Do you use cloudfare tunnel or a vpn like tailscale or wireguard ? Why would you choose of these over the other? reddit / selfhosted ---------------------------------------------------------------------- ElevenNotes · 2023-11-30 09:47 Pretty simple answer: Wireguard. Why? It’s the fastest of them all, works on almost all devices you can imagine, does not rely on any 3rd party like Tailscale with OICD or other IdP. Tailscale has its use when you are behind CGNAT and don’t want to VPS a Wireguard server somewhere with a static IP, other than that, it has no use in my opinion. I’m fully aware that I get downvotes from people who praise the zero trust principals of Tailscale and all the rest, but they always forget that you can do zero trust since decades with any network equipment (VXLAN) and add Wireguard to the mix. You can even run Wireguard in your local network to encrypt unencryptable traffic like NFS. Check back in a few hours /u/Silencer306, this comment will have a few if not many downvotes. ---------------------------------------------------------------------- weischin · 2023-11-30 10:04 Not sure about others but I use Tailscale to connect to services on my local network and Cloudflare tunnel for apps I put online. ---------------------------------------------------------------------- LegitimateCopy7 · 2023-11-30 10:10 wireguard as primary, Tailscale as backup. if I have something I don't mind Cloudflare and the government taking a look, then Cloudflare tunnel. ---------------------------------------------------------------------- ArgoPanoptes · 2023-11-30 10:19 If you can use Wireguard that is probably a good solution but I would still prefer to have a cloud proxy in front of it because my network can not handle all the attacks and wouldn't even notice some of them if you use just Wireguard. I use CF Tunnels firstly because of all the protections and traffic analysis it does, and secondly, because even DDNS wouldn't work on my network. ---------------------------------------------------------------------- ElevenNotes · 2023-11-30 10:21 I get your fear, but the fear is probably not based in reality since 1st you are not a target (no one cares really), 2nd you can implement DDoS protection pretty much on any custom router OS, some more expensive routers have it even backed in. To protect against DDoS is nothing fancy and can be easily achieved without the need to use cloud-based services. Not saying you shouldn’t just saying the need is not rooted in reality but more on an emotional side (the big cloud provider will protect you better than you can, kind of thing). ---------------------------------------------------------------------- ArgoPanoptes · 2023-11-30 10:28 You are probably right, but at the moment, this type of security is something I just don't want to worry about or deal with it. I think next year I'll get a hardware firewall from which I will be able to learn more and be more confident in the use. ---------------------------------------------------------------------- ElevenNotes · 2023-11-30 10:31 That’s the spirit! ---------------------------------------------------------------------- arcadianarcadian · 2023-11-30 10:37 Wireguard. Because I would like to self-host everything myself, so why should I use another 3rd party service? ---------------------------------------------------------------------- NekoLuka · 2023-11-30 11:17 I wanna host everything myself, but also love tailscale, so I'm using tailscale with headscale... It's so convenient to not open up ports, especially since I don't have a static IP ---------------------------------------------------------------------- driversti · 2023-11-30 11:18 I use WireGuard. It is sufficient for me, because I have no need to make my services publicly visible. ---------------------------------------------------------------------- wiseguy9317 · 2023-11-30 11:56 I use Wireguard and Tailscale. Some networks block Wireguard connections. Tailscale always works. ---------------------------------------------------------------------- 80Ships · 2023-11-30 12:05 I do exactly the same. I expose my wordpress website through CF tunnels though I'm not sure how safe that is - I'm probably asking for trouble. ---------------------------------------------------------------------- Simplixt · 2023-11-30 12:05 Wireguard ( + VPS as Wireguard-Gateway with fixed IP to my HomeNet) \- No Cloudflare, as I don't want a Man-in-The-Middle breaking my certificates \- No Tailscale, as I'm using OPNsense and want complete controll over my Networking \- No Port-Forwarding with Reverse Proxy, as I don't trust Selfhosted- Github-projects to be hardened enough for Security But I only use my Selfhosted-Apps on my own devices. Otherwise Reverse Proxy with strict 2FA / Forward-Authentication would also be an option. ---------------------------------------------------------------------- weischin · 2023-11-30 12:21 Cloudflare proxies your website and along with that all the security features it provides so I would say it's pretty safe. ---------------------------------------------------------------------- wtfbreeze · 2023-11-30 12:22 \+1 ---------------------------------------------------------------------- vivekkhera · 2023-11-30 12:28 I’ve used IPSec to connect to my home (and office when I had my own company) networks. It has never failed me and the client is built right into my iphone and mac. ---------------------------------------------------------------------- FaptainCrunch7 · 2023-11-30 12:50 Would this be instead of a reverse proxy? ---------------------------------------------------------------------- dnt_pnc · 2023-11-30 12:52 Wireguard because my consumer router has it built-in. ---------------------------------------------------------------------- aadoop6 · 2023-11-30 12:55 How do you access those services from a public network? Say, you want to access something while working from your office or a friend's computer. ---------------------------------------------------------------------- driversti · 2023-11-30 12:57 I connect to my VPN and now I'm in my local network, say 10.100.10.x/24 ---------------------------------------------------------------------- Anejey · 2023-11-30 13:02 I use all three. * CF tunnels to access generic apps I want public. * Tailscale to have remote access to my home network. * Wireguard tunnel going to a VPS for apps that I don't feel comfortable running through CF due to the bandwidth (Jellyfin, AzuraCast). I totally could move everything that's on CF tunnels over to Wireguard, but I see no need to do it. Cloudflare is trustworthy enough and I like the additional protection it offers. ---------------------------------------------------------------------- 007bane · 2023-11-30 13:12 I use cloudflare with overseerr ---------------------------------------------------------------------- TheRealSeeThruHead · 2023-11-30 13:29 I use both. Cloudflare is for public facing services. Like overseerr and wizarr. Tailscale is how I access my private services and dashboards. ---------------------------------------------------------------------- PatochiDesu · 2023-11-30 13:31 wireguard because no one else needs to know what services i run in my local network ---------------------------------------------------------------------- sko3d · 2023-11-30 13:52 Wireguard to access my services from anywhere, automatically connected on my phone when it is not in my home wifi. ---------------------------------------------------------------------- jkirkcaldy · 2023-11-30 14:20 For work, Tailscale between vps and server. It works like cloudflare tunnels but doesn’t have the issues with the TOS excluding media streaming etc. Keeps the internal server relatively safe and we can stream media/serve media content. Cloudflare is our registrar and dns provider. ---------------------------------------------------------------------- AnApexBread · 2023-11-30 14:34 Yes. I use all three for different purposes. It all depends on what my requirements for self hosting some are. ---------------------------------------------------------------------- numblock699 · 2023-11-30 14:39 To access my stuff at home and elsewhere from anywhere I use Twingate. I don’t expose anything from my home via Cloudflare. I do ise cloudflare WAFs for stuff on my VPSs. ---------------------------------------------------------------------- AnApexBread · 2023-11-30 14:40 >Tailscale has its use when you are behind CGNAT and don’t want to VPS a Wireguard server somewhere with a static IP, other than that, it has no use in my opinion. I’m fully aware that I get downvotes from people who praise the zero trust principals of Tailscale and all the rest, but they always forget that you can do zero trust since decades with any network equipment (VXLAN) and add Wireguard to the mix. People just forget that all Tailscale is is a fancy GUI for managing Wireguard. That's it. Wireguard lacks a lot of user management features so you need a service like Tailscale to handle that, but everything zerotier does is something you can already do in wireguard, just simplified. ---------------------------------------------------------------------- AnApexBread · 2023-11-30 14:43 >- No Port-Forwarding with Reverse Proxy, as I don't trust Selfhosted- Github-projects to be hardened enough for Security You know there are plenty of non Github reverse proxies. Nginx proxy manager is just a gui for Nginx. You can download Ngnix and configure it manually. It's hardly some "self hosted-github-project", Nginx is used all over the world by millions of businesses ---------------------------------------------------------------------- AnApexBread · 2023-11-30 14:44 >How do you access those services from a public network? With Wireguard? ---------------------------------------------------------------------- AnApexBread · 2023-11-30 14:46 >Some networks block Wireguard connections. Dollars to doughnuts they're blocking the default Wireguard port. Change your wireguard port to something like 8080 or 8443 and you'll almost certainly make it through ---------------------------------------------------------------------- AnApexBread · 2023-11-30 14:47 >CF tunnels to access generic apps I want public. >I totally could move everything that's on CF tunnels over to Wireguard, but I see no need to do it How would you keep the public apps public if you require a wireguard connection to access them? ---------------------------------------------------------------------- terramot · 2023-11-30 14:52 I have a domain on cloudflare to map internal IPs/services and use wireguard to reach the network. Tried Tailscale and Zerotier, there was a problem on some devices when switching from wifi to internet which was breaking internet access, switched to Wireguard and now i'm happy. ---------------------------------------------------------------------- Anejey · 2023-11-30 14:53 I've got a WG tunnel linking the VPS to my locally hosted Nginx Proxy Manager. Then on the VPS I've got Caddy (also a reverse proxy) that points domains to the WG tunnel. As for DNS I still use Cloudflare. To access local services publicly all I need to do is add a proxy host in NPM, and add a DNS entry in Cloudflare that points to the VPS. ---------------------------------------------------------------------- omniterm · 2023-11-30 14:56 I use Twingate, saw it in a network chuck video and setup was easy. At one point I had a VPN server running on a raspberry pi but never really used it just like I don't really use twingate that much. I may eventually setup wireguard on my cloud server so I'm the one hosting everything but for now it's not something I use so it's one of those when I get around to it. ---------------------------------------------------------------------- Simplixt · 2023-11-30 15:02 It's not about the reverse proxy at all, it's about the applications behind. As I said below, with Forward-Auth-Proxy it's an option. ---------------------------------------------------------------------- Minty14 · 2023-11-30 15:39 How did you get WG to auto connect when off your home wifi? I've never found a reliable method (on Android). ---------------------------------------------------------------------- Oujii · 2023-11-30 16:16 This an over simplification that does not do justice to either ZeroTier or Tailscale. ---------------------------------------------------------------------- shmeekaz · 2023-11-30 16:25 Precisely why I use WireGuard. Love it. ---------------------------------------------------------------------- Oujii · 2023-11-30 16:47 You can Tailscale on OPNsense. Also, can you link to the WireGuard- gateway? ---------------------------------------------------------------------- Oujii · 2023-11-30 16:48 They might be doing DPI as well. Some places block all UDP ports. ---------------------------------------------------------------------- lrdfrd1 · 2023-11-30 17:04 Mainly reverse proxy via NPM, if that goes down, tailscale to the server, if that goes down, WireGuard on the router. If that goes down.. call the isp. :) ---------------------------------------------------------------------- KoppleForce · 2023-11-30 17:39 Doesn’t cloudflare limit a lot of what you and you can pass through it? I mean in my laymen head it’s basically just a VPS that is serving up traffic for you, seems like they’d want some compensation for that if you start moving anything significant through it. I only use a basic text based memo app thing through cloudflare, and use rented VPS + WireGuard/Nginx for everything else. ---------------------------------------------------------------------- bobbarker4444 · 2023-11-30 17:44 >To protect against DDoS Just to nit-pick, a homemade solution can protect against *some* DDoS attacks. Simply having packets arrive at a device means there's a potential to DDoS through sheer volume. The idea behind services like Cloudflare is that they can handle significantly more incoming volume than your home router can. I wouldn't really say that's "emotional". Cloud bases DDoS protection services simply have the infrastructure that you and your router from amazon do not. ---------------------------------------------------------------------- HoytAvila · 2023-11-30 17:53 What attacks are you worried about when you open wireguard port? It is a UDP port so attacks are limited, and changing the default port gives you even greater protection. So they cant even know you are running wireguard behind that port. (If someone is able to know then most likely it is your ISP lol) Wireguard just works, you own everything and control everything. Im struggling to find a reason to not use wireguard for security reasons which forces you to use cloudflare or tailscale, if wireguard is not secure enough for you then there are more things to worry about other than what tech to expose services with. ---------------------------------------------------------------------- ElevenNotes · 2023-11-30 17:57 Spread the word about Wireguard. ---------------------------------------------------------------------- whopper2k · 2023-11-30 17:59 "Wireguard-gateway" doesn't refer to a project in this context, it's a gateway for Wireguard traffic. By having a cloud-hosted VPS with a static IP, you can set up static DNS routes (or even hardcode the IP but that's lame) for you Wireguard conf files instead of having to resort to dynamic DNS entries that update when your ISP issues you a new public IP. I imagine the comment OP doesn't want to link their private VPS on Reddit lol ---------------------------------------------------------------------- wiseguy9317 · 2023-11-30 17:59 I wish it was that simple. Some networks have rules in place to block personal vpn use. I have yet to run into one that blocks Tailscale. ---------------------------------------------------------------------- schklom · 2023-11-30 18:02 Home server --Wireguard--> VPS and client --https traffic--> VPS --tcp passthrough via Wireguard--> home server As with Cloudflare, no one can find my IP + I don't open a port + the VPS provider will handle (D)DoS attacks for me.\ Unlike with Cloudflare, the VPS does ***not*** decrypt anything, it just passes the encrypted traffic to my home server. ---------------------------------------------------------------------- schklom · 2023-11-30 18:07 "Tasker" and "Automate" can do that pretty well and much more. You can also enable "Always-on VPN" in Android settings, but it is not ideal unless you have a static home IP. ---------------------------------------------------------------------- schklom · 2023-11-30 18:09 My uni blocked 80, 22, 443, 1994, 51820, for UDP. I didn't test others. ---------------------------------------------------------------------- AnApexBread · 2023-11-30 18:11 It's really not. Explain something Tailscale does that you can't do in wireguard natively. ---------------------------------------------------------------------- Standard_Parking7315 · 2023-11-30 18:15 I use Wireguard to access my home VPN served by my tpLink router. Tailscale to connect devices/servers using tunnels, specially when I can’t open ports, like at work. And Cloudflare to expose services without opening ports and with basic bot protection and analytics. ---------------------------------------------------------------------- aadoop6 · 2023-11-30 18:23 Sure, but what if that computer doesn't have wireguard installed. I don't see any other way except exposing the service to the public. ---------------------------------------------------------------------- aadoop6 · 2023-11-30 18:24 For that you need a VPN client on a machine you don't own. How does it work in all cases? ---------------------------------------------------------------------- wwbubba0069 · 2023-11-30 18:24 The tunnel has limits, you can't run your Plex/Jellyfin through it. Static pages only. The DNS they do is not limited. I use Cloudflare for the dynamic DNS sync and proxy. ---------------------------------------------------------------------- [deleted] · 2023-11-30 18:24 [deleted] ---------------------------------------------------------------------- driversti · 2023-11-30 18:29 I have a server on Oracle, but plan migrating it to Hetzner ---------------------------------------------------------------------- Oujii · 2023-11-30 18:42 NAT hole punching. ---------------------------------------------------------------------- Hoopae · 2023-11-30 19:00 Same setup here - Cloudflare Tunnel for anything that I'm not worried about exposing or want public (Overseerr, Mealie, etc.) and Tailscale for more sensitive things like Portainer. VPN's are great, and Tailscale/Wireguard are great solutions, but there are times where I can't install apps on shit (like for work computers) ---------------------------------------------------------------------- AnApexBread · 2023-11-30 19:03 Wireguard already supports client-to-client VPN connections natively. ---------------------------------------------------------------------- adamshand · 2023-11-30 19:05 Same. ---------------------------------------------------------------------- ialex87 · 2023-11-30 19:05 Yo! Same here and looks like I am not the single paranoid here! ---------------------------------------------------------------------- tpwn3r · 2023-11-30 19:06 Tailscale is amazing. Soo easy to setup. ---------------------------------------------------------------------- ElevenNotes · 2023-11-30 19:06 Yes, but you are not targeted by Chinese bot nets that will DDoS you 24/7. You will be DDoS by a guy who lost in Minecraft against you and spent 20$ for a 30' DDoS attack against your IP. ---------------------------------------------------------------------- ElevenNotes · 2023-11-30 19:24 This is only needed in special cases and not the norm. ---------------------------------------------------------------------- ElevenNotes · 2023-11-30 19:25 I manage dynamic Wireguard for hundreds of clients with 2FA and SSO without any problem, so you are spot on 😁. No GUI needed. ---------------------------------------------------------------------- Oujii · 2023-11-30 19:26 That's not what I said though. ---------------------------------------------------------------------- Oujii · 2023-11-30 19:28 That's irrelevant, the question was something that Wireguard doesn't do natively. ---------------------------------------------------------------------- ElevenNotes · 2023-11-30 19:31 You can hole punch with any software. It's not line Tailscale invented this. ---------------------------------------------------------------------- AnApexBread · 2023-11-30 19:37 That's what you're calling "NAT hole punching". In IT we call that a client-to-client VPN, where both clients can talk bi-directionally with each other. Wireguard supports that natively. A wireguard client behind a firewall can talk to another Wireguard client in a different network and open a communication tunnel the two. The two can then talk without having to forward ports. That's a feature of wireguard, not Tailscale. ---------------------------------------------------------------------- Oujii · 2023-11-30 19:42 Okay, so if I have my WireGuard server hosted at home behind CGNAT and I’m out and about, how do I go about connecting to that server? ---------------------------------------------------------------------- Oujii · 2023-11-30 19:42 I didn’t say they invented this though. Can you tell me how to do this using Wireguard natively? ---------------------------------------------------------------------- PatochiDesu · 2023-11-30 19:50 zero trust is not zero trust because you have to trust the provider of your service. and because they are naming it zero trust i cant trust them. ---------------------------------------------------------------------- sko3d · 2023-11-30 20:11 This. I use Tasker for this, works very reliable. ---------------------------------------------------------------------- what_comes_after_q · 2023-11-30 20:56 I use Tailscale, and you can set up a subnet router for that particular use case. ---------------------------------------------------------------------- xardoniak · 2023-11-30 21:43 I use CloudFlare as my reverse proxy, with a CF application in front of most things. This locks it down to either my Google account (with 2fa enabled) or my email, which needs 2fa to log into. I also set up my internal resources to auth with Google where possible. I do have Overseerr available publicly though. I also have a split tunnel VPN running 24/7 on my phone so I can access internal resources like my AdGuard servers ---------------------------------------------------------------------- secopsx · 2023-11-30 21:48 I just use the UDM-SE App (Teleport). I can connect on demand and get to all of my services, get adblocking while I'm out and about. Teleport on ubiquiti is just wireguard renamed. I don't need to expose any services from my home network, because I'm the only one using them. If It wasn't just me, I'd just have them download the wifiman app, send them a teleport link and boom...they're in on the local network. Exposing "services" for a convenience factor is just too much of a security risk for myself. I host all of my websites on github (free) and leverage vercel for CI/CD pipelines (again, free). Domains are the only thing public and that I pay for. (local dns reasons for lets encrypt certs) and for my public websites not associated with my home infrastructure. ---------------------------------------------------------------------- secopsx · 2023-11-30 21:49 excellent reply ---------------------------------------------------------------------- brunopgoncalves · 2023-11-30 22:16 and this can be poor if provider is cloudflare ---------------------------------------------------------------------- shmeekaz · 2023-11-30 22:19 Could always tunnel UDP inside TCP. ---------------------------------------------------------------------- Ouity · 2023-11-30 22:21 Hypothetically, it would be a little cumbersome but you could log in to prozmox on your phone and make the necessary changes/grab a new key. I've done similar in the past. I've never felt the need to bring one of my self hosted services up on someone else's device, though. And with your own device, just install wireguard to your devices and this won't happen ;) ---------------------------------------------------------------------- zfa · 2023-11-30 22:22 They're different tools: 1. WireGuard/Tailscale allows you to access private resources resources 2. Cloudflare Tunnel allows you to make private resources availalbe publically. There's some overlap - Cloudflare has a zero-trust product called Access which can be staced on top and WireGuard/Tailscale could be set up with multiple users - but they're literally diferrent tools designed to solve different problems. ---------------------------------------------------------------------- zfa · 2023-11-30 22:28 Twingate is great but for some reason the Android client won't run because it thinks my phone is rooted (it isn't). So weird. ---------------------------------------------------------------------- omniterm · 2023-11-30 22:31 I use to have root and it refused to run as well. After hiding root from the app Twingate worked with no issues. That is the one annoyance I had with Twingate. There is no reason to block the app if your rooted. They should switch to a warning instead of out right blocking ---------------------------------------------------------------------- zfa · 2023-11-30 22:35 Yeah, so annoying. I did report it so may check back at some point. In my case I think it's actually false positive due to an unlocked bootloader. ---------------------------------------------------------------------- m3mph1z78 · 2023-11-30 22:35 Can you share how to do this setup? I'm using opnsense and intending to use a gateway on a vps. I searched for tuts but haven't found any yet. ---------------------------------------------------------------------- Simplixt · 2023-11-30 22:45 If you have detailed questions on the way just ask, but let's start with the installation: \- Search for an VPS that allows the install via Custom ISO \- Install OpnSense via WebTerminal, only set the WAN-Interface \- Disable the firewall via pfctl -d command, so that you can login to the WebInterface via WAN-Address \- Install WireGuard; config the VPS-Firewall as Server, the Home- Firewall as Client \- Config all Firewall rules according to your needs ... ---------------------------------------------------------------------- m3mph1z78 · 2023-11-30 22:48 Thank you! Appreciate your reply and offer! ---------------------------------------------------------------------- Oujii · 2023-11-30 23:03 This is the way. ---------------------------------------------------------------------- platswan · 2023-12-01 00:05 Started with exposed domains with NPM, SSL certificates, etc. Tried out CloudFlare tunnels and wasn't satisfied, so I landed on Tailscale. Dead simple to set up and use. Fast, secure, what more to ask for? ---------------------------------------------------------------------- nmkd · 2023-12-01 00:55 ZeroTier >>> it just works ---------------------------------------------------------------------- LegitimateCopy7 · 2023-12-01 01:06 https://tailscale.com/blog/how-nat-traversal-works/ read this detailed blog written by Tailscale on the nuanced topic of "NAT Traversal" (yes, this is what we call it in IT) and stop being confidently wrong. Wireguard doesn't do NAT traversal by itself. That's why it needs another layer like Tailscale to handle that. ---------------------------------------------------------------------- Ordinary_Employer_39 · 2023-12-01 02:09 This might be what you're looking for https://github.com/NOXCIS/Wiregate ---------------------------------------------------------------------- PaleMongo · 2023-12-01 03:36 That proxy exposes all your traffic to Cloudflare... so you must trust them. ---------------------------------------------------------------------- mikesellt · 2023-12-01 03:57 What about Headscale, NetMaker, etc...? Anyone using those? For remote access, I've been using Tailscale and route my whole home network to it so I can access anything and only have a Tailscale client on my server itself (in its own container) and the mobile clients. I've used Zerotier in the past, but it was early on and kinda buggy. I've been looking for a completely self-hosted solution to replace Tailscale. For public services, I just use Nginx Proxy Manager and port forward to it. Cloudflare just hosts DNS. ---------------------------------------------------------------------- MITstudent · 2023-12-01 04:22 It has been 8hrs. I think you win. I was swayed by these sweeping statements but you have proven that reality is hairier. Thank you ---------------------------------------------------------------------- auzzlow · 2023-12-01 04:27 Well.. WireGuard is point to point. What these apps do are manage a mesh of these connections from every device to every device. So, while nothing networking wise is being done in TS that can't be done with WG alone.. TS is programmatically creating these tunnels for you. Although I admit it is not in the spirit of your comment, I would argue that WireGuard alone can't help you avoid the *literally* exponential amount of work that's required to create a mesh of tunnels. Connect 2 devices, you need 1 tunnel. Connect 3 devices, 3 tunnels. 4 devices, 6 tunnels. 5 devices, 15 tunnels needed. I have 43 devices on my tailnet.. and I'm not going to setup the thousands of tunnels that would be necessary to connect those. Some people have many many more. ---------------------------------------------------------------------- Oujii · 2023-12-01 04:47 The other guy (the one I originally replied to) didn't like it and blocked me. Nice. ---------------------------------------------------------------------- Encrypt-Keeper · 2023-12-01 05:45 For starters the CF tunnel means your service is publicly accessible and Tailscale or Wireguard it won’t be. ---------------------------------------------------------------------- sintheticgaming · 2023-12-01 06:05 Wireguard I trust myself more than any cloud provider, and at least I know when something is fucked and not working it’s my own fault. Also who’s to say cloudflare doesn’t decide to put its tunnels service behind a subscription.. ---------------------------------------------------------------------- ElevenNotes · 2023-12-01 06:25 Wireguard is just software, and like any software, it can be controlled, integrated and what not. If you are not capable of opening a Wireguard connection after using 2FA or SSO you should stick to prebuilt solutions. ---------------------------------------------------------------------- ElevenNotes · 2023-12-01 06:25 There is no winning against me buddy. ---------------------------------------------------------------------- Cold-Membership7654 · 2023-12-01 06:59 I have been experimenting with Tailscale and it's just not fast enough for our needs. It's insanely simple to setup and get guys going on it, but in the end we couldn't get more than \~20mbit or so, if even that. Looking forward to giving [Netmaker](https://www.netmaker.io/) a shot (Still a Wireguard Kernel as Tailscale), but we need to be able to switch allowed access between different groups of external users throughout the day. Ideally in a way that only requires a click or two, or can be somehow automated into a click or two. ---------------------------------------------------------------------- Silencer306 · 2023-12-01 07:18 Can you not give access to other people on your wireguard/tailscale so they can access the apps they need? And restrict them to the said apps? Does cf tunnel make it easy? Or giving them access to your vpn is a risk? ---------------------------------------------------------------------- zfa · 2023-12-01 07:24 Yes, you can give other users access to WG/TS, of course. Still doesn't make the services behind them *public* though. CF Tunnels are easy but don't limit access in and of themselves. Giving people access to your VPN is as risky as you set things up (firewalls etc.) ---------------------------------------------------------------------- Silencer306 · 2023-12-01 07:28 I keep reading that everyone uses nginx, does that require port forwarding to work? What problem exactly does nginx solve? And without nginx how are YOU solving that problem? Sorry I’m a little confused ---------------------------------------------------------------------- Silencer306 · 2023-12-01 07:33 So I can just setup a wireguard and let others use it to access my Plex? Only thing is they need a client to connect? And I can restrict their access using firewall? ---------------------------------------------------------------------- oriongr · 2023-12-01 07:34 Do you run tailscale in same network as portainer? ---------------------------------------------------------------------- zfa · 2023-12-01 08:03 Sure. As long as they run the properly-configured WG client and turn on the connection to your server - and that server can pass traffic to plex - they'll be able to access it just fine. ---------------------------------------------------------------------- Oujii · 2023-12-01 11:27 Although you ignored my question, now you understand that there are other uses cases that people might have for a software like this. It’s a similar situation to self hosting email. A lot of people simply don’t want to. ---------------------------------------------------------------------- jazzmonkai · 2023-12-01 13:12 I started with Tailscale. My main use in the beginning was to have access to my Home Assistant when I was out, and for that it was perfect. Then I started to want access to files on my NAS without using Synology's Quickconnect after they had a security scare. Tailscale was fine for this too. But when I began game streaming from my home PC, that's when Tailscale stopped working for me. Latency spikes, poor bandwidth, it just wasn't up to the task. Now I have wireguard set up on my Opnsense router, and it's perfect. My upload speeds are max 20Mbps due to my internet service, but I can reliably stream at around 15Mbps with latency of about 25ms max. It's definitely harder to manage and maintain than Tailscale was, and I've ended up doing a bunch of other stuff like buying a domain so I can have SSL for my other hosted services (which have grown since I started, naturally!), but for performance it's ideal. I'd probably start with something like Tailscale or Zerotier because they're easy to set up and deploy. If that meets your needs, no need to look elsewhere. I considered CF tunnels but I have one already set up for Google Home to interact with Home Assistant and I find it hard to understand so the idea of using it more widely didn't seem smart. I'm already worrying about the day I have to update the domain name from the current DuckDNS one to my paid for domain... ---------------------------------------------------------------------- ElevenNotes · 2023-12-01 14:11 I did not ignore your question, you know full well that Wireguard does not have native **anything**, why do you think Tailscale is using Wireguard as a base layer? But that does not mean you can’t extend Wireguard yourself with anything you like, which you can if you know how, and yes, the average Joe does not know how, that still does not make Tailscale the primary choice if you don’t have CGNAT and can port fortward, you should still pick Wireguard first. The simple reliance on a 3rd party should be enough to even convince you, and we can all agree that zero trust principles are not needed in a self hosted context, most if not all companies don’t even use zero trust principles, only the big or modern ones, I have seen none so far, not a single one, from Hospitals to Governments that use any zero trust principles. ---------------------------------------------------------------------- Hoopae · 2023-12-01 14:18 I do, yeah. Tailscale is my fallback "something went wrong while I'm not at home and I need to fix it". I recognize that there are more elegant/secure solutions, however when I just need to log in from my phone and restart a container or something, Tailscale works great and keeps me from having to expose my Portainer config. Prior to using Tailscale for this solution, I had Portainer exposed via my CF Tunnel and locked behind a Zero-Trust config that required a 2FA email where the only accepted email was my personal gmail account. Again, not the most scalable solution, but it worked for a while. ---------------------------------------------------------------------- Oujii · 2023-12-01 14:19 You can of course extended Wireguard to do other things with the right tools, but a lot of people simply don't want to. What should be primary or secondary choice is completely up to the person doing it, I personally prefer to use WG as you, but I don't judge anyone for choosing Tailscale for its simplicity. In general people don't pick Tailscale for the zero trust, at least not individuals, but there are companies that use it. I work at one of the biggest companies in the world and we are moving to a zero trust environment, don't ask me why, I don't take these decisions. Tailscale is just easy and that's probably why people use it. For me Wireguard is as easy, but not everyone agrees with me. ---------------------------------------------------------------------- ButterscotchFar1629 · 2023-12-01 21:01 Both ---------------------------------------------------------------------- MITstudent · 2023-12-02 03:29 I'm not your buddy pal ---------------------------------------------------------------------- MITstudent · 2023-12-02 03:30 LOL ---------------------------------------------------------------------- ia42 · 2023-12-04 07:38 When I cruise around the net I sometimes use Mullvad as an ass-guard. When I connect to my own server I have SSH, and if I ever need to access a local port I use *port redirect over the SSH tunnel*. As a backup of a backup, if I am at a site that blocks access to remotes on port 22, I have *sslh* running on port 443 in front of my nginx, intercepting TLS for nginx, SSH and openVPN (running in docker) *all on the one port*, so I have options...