Zero Tier vs Tailscale? reddit / selfhosted ---------------------------------------------------------------------- archgabriel33 · 2023-12-17 20:57 What's the latest view around here on what's best for remote accessing my homelab network? ZeroTier or Tailscale? Or something else? And why? [View Poll](https://www.reddit.com/poll/18kr28m) ---------------------------------------------------------------------- ADB-UK · 2023-12-17 21:14 Would help for you to say what you want to do... ---------------------------------------------------------------------- Oujii · 2023-12-17 21:37 They actually said it in the post. ---------------------------------------------------------------------- Simplixt · 2023-12-17 21:51 WireGuard. ---------------------------------------------------------------------- morphodone · 2023-12-17 21:56 Same here. Wireguard. ---------------------------------------------------------------------- hereisjames · 2023-12-17 22:07 Remote access, I prefer Twingate since it's granular by user and resource, down to port level, without having to use an external identity provider. And as the name suggests it's natively HA. Infrastructure, like linking servers and instances, something Wireguard based. ---------------------------------------------------------------------- archgabriel33 · 2023-12-17 22:11 Yep. Just the normal stuff. Access my services and containers. E.g. Gotify, radarr, etc ---------------------------------------------------------------------- prabirshrestha · 2023-12-17 22:33 Used both. Primary is tailscale. I one got in a situation where tailscale bug was having issues running in Synology nas. Had ZeroTier as a backup which allowede to connect to my nas and restart tailscale. ---------------------------------------------------------------------- FuriousRageSE · 2023-12-17 22:39 >Twingate Read little quickly.. it only seems to replace vpn, and not tunnels and such, atleast i didnt i see any reference to that when i skimmed thru. ---------------------------------------------------------------------- adamshand · 2023-12-17 23:01 Might be nice to have some selfhosted options included. :-) - wireguard - boring proxy - ssh - openvpn - ... ? ---------------------------------------------------------------------- multidollar · 2023-12-17 23:07 Self-hosted WireGuard, because this is Self-hosted after all! ---------------------------------------------------------------------- Phynness · 2023-12-18 00:42 Wireguard for accessing services that are not exposed. Cloudflare tunnel for Overseerr. ---------------------------------------------------------------------- NikStalwart · 2023-12-18 01:11 > Had ZeroTier as a backup which allowed to connect to my nas and restart tailscale. Why use something as heavy as zerotier for backup? IO mean I love me some backups as much as the next sysadmin but my backup is vanilla wireguard — the fewer moving parts, the better. ---------------------------------------------------------------------- NikStalwart · 2023-12-18 01:13 > Read little quickly.. it only seems to replace vpn, and not tunnels and such, atleast i didnt i see any reference to that when i skimmed thru. I am confused by this statement. What, to you, is the distinction between tunnels and a VPN? A VPN, after all, creates a tunnel.... ---------------------------------------------------------------------- NikStalwart · 2023-12-18 01:15 KVM-over-mom. >!In all seriousness, I prefer things with the fewest moving parts possible, so for the longest time I've used ssh tunnels, and only recently switched to wireguard-based solutions like innernet!< ---------------------------------------------------------------------- xkcd__386 · 2023-12-18 01:30 Does "self-hosted" necessarily mean "public IP available"? If you don't rent a VPS or similar, and the servers you _do_ own are behind CGNAT (for whatever reason), you need something like tailscale to help "get out". If you have, say, your own nextcloud or whatever in such a setup, is that not considered self-hosting, simply because you're using an external service to get access to stuff behind CGNAT, say, from your phone while on the road? ---------------------------------------------------------------------- Internal_Seesaw5612 · 2023-12-18 02:56 Anything like tailscale just brings a pre-made solution to rotate wireguard keys, a easy to use firewall ACL, and to create a vpn without opening ports. If any of those aren't need for you than I'd just stick with wireguard. ---------------------------------------------------------------------- themonstersarecoming · 2023-12-18 03:52 Tailscale is amazing and just works amazingly well out of the box. I use it extensively. However if you want to go with self-hosted then just hosting wireguard is the way to go. What I do is use a small cloud hosted VPS to run Nginx Proxy Manager and put Tailscale (or wireguard) on it and my unraid server (could be any docker server). Then I can easily route through the private network, never exposing my public IP to anyone, everything is encrypted, and it works pretty well. It also means my network can change around the server (say it's a portable zimaboard or raspberry pi that I plug into hotel wifi) and it still just works and is reachable assuming the server has access to the Internet. For offline I run a mirrored copy of the Nginx Proxy Manager locally, and use my DNS ad blocker to route traffic to the local instance of Nginx Proxy Manager. That way if I'm on my local network I go straight to the server without having to go to the VPS, and if I'm outside my home network then my VPS still let's me connect. However if it's only you accessing stuff from other computers that also are part of your tailscale network, then you can just ignore all the reverse proxy stuff and just use tailscale with their dns. This is great because you can access your services anywhere you want with the same address (http://servername:port) and not expose yourself to outside Internet at all. ---------------------------------------------------------------------- mrpink57 · 2023-12-18 05:16 I moved from vanilla WG to Tailscale, actually to Headscale. My reasoning was for ease of use for others, not so much me. Since I self-host headscale and have to set to auth through Authentik a user can just use their standard Authentik login to use my Tailscale services, this makes it a lot easier for everyone. I have no problem with vanilla WG but Tailscale just lowers the bar for others to use. One of the other reasons for my move is I manage three other homes, initially I was creating keys for each location and having to use each config to manage each location, with Tailscale I just have each location connected through my headscale and can just access each home as needed. ---------------------------------------------------------------------- archgabriel33 · 2023-12-18 06:00 I think he means a VPN that doesn't route all Internet traffic to it, just homelab stuff. ---------------------------------------------------------------------- ElevenNotes · 2023-12-18 06:01 https://www.reddit.com/r/GlInet/s/bb4lhNNC3t ---------------------------------------------------------------------- ElevenNotes · 2023-12-18 06:02 Same. Wireguard with over 10'000 clients, SSO/2FA and all the Shenanigans. ---------------------------------------------------------------------- archgabriel33 · 2023-12-18 06:23 I didn't know of this one. So how is it different than Tailscale and ZeroTier? ---------------------------------------------------------------------- TBT_TBT · 2023-12-18 07:14 Zerotier needs about 22 MBytes of ram and almost no CPU. I don’t see how it would be called „heavy“. ---------------------------------------------------------------------- lilolalu · 2023-12-18 08:52 Unless you will be using the mesh part of Tailscale or Zerotier, to connect multiple networks, it has very little advantage over a regular VPN, i.e. via Wireguard. Just to dial into your home network you don't need either. ---------------------------------------------------------------------- FuriousRageSE · 2023-12-18 09:06 >37 > >13.8% > >Cloudflare Tunnels Look at the vote options, and it might become more clear.. ---------------------------------------------------------------------- PhilipLGriffiths88 · 2023-12-18 11:01 You are correct, it doesn't have that capability. Instead, check out OpenZiti. Its a zero trust overlay network, similar to Twingate but it is open source, can be self-hosted, and has a Tunnels equivalent called [zrok.io](https://zrok.io) (which is built on OpenZiti). It can also do more use cases, e.g., zero trust in the LAN or even embedded into apps via SDKs. ---------------------------------------------------------------------- PhilipLGriffiths88 · 2023-12-18 11:01 It takes a much stronger approach and opinion on doing zero trust networking principles for a higher level of security and scale. ---------------------------------------------------------------------- CheebaSweets · 2023-12-18 12:40 Currently Tailscale and only because I was forced to do so after changing my ISP, they now use CGNAT! Previous ISP provided a dedicated IPv4 address and so Wireguard was working beautifully, and it felt super secure. I've seen there are ways around CGNAT whilst being completely self- hosted, but just haven't had the time to set that up and Tailscale seems to be doing the job. In addition, I don't have overly sensitive data to be worried about leaks etc. ---------------------------------------------------------------------- certuna · 2023-12-18 12:42 The main advantages of ZeroTier over the classic roadwarrior VPN (IKEv2/OpenVPN/Wireguard) that I used to run before are * it works when the home network is behind CG-NAT or a firewall * no additional hardening of the VPN server with IP whitelists/blacklists is needed * it works between the clients when the home network is down (i.e. the mesh part) * it removes the tedious admin of cert management * multicast ---------------------------------------------------------------------- hereisjames · 2023-12-18 13:02 Twingate or OpenZiti? Twingate is useful for remote access, as the name suggests it's deployed in a HA configuration and you have granular control on user access by resource and port. It's not designed to expose services to people outside your closed user group, there's no Tailscale Funnel equivalent today OpenZiti is a more comprehensive approach and will require considerably more effort to deploy, but has more capabilities. If you want more direct equivalents to Tailscale : Nebula (or Defined Networks if you want someone else to host the control plane), Netmaker and Netbird (both Wireguard based, both can be fully self hosted or they both have a generous free hosted control plane tier). ---------------------------------------------------------------------- hereisjames · 2023-12-18 13:05 They mean a general way to expose homelab services to the big bad world with relatively low risk. Agreed, their use of terminology is incorrect. They really mean "Tunnels" (as in the Cloudflare product) not "tunnels" (as in the general use of the term). ---------------------------------------------------------------------- lilolalu · 2023-12-18 13:29 Ok: This is /r/selfhosted... So some people here have a certain selfhosting spirit. 1. The reason why Tailscale or Zerotier connect through your cgnat is not because they have some unheard of network magic going on, but because your machines behind the CGNAT dial-out to zerotiers / tailscales servers and are rechable through their public IPs. This means also, all your traffic goes through all their networks. If you you like that idea depends on the trust you put in that companies. Alternatively, in the spirit of self-hosting, you can get a cheap vps and use the VPS' public IP for your selfhosted Wireguard Tunnel. 2. You don't need to harden a Wireguard server, its cryptographically sound, if there is a general bug in Wireguard, it will also affect Tailscale etc since they are based on Wireguard. 3. Yes, the mesh is nice 4. As opposed to what? Cert management has become trivial with acme.sh, it's built into proxies like traefik or caddy. 5. What do you need multicast for, spanning several networks and not only your home network? ---------------------------------------------------------------------- certuna · 2023-12-18 14:01 also deals with VPS topics which are even less strictly selfhosted, this subreddit is a big tent. >This means also, all your traffic goes through their networks. No this is not how mesh-VPN works. The traffic doesn't go through ZeroTier/TailScale's servers. They use a process called UDP Hole Punching to set up peer-to-peer tunnels between nodes, ZT/TS is only a matchmaker in the connection, it's not in between. ---------------------------------------------------------------------- mrpink57 · 2023-12-18 14:13 🫤 ---------------------------------------------------------------------- lilolalu · 2023-12-18 15:37 1. You are talking about the inter mesh network connections, those can be P2P, sure. Traffic routed into your mesh network from the internet will go through a proxy server operated by Tailscale or Zerotiers, thus, through their network and then tunneled to your network. 2. No you not only don't need to harden your VPN servers, it makes little sense. If the crypto of VPN is broken, we are fucked. If you have site to site vpn, you could limit the IP access but the more common scenario is accessing your network from laptops or mobile phones, which will get random IP's, have random MAC adresses, random geographic locations. So what would you want to block exactly? 3. Ok, I don't use Apple stuff. ---------------------------------------------------------------------- nefarious_bumpps · 2023-12-18 15:45 I still use OpenVPN on my pfSense firewall with cert+pass authentication. I'm in the "If it ain't broke don't fix it" camp. ---------------------------------------------------------------------- Ok-Sentence-534 · 2023-12-18 15:57 Using Tailscale, sure it goes against "self host everything!!" however, it's simple and it's what I know and work with daily. ---------------------------------------------------------------------- certuna · 2023-12-18 17:32 >raffic routed into your mesh network from the internet will go through a proxy server operated by Tailscale or Zerotiers, thus, through their network and then tunneled to your network. No this is not how these protocols work. ZT/TS is not a proxy, the root servers only act as a matchmaker for direct connections between the two nodes. It you're interested, you can read up on the details here: [https://docs.zerotier.com/protocol/](https://docs.zerotier.com/ protocol/) . It doesn't even have to be a 3rd party: you can set up your own "moon" (root server) so none of the matchmaking is done by a ZT server. >Ok, I don't use Apple stuff Multicast is not some Apple protocol, it's one of the fundamental cornerstones of IP networking. This is a good introduction if you're interested in learning more: [https://www.catchpoint.com/network- admin-guide/ip-multicast](https://www.catchpoint.com/network-admin- guide/ip-multicast) ---------------------------------------------------------------------- lilolalu · 2023-12-18 17:45 I think we are talking about two different things. The moment you use Tailscale or Zerotier to make services available to THE INTERNET i.e. through what Tailscale calls Funnels, it will go through their proxy servers and their network. Most people use these services for BOTH purposes, exposing services to the outside and dialing into their private network. I think you are discussing for the discussions sake. That is not very interesting, sorry. The benefits of something like Tailscale or Zerotier for a typical Roadwarrior setup are minimal and IF you additionally use them to expose services to the internet, you are trusting their privacy. Both reasons for me not to use either. I would use them if I wanted a mesh vpn but that's not the typical usecase of the majority of users. ---------------------------------------------------------------------- archgabriel33 · 2023-12-18 19:45 1. That's just not true. Your traffic doesn't go through their network. That's true for Cloduflare Tunnels, but not for mesh VPNs. ---------------------------------------------------------------------- lilolalu · 2023-12-18 19:52 Oh so Tailscale funnels magically create a p2p connection between however accesses your services through the internet and your servers? I think there is a proxy server involved and that runs on the companies network. ---------------------------------------------------------------------- archgabriel33 · 2023-12-18 19:54 Only heard of Funnel now. Didn't know this existed and I doubt this is something most homelab people in this subreddit use so not sure why you brought up a relatively niche feature and claimed that's the default way this worse. Also, Funnel is not like a VPN proxy. A VPN proxy decrypts traffic or receives unencrypted traffic. That's not how Funnel works. From the Funnel docs: The device accessing the Funnel site sends a request to the Funnel relay server. The Funnel relay server establishes a TCP proxy to your node over Tailscale. This proxy serves as an encrypted relay between the Funnel relay server and your node. We use a relay server to send Funnel traffic between public devices and your node to ensure your node’s IP address isn’t exposed to the internet. Importantly, the Funnel relay servers do not decrypt traffic moving between public devices and your nodes exposed through Funnel, so Tailscale cannot see any information about the content being served. The Tailscale server on your node terminates the Transport Layer Security (TLS) and passes the request to the local service you’ve exposed through Funnel. The local server responds to the Tailscale server running on your node. The Tailscale server on your node encrypts the response and sends it back to the Funnel relay server over the TCP proxy. Without decrypting the response, the Funnel relay server forwards the response to the user’s device, which terminates the TLS and reads the response. ---------------------------------------------------------------------- archgabriel33 · 2023-12-18 19:57 I did include "something else", but tbh those are not that straightforward to be used on a phone or iPad and I need something that's really device agnostic. ---------------------------------------------------------------------- lilolalu · 2023-12-18 20:15 Ah so it's proxy servers after all and the traffic DOES go through tailscales network albeit encrypted BUT the TLS termination is handled by a proprietary software... That's all I said: if you trust Tailscale and/or you need a mesh VPN, it's a great service. I neither trust them, nor do I need a mesh VPN. And yes I think it applies to most people on /r/selfhosted, at some point they want / need to expose some kind of service to the internet. I.e. so people without Tailscale can also access that services. To access your home network securely through a VPN, it's fairly easy to setup wireguard yourself, without relying on something like Tailscale. If you need to expose services, you can run your own proxy server, and don't have to trust Tailscale. You also don't risk that Tailscale ever decides that their free service is not free anymore. I know that some people actually make use of the mesh vpn that Tailscale provides, but the majority uses it as an "easier" solution for a Roadwarrior VPN and/or proxy servers, admittedly it's very easy to setup. BUT. A Wireguard server is also very easy to setup so are proxy servers nowadays. ---------------------------------------------------------------------- TBT_TBT · 2023-12-18 20:16 „Making services available to the internet“ is however not the standard usecase, you smarty pants. Both of you are right: - Using TS/ZT to mesh connect devices in a private network (AKA THE STANDARD USE CASE!), the traffic does not touch TS/ZT servers, they only do hole punching. - If Funnel (Tailscale) is used (AKA >>NOT<< THE STANDARD CASE), their server are indeed the proxy and traffic flows through their servers. It however is still SSL encrypted, most of the time. ---------------------------------------------------------------------- lilolalu · 2023-12-19 06:15 Just browse this subreddit and take count on how many people want to or already connect services to the "outside" using Tailscale. It's interpreted as a magic vpn tunnel proxy thingy and that's how it's used. ---------------------------------------------------------------------- kweglinski · 2023-12-19 08:47 I don't have the public IP so I have to use tailscale. I've tried zero tier but it had serious problem on phone when switching between mobile and wifi network I had to wait ~30mins to see my devices on vpn. Tailscale doesn't have this issue. Also restrictions are much easier to apply. Right now in the process of setting up a small vps to run wireguard and couple public facing websites. ---------------------------------------------------------------------- TBT_TBT · 2023-12-19 08:51 No. TS and ZTs USP is the hole punching part, which helps those CGNAT guys and the easy configuration. The mesh part (to be able to access the servers@home) is indeed the standard usecase. ---------------------------------------------------------------------- lilolalu · 2023-12-19 09:19 Omg, do whatever you want but don't pretend it's rocket science what they are doing. "Hole punching" is not blackmagic but it means their proprietary directory server, which is publicly reachable (and is probably logging incoming connections and IP's) connects your non reachable servers behind CGNAT and allows incoming connections. A 5€ vps can do the same "magic". ---------------------------------------------------------------------- TBT_TBT · 2023-12-19 09:25 …but it does its magic without the need for a 5$ VPS, the free tier is very generous. So its free and easy vs needing a monthly fee and being more difficult. That is the point for most people. Many people wouldn’t pay those 5$, many people wouldn’t know how to set that VPS and Wireguard up. I have more than 5$ VPSes and the knowledge to do it. But still I prefer the easier tool. Use what you want but don’t judge other people for doing it differently. ---------------------------------------------------------------------- lilolalu · 2023-12-19 09:37 We are discussing this in /r/selfhosted where the general spirit is not to rely on the privacy or reliability of commercial external service providers.. But apparently with the exception of Tailscale (or Zerotier) and Cloudflare. Who offer a free tier which they can cancel at random, start charging money etc. Instead of using the same idea of a mesh VPN, if you want or need that (which most don't because they are using the mesh vpn like a Roadwarrior vpn) but self hosting it (oh there are plenty of options: netbird, nebula, tinc etc.pp.) people go to extreme lengths explaining why using THESE commercial services is ok and that they provide something you couldn't possible do yourself... And that's BS. Like I said, do as you please, just dial down on the fanboy rhetoric by pretending there is some network magic happening. ---------------------------------------------------------------------- TBT_TBT · 2023-12-19 09:41 Dude, the spirit of this subreddit is: „do what works for you“ and not „you have to self host everything religiously“. If free tiers are not available anymore, people with switch regardless. ---------------------------------------------------------------------- PhilipLGriffiths88 · 2023-12-19 09:47 /u/lilolalu /u/archgabriel33, for Tailscale default is p2p connections unless not available (e.g., NAT, or ISP blocks UDP), then connections are facilitated via DERP. I understand these DERP connections are more common than expected. ---------------------------------------------------------------------- lilolalu · 2023-12-19 09:52 Google Mail and Photos works great. Dropbox works great. Tailscale works great. They are all phantastic services that would work for me but still I don't use them. So I think you and me have a different reasoning for self hosting. ---------------------------------------------------------------------- TBT_TBT · 2023-12-19 09:53 Yep ---------------------------------------------------------------------- krakrakra · 2023-12-31 11:12 This sounds what I want, but what happens if the VPS is compromised? Will the attacker have access to the Wireguard network or is there a way to make the VPS act as a blind dumb relay?