TBT · 2023-11-30 09:03 But it can be, with https://github.com/juanfont/headscale . Apart from that: it is a service with a 3 user, 100 device free tier which supports many other self hosted endeavors. ---------------------------------------------------------------------- TBT_TBT · 2023-11-30 09:05 Tailscale as controller based Wireguard VPN is absolutely not comparable to this and way easier to setup and use. ---------------------------------------------------------------------- Daniel15 · 2023-11-30 09:06 No need to go down to 256MB RAM when providers like RackNerd and GreenCloudVPS have VPSes with 2GB RAM for $15/year (for example https://greencloudvps.com/billing/store/budget-kvm-sale and https://www.racknerd.com/BlackFriday/) ---------------------------------------------------------------------- Daniel15 · 2023-11-30 09:07 Oracle have a habit of deleting VPSes on the free tier. It's a good option if you script things (eg using Ansible) so you can easily spin up a new VPS. IMO it's worth paying the $15-30/year to get a VPS at a good provider. ---------------------------------------------------------------------- billdietrich1 · 2023-11-30 09:08 Free for up to 3 users and 100 devices. Doesn't sound like a MLM. ---------------------------------------------------------------------- Daniel15 · 2023-11-30 09:09 You can do useful things with Linux namespaces and Wireguard: https://www.wireguard.com/netns/. I don't think systems like Tailscale are quite as flexible. This is more of an advanced use case though. ---------------------------------------------------------------------- TamSchnow · 2023-11-30 09:11 Taildrop is the best way for my Family (who takes a *lot* of pictures) to send them to our server. ---------------------------------------------------------------------- Daniel15 · 2023-11-30 09:11 Tailscale creates a mesh network, where nodes can usually directly reach other nodes, without going through an intermediary server. Like Wireguard, there's no such thing as "clients" and "servers", just peers. With a VPS, you'd likely be routing everything via the VPS, which is slower and introduces a single point of failure. ---------------------------------------------------------------------- PhilipLGriffiths88 · 2023-11-30 09:16 Yeah, agreed. Most important, Wireguard is super easy if you have a small deployment, it does not scale gracefully as it doesn't have its own inherent 'control and orchestration' engine. Thats what the likes of Tailscale offer. fwiw too, Twingate and ZeroTier are not built on Wireguard so moot for them. ---------------------------------------------------------------------- TBT_TBT · 2023-11-30 09:17 And why would that be? They offer a generous free tier, because they earn their money with companies. ---------------------------------------------------------------------- dontquestionmyaction · 2023-11-30 09:20 Tailscale is based on Wireguard, making it a lot faster and more battery friendly. Also has some neat features. If you like ZT, you don't need to switch. ---------------------------------------------------------------------- TBT_TBT · 2023-11-30 09:23 What do you even mean? Tailscale uses „MagicDNS“, which means you can set the name of every device in the TS network via the admin panel. Every other partner in the network will then „know“ how to reach the other side via the name. Those names do not change. I am also under the impression, that the private 100.x.x.x IPs don’t change. ---------------------------------------------------------------------- gaggina · 2023-11-30 09:50 I use netbird ---------------------------------------------------------------------- Simplixt · 2023-11-30 10:14 Exactly. My spare time is worth the 12$ per year, to just have a service that is reliable and works 24/7, instead of an Oracle Cloud Free where my VPN might get shut down in the middle of my vacation, because I'm not a paying customer. ---------------------------------------------------------------------- GolemancerVekk · 2023-11-30 10:29 > yes, you can use OIDC on Free but not the lowest paid tier for some reason Free tier only has 3 users and is capped at 100 devices which disqualifies it from being used for companies. So starter tier doesn't compete with free, free is basically irrelevant for corporate, it only competes with the other paid tiers. Free is only there to create word of mouth from hobbyists and for home use. ---------------------------------------------------------------------- GolemancerVekk · 2023-11-30 10:32 > I like the simplicity of joining devices without needing a login; I believe Tailscale is more user based and requires something like a Google or MS account. You don't need to login on Tailscale either as a regular user. I mean it does need *one* person to login (the savvy one who acts as admin) but secondary users don't care about that. When a friend/relative attempts to join a device to Tailscale it gives them a link, they pass it to the admin, the admin approves it on their account and that's it. ---------------------------------------------------------------------- GolemancerVekk · 2023-11-30 10:35 I believe you can with Tailscale but it's a paid feature on one of the higher plans. ---------------------------------------------------------------------- GolemancerVekk · 2023-11-30 10:45 It's the whole reason they opened up [almost] all the features for free accounts for hobbyists, to get word of mouth going. Pretty smart of them – that and maintaining a good relation with WireGuard and Headscale is also brilliant. Their main target is corporate use anyway, that where all the money is. ---------------------------------------------------------------------- Reasonable-Bear5084 · 2023-11-30 10:50 Just installed tailscale and removed my custom wireguard installation, thank you! The android app is a bit rough though ---------------------------------------------------------------------- sulylunat · 2023-11-30 10:51 Probably feels too good to be true lol. I don’t actively use it but have got it setup as an option just in case I ever need local access to my network and it’s something I’m not hosting. I also use Cloudflare tunnel though so can do the same thing with that. Either way, options are nice. ---------------------------------------------------------------------- GolemancerVekk · 2023-11-30 10:53 Yeah if you need to set up a 1:1 tunnel to tie, say, a VPS into your home server, I'd say use wg-easy and call it a day. But if you already use Tailscale it's game over, you might as well use it for this too. ---------------------------------------------------------------------- GolemancerVekk · 2023-11-30 10:55 Not necessarily. Tailscale binaries are huge and it can be problematic to install them on routers with low space/RAM that will run WG without issues. ---------------------------------------------------------------------- Curious-Tumbleweed60 · 2023-11-30 11:08 It is new, as much as it shames me to shill - these guys have consistently been bringing typically paid tier features to their free tier consumers. SSO should never be a paid feature anyway. Security should never a bargaining chip https://sso.tax But damn if their marketing approach works, they want to make selfhosters their professional acolytes, this thread is all the proof we need that the approach works. ---------------------------------------------------------------------- Curious-Tumbleweed60 · 2023-11-30 11:10 I mean it is, but they're not trying to extract money from consumer users. They want you to proselytize in your workplace, they don't make bank off selfhosters - selfhosters make the bank for them (because the product is genuinely great) ---------------------------------------------------------------------- GolemancerVekk · 2023-11-30 11:13 And how would you use Authentik if the reason you need Tailscale is that you're behind CGNAT? 🙂 ---------------------------------------------------------------------- blackstar2043 · 2023-11-30 11:17 > What's the advantage of Nebula? I hadn't heard of it. Tailscale uses Wireguard too. Tailscale have a good comparison chart: https://tailscale.com/compare/nebula/ - they are very similar but use different encryption methods. > You should really switch that to nftables at some point. iptables is deprecated and will be removed in the future. We went through a similar deprecation many years ago during the switch from ipchains to iptables. Having been using iptables for a long time, it's become a habit to use the term. My choice of Linux is Debian, and it has been included with nftables for some time now. ---------------------------------------------------------------------- GolemancerVekk · 2023-11-30 11:19 You don't want to use a 3rd party OIDC provider but you'd like to use a 3rd party VPN provider? I think you need to reevaluate where you draw the line. If you really want to be 100% self-hosted and self-reliant it's technically possible, but are you really going to self-host DNS and email too? And you'd still have to rely on 3rd parties for domain registration. ---------------------------------------------------------------------- alex2003super · 2023-11-30 11:45 Idk. You could use a free tier Oracle VPS. Although by that point you can install Wireguard on that directly. ---------------------------------------------------------------------- Kenzijam · 2023-11-30 11:46 Don't think so. Issue on github has been open for years at this point. You can't really get around tailnets all sharing the same address space. If two nodes have the same ip in different networks, you can't join them both and have them both work properly. Something fundamental has to change there. https://github.com/tailscale/tailscale/issues/183 ---------------------------------------------------------------------- thefpspower · 2023-11-30 11:51 Never heard of that, but thanks for the heads up. ---------------------------------------------------------------------- Reasonable-Bear5084 · 2023-11-30 12:28 nice trick thanks ---------------------------------------------------------------------- HellDuke · 2023-11-30 12:37 Since my router has openVPN I just use that, never seen much reason to go for anything else ---------------------------------------------------------------------- mathiasnx · 2023-11-30 12:53 There is also [ssotax.org](https://ssotax.org) which is more up2date. It also has a Friends of SSO page. ---------------------------------------------------------------------- SpongederpSquarefap · 2023-11-30 13:13 That would cost like £100 a month to run in any other provider lol ---------------------------------------------------------------------- nosyrbllewe · 2023-11-30 13:27 I want to use mydomain.com to point to my server rather than use Tailscales MagicDNS. Though from my experience so far, my domain name does not work when it point to myserver.xxxx-yyyy.ts.net, the MagicDNS from Tailscale. So I am forced to use the 100.x.x.x IP address instead. While my client computers do keep the same IP, my docker container's IP does keep changing with restarts and such. Though, that could be due to a misconfiguration on my part. ---------------------------------------------------------------------- SpongederpSquarefap · 2023-11-30 13:48 How does it do that exactly? Do they provide a connection broker or something? ---------------------------------------------------------------------- DIBSSB · 2023-11-30 13:48 Its an essential feature which is user in cross country offices to transfer files Idk about security but it works on all devices except just 1 laptop which connects via drep no direct connection while other establish it always ---------------------------------------------------------------------- SpongederpSquarefap · 2023-11-30 13:48 How does it do that exactly? Do they provide a connection broker or something? ---------------------------------------------------------------------- algowolf · 2023-11-30 14:23 Thanks, I guess I misunderstood then. I thought that any device joining my network needs some kind of identity provider login. I don't have any friends or relatives using my network, but I have several personal devices in multiple places. With ZeroTier, each device just requests to join my ZT network ID (no login of any kind), and I approve that device from my admin panel. ---------------------------------------------------------------------- winston198451 · 2023-11-30 15:28 Those are KVM-based VPSes. They are less expensive but I believe they are regulated to the kernel of the host... if that matters to anyone. ---------------------------------------------------------------------- Mintfresh22 · 2023-11-30 15:29 No they didn't. ---------------------------------------------------------------------- tubbana · 2023-11-30 15:44 https://tailscale.com/blog/throughput-improvements/#results Also in upstream ---------------------------------------------------------------------- vnprc · 2023-11-30 16:03 The entire idea of using domain hosting as an identity layer is flawed to the core. Use a public private keypair and route around every centralized point of failure. ---------------------------------------------------------------------- vnprc · 2023-11-30 16:08 Metadata is everything. Just ask Ed Snowden. ---------------------------------------------------------------------- Daniel15 · 2023-11-30 16:18 You're thinking of OpenVZ or LXC. KVM lets you do whatever you want. You can install any OS. ---------------------------------------------------------------------- winston198451 · 2023-11-30 16:37 I stand corrected. Great, now I need to rethink my VPS hosting solution! I'm paying $5.35 a month for Linode. ---------------------------------------------------------------------- GolemancerVekk · 2023-11-30 16:41 They've added passkey support but unfortunately they have some limitations right now: > 1. Users cannot create a new tailnet using passkey key authentication. The tailnet must first be created and user invites for passkey authentication can be sent to subsequent users. > 2. GitHub users accounts don’t have email addresses, so you cannot use passkeys for GitHub tailnets. I'm not sure I understand what either limitation has to do with passkeys, must be something on Tailscale's side. Let's hope these are temporary. ---------------------------------------------------------------------- GolemancerVekk · 2023-11-30 16:54 When a Tailscale device requests to join it generates a web link instead of making a directed request. You open that link in a browser and login to a Tailscale admin account and approve the device then it gets the message and connects (automatically). So basically for your use case it would be extremely similar. You can tie devices to accounts but that's only needed if you intend to create special rules about which devices can interact with other devices and/or accounts. ---------------------------------------------------------------------- Factual_Signage · 2023-11-30 17:57 You do realize that data streams/paths are a thing, right? ---------------------------------------------------------------------- Factual_Signage · 2023-11-30 18:00 Data sciences are a thing. It's literally a part of my job to monitor traffic flow. ---------------------------------------------------------------------- Mintfresh22 · 2023-11-30 18:07 I am sure they have an unbiased opinion. ---------------------------------------------------------------------- tubbana · 2023-11-30 18:18 I mean changes are already in upstream wireguard codebase and they seemed very thankful... ---------------------------------------------------------------------- bigboicarlo · 2023-11-30 18:34 What’s the difference between tailscale and WireGuard? I personally run a reverse proxy for everything public facing and just access my home network for everything else via WireGuard VPN ---------------------------------------------------------------------- epsiblivion · 2023-11-30 18:35 they don't require cli config anymore for cf tunnels. fully able to manage from the cloud dashboard. ---------------------------------------------------------------------- Daniel15 · 2023-11-30 20:39 Linode uses KVM too :D The larger providers (Linode, DigitalOcean, etc) tend to have higher overheads since they run ads, free credit promotions for new users, etc. Too bad you just missed out on Black Friday. Shorting companies have huge sales. You might still be able to find good deals if you look at LowEndTalk. I know that GreenCloudVPS and RackNerd still have some sales going. HostHatch had a good sale too, but theirs has ended already. ---------------------------------------------------------------------- KevinCarbonara · 2023-11-30 20:48 There's a difference between "word of mouth" and "Tailscale changed my life". Only one of those is manufactured. ---------------------------------------------------------------------- ObjectiveList9 · 2023-11-30 21:02 Feels like a rug pull waiting to happen tbh, but I also don’t like the idea of remote access to my network being ran through an organization that isn’t me ---------------------------------------------------------------------- TBT_TBT · 2023-11-30 21:03 Then selfhost it with Headscale. ---------------------------------------------------------------------- Mintfresh22 · 2023-11-30 21:28 You are the one that keeps trying to convince me of something that isn't true. Go away. ---------------------------------------------------------------------- TBT_TBT · 2023-11-30 21:31 If at all, you would need to set a CNAME for mydomain.com forwarding to the name of myserver.xxxx-yyyy.ts.net. Having CNAME for the main domain however is not allowed. The main domain must link to an IP address via A record. If you want to use myserver.xxxx-yyyy.ts.net as target, you could only use CNAME with a SUBdomain, like myserver.mydomain.com. I however don’t really get why that would be necessary, except maybe for LE SSL. You however would not need to use SSL in the tunnel, because the transfer is secure in the tunnel, so you could just use http://magicdnsname . ---------------------------------------------------------------------- ProffesionalAds · 2023-12-01 06:13 Personally, I like Tailscale for its simplicity but you can have a look at Netmaker which I think you might like it for its robustness when it comes to remote access. https://www.netmaker.io/ ---------------------------------------------------------------------- SpambotSwatter · 2023-12-01 14:11 /u/ProffesionalAds is a click-farming spam bot. Please downvote its comment and click the `report` button, selecting `Spam` then `Link farming`. With enough reports, the reddit algorithm will suspend this spammer. --- >!^(If this message seems out of context, it may be because ProffesionalAds is farming karma and may edit their comment soon with a link)!< ---------------------------------------------------------------------- DeusExRobotics · 2023-12-02 12:58 Yeah it's click click done. I used to wrangle ports like Hercules fighting the hydra. Now I just connect and don't think twice about it. it's pretty awesome. Here's a tutorial [https://youtu.be/\_Yhkg-0KDXU](https://youtu.be/_Yhkg-0KDXU) ---------------------------------------------------------------------- jdub-951 · 2023-12-03 23:32 The big one for me is the ability to host your own control plane using headscale and relays. While I trust Tailscale for hosting, some of my clients don't, and having a solution I'm 100% in control of has value.