Tailscale or Wireguard, or some combo of both reddit / selfhosted ---------------------------------------------------------------------- apperrault · 2023-12-28 19:45 Hey all I have been self hosting for a while and i use it as my decompression and mind clearing activity. For a while I was a Wireguard guy, and it worked great (99% of items I connect to are Linux based so I don't mind console access and doing most things command line. Then a couple of years ago I heard about this great new thing, Tailscale. I could install it on each of my devices, including my NAS appliances, and connect without any additional software on the system I am on. I have been doing some tweaking of things in my self-hosted environment and started to notice that DNS was being wonky, and Tailscale kept taking over DNS on some of my systems, so when I was inside my home lab I couldn't connect to things internally with DNS. I then started turning off auto DNS in Tailscale. This got me to thinking, do I really need tailscale on EVERY machine in my lab? Do I really need tailscale at all? Can't I just connect via self-hosted wireguard and SSH to all of the other machines? I find myself using wireguard over tailscale more and more, should I abandon tailscale in general, or maybe keep it installed on one machine to use as a back door in the event of a container failure? What do y'all think? What do y'all do? app ---------------------------------------------------------------------- EndlessHiway · 2023-12-28 21:01 Tailscale is Wiregaurd. ---------------------------------------------------------------------- apperrault · 2023-12-28 21:04 True, u guess I'm talking tailscale software or self-hosted wireguard ---------------------------------------------------------------------- zfa · 2023-12-28 21:19 With correct routing you should only need WG on your mobile devices and one device at home (router?) to be able to connect to everything. Providing you don't have an issue with having to navigate tricky NAT traversal, and are happy having all traffic go through that one home WG peer then TS isn't really adding much to your use case. ---------------------------------------------------------------------- Duff4321 · 2023-12-29 00:13 You could do what @zfa suggested and have a WireGuard endpoint to have access your whole local network. Or do the same with Tailscale . I have one machine that I have proxmox on and I created an lxc whose only job is to serve as my Tailscale subnet router. That way I can access my LAN by turning on Tailscale on my client device wherever I am, be that my laptop, phone, etc. I then turn off Tailscale when I don’t need local access, but it’s effectively a split tunnel so I could leave it on all the time and it should only route to my LAN when trying to access things on my LAN. Normal internet traffic will use whatever internet connection I have (lte, Wi-Fi) for my location and not route through LAN. ---------------------------------------------------------------------- dually · 2023-12-29 04:20 The problem that tailscale solved can be worked around using just wireguard. OTOH, you wouldn't want to use tailscale for all the different scenarios where a wireguard vpn is useful. Therefore I use only wireguard for the sake of simplicity. ---------------------------------------------------------------------- shzient · 2023-12-29 08:06 imo tailscale real advantage is when your ISP is using cgnat and thus you are not able to port forward your wireguard port, you will have to use tailscale as they implement NAT traversal. Another scenario is you do not want to expose any port for security reason, then tailscale is also an alternative.