Tailscale Blog

I recommend checking out Caddy <https://caddyserver.com/>, which replaces both Nginx and Certbot in this setup. Tailscale <https://tailscale.com/> can remove the need to open port 22 to the world, but I wouldn't rely on it unless your VPS provider has a way to access the server console in case of configuration mistakes.

Since last year I’ve been configuring and maintaining my homelab setup and it is just amazing. I’ve learned so much about containers, virtual machines and networking. Some of the self hosted applications like paperless-ngx [1] and immich [2] are much superior in terms of features than the proprietary cloud solutions. With the addition of VPN services like tailscale [3] now I can access my homelab from anywhere in the world. The only thing missing is to setup a low powered machine like NUC or any mini PC so I can offload the services I need 24/7 and save electricity costs. If you can maintain it and have enough energy on weekends to perform routine maintenance and upgrades. I would 100% recommend setting up your own homelab. [1] https://docs.paperless-ngx.com/ [2] https://immich.app/ [3] https://tailscale.com/

I would recommend trying to set up tailscale[0] in the servers instead of a VPN, its similar to the reply about SSH ProxyForwarding but it has a lot more tricks under the hood. Of course you need somewhere (aka an AWS server in eg. europe) to connect to. Also have a look at their blog post about NAT traversal for some potential inspiration: https://tailscale.com/blog/how-nat-traversal-works/ Good luck out there! I'll have a look at your github repo now. [0]: https://tailscale.com/

I do something similar with the subsonic protocol by locally hosting Airsonic[0] and listening with Strawberry Player[1] on Desktop and iSub[2] on iOS. Using Tailscale[3], I'm able to stream my library on the go. Best part is that all this infra is free and pretty hands-off maintenance-wise. [0] https://airsonic.github.io/ [1] https://www.strawberrymusicplayer.org/ [2] https://isub.app/ [3] https://tailscale.com/

If you like this, you’re gonna love Tailscale https://tailscale.com/

Tailscale (https://tailscale.com) is a great solution for this use-case. It's also just an absolutely excellent experience overall and I can't say enough nice things about it.

> I also need to figure out how to install Wireguard on my router to allow to access my NAS from my phone while on a trip, but that's another story. I can recommend https://tailscale.com/ It just works.

While perhaps less portable (and a bit more proprietary) it's worth checking out the new project of Avery Pennarun, better known as apenwarr -- the creator of sshuttle -- which has made the rounds here, Tailscale [0]. I've switched all my devices to it and frankly, it's wonderful. Private VPN, tunnel, VLAN, auth, sharing, all-in-one. 0: https://tailscale.com

Regarding ZeroTier, these days I recommend using tailscale [1] instead. Much simpler setup, easier to understand, and likely more secure since it's just built on top of Wireguard (vs. layers of custom protocols). You do trade-off some of the more advanced features, but those are hardly used for this use-case anyway. [1] https://tailscale.com

If you are looking for cross-platform FOSS P2P, ProtocolLabs' (makers of IPFS) https://libp2p.io (P2P conns over TCP, UDP, QUIC, WebSockets, WebRTC) with implementations in various languages (Go, Rust, JavaScript) with varying degrees of features is great to have in the toolbox, as well. Unless of course you're sold into a solution like https://tailscale.com, who I believe are readying a userspace embeddable implementation of their P2P mesh wireguard overlay network, which then would be a compelling alternative, too, in the not so distant future, especially because of its security posture (though only the clients are FOSS).

For those that find this interesting, I highly recommend Tailscale (https://tailscale.com).

Worth taking look at http://tailscale.com - Their tag line: Private networks made easy. No affiliation -- just like their product.

I think Tailscale [1] can be to WireGuard what Github and Gitlab are to git. If you haven’t checked them out yet: worth taking a look! [1] https://tailscale.com

This is what we (https://tailscale.com) are working on! WireGuard is incredible, but adding some key management (that integrates with your IAM system) and NAT traversal really helps to round things out. I'd love to hear suggestions and feedback on what we're building.

If you do your work in VSCode you can setup the following pretty easily and it works really well (I use it to connect to my workstation in my home office when I work in a coffee shop on my laptop or the rare occasions I go into the office): 1. Install Tailscale (https://tailscale.com/) on your laptop and workstation and enable the "MagicDNS" (https://tailscale.com/kb/1081/magicdns/) feature. This sets up a VPN mesh between your machines (and any other you add). 2. Setup you SSH keys so you can login via the "MagicDNS" domain name from your laptop to your workstation. 3. Install the VSCode Remote Development extension (https://code.visualstudio.com/docs/remote/remote-overview) on your laptop and then open a workspace on your workstation via its SSH feature using the "MagicDNS" domain. It is surprisingly fast - you are just sending keystrokes/commands over the VPN and not rasterizing the host screen like you would with VNC.

Increasingly these days I'm thinking: the M1 MacBook Air holds up very well, but I also want to use Linux: why not both? My biggest problem with Linux / BSD is the GUIs. I don't know why but whenever I use a Linux desktop, the mouse either moves too fast or too slow and there's no sweet spot. The GUI keyboards shortcuts are all messed up: I love the "⌘" (super) key because then ⌘C is copy everywhere, and ^C is an interrupt in the terminal. I have ⌘← , ⌥← , ⌘⌫ , ⌥⌫ , ⇧⌘← , ⇧⌥← ingrained in my memory (for moving, deleting, and selecting by line or by word). I have fussed with remapping keys but there's always that one app that won't cooperate. So why not both: shift down from a single the top of the line 16" MacBook Pro to a MacBook Air, and then pair it with a desktop running Linux that I SSH into over LAN. - LAN internet speeds are fast enough that I don't notice any latency. - I'll have convenient access to both Linux and macOS, for testing. - I can spec up the Linux desktop as much as I want. It could even have a Threadripper. - The MacBook Air will have better battery life than any Linux or BSD laptop. - I can use Tailscale[1] to set up a no-fuss VPN, so that I can still SSH to it even when I'm not on LAN. - All the GUIs will still be macOS, so things like mouse speed and keyboard shortcuts will all be familiar. It might even net out to be around the same price. My 16" MacBook Pro was like $3,000. An M1 MacBook Air would be $1,500 (with some storage and memory),…

I lead the customer engineering org at Tailscale. We think this is a great idea and we're discussing internally potentially adding that to the console. In the meantime, if you'd like to get an assessment, please feel free to open a support ticket (https://tailscale.com/contact/support?type=other&subject=security%… and we'll happily take a look

Host your own VPN with WireGuard https://www.wireguard.com/ Tailscale is a commercial solution with centrally managed clusters based on WireGuards point to point tunneling https://tailscale.com/ NordVPN is based in Lithuania. https://nordvpn.com

Tailscale have a great FAQ about IPv4 vs IPv6: https://tailscale.com/docs/reference/faq/ipv6 If you're not an expert in this area it's worth a read - I certainly learned a few things!

Other than for the remote desktop part, Tailscale [1] smooths out a lot of this and has a nice access control scheme. I've been a happy user both at the homelab scale and within bigger orgs. [1] https://tailscale.com/

Not really, look at a great post on Tailscale blog how such P2P connection can be established: https://tailscale.com/blog/how-nat-traversal-works With IPv6 you might have to use a hack to make firewall allow incoming packets (like sending a dummy UDP packet to the peer first). The firewall only read, allow or deny these packets. While NAT must mess with the message IP//TCP//UDP headers to work.

For anyone who thinks IPv6 is without merit, I recommend reading up on the various challenges of NAT traversal [1]. In cases where CGNAT is deployed in particular, there are scenarios where the only way to make everyday P2P connections work is to route traffic through a 3rd party - which can impact latency and bandwidth. While IPv6 doesn’t make establishing a P2P connection trivial (there are still firewalls to contend with) - it does simplify things dramatically. And as someone who is behind CGNAT, I am very grateful for the existence of IPv6. [1] https://tailscale.com/blog/how-nat-traversal-works

$3 VPS running Headscale is not simpler since you won't be able to run both headscale and tailscale on your end user machines, I don't recommend it. The solution we've found is running a white IP container (or VPS) which looks like regular Wireguard outside, while inside it "forwards" to your existing tailscale network. I don't remember if we use https://github.com/gravitl/netmaker or https://github.com/juhovh/tailguard Also see: https://tailscale.com/blog/peer-relays-beta

I did not intuitively understand what Tailscale does, so I visited the following related page: https://tailscale.com/blog/how-tailscale-works Ah! OK, now I get it! :-) But, what found particularly interesting on that page was the following: >" Some especially cruel networks block UDP entirely , or are otherwise so strict that they simply cannot be traversed using STUN and ICE. For those situations, Tailscale provides a network of so-called DERP (Designated Encrypted Relay for Packets) servers. These fill the same role as TURN servers in the ICE standard, except they use HTTPS streams and WireGuard keys instead of the obsolete TURN recommendations." DERP seems like one interesting solution (there may be others!) to UDP blockages...

Tailscale spy on all of your traffic/behavior by default, so this isn't a great recommendation to people who used NordVPN for privacy reasons without the disclaimer that they will need to opt out of Tailscale's spying by setting a special environment variable on every single machine in their Tailnet: https://tailscale.com/kb/1011/log-mesh-traffic “Each Tailscale agent in your distributed network streams its logs to a central log server (at `log.tailscale.io`). This includes real-time events for open and close events for every inter-machine connection (TCP or UDP) on your network.”

The fact that most new programming services and products are oriented towards C-suite types, and not to the people who actually use them. Most websites looks like [1] or [2] which are full of corporate-friendly buzzwords but don't help me understand what they actually do or how they work. To get a concrete understanding I need to go to github and find repos that actually use the product to even understand what it's for. [1] https://www.astronomer.io/ [2] https://tailscale.com/

I understand adding the "AI" keyword is just SEO, like adding "Reddit" to article headlines... It still leaves a bad taste, even if the main course is excellent. Even the diagrams for API vs AI gateways are almost identical. <https://tailscale.com/blog/ai-normal>

Probably gets pretty costly if you’re running a lot of data through it. Now if you could implement a Tailscale DERP server in a lambda that would be pretty amazing: https://tailscale.com/kb/1232/derp-servers

Yeah this is all great feedback, thanks. Makes sense about the env var! On the second item- this is interesting. I definitely see the reason for asking :) We actually don’t use SSH keys for Tailscale SSH, since the auth is handled within Tailscale (more info at https://tailscale.com/kb/1193/tailscale-ssh#authentication-and-authori… I’ll think more about this. Do you have a break-glass setup with a normal SSH key for this today?

Headscale creator here. > Fun fact: Tailscale have an almost-assuredly-accurate count of Headscale users due to how few people disable the Tailscale client's telemetry which by default sends them real-time events about everything you do on a Headscale network. See KB1011: https://tailscale.com/kb/1011/log-mesh-traffic That is not true. We actually instruct all the clients to send no logs - since at least three years: https://github.com/juanfont/headscale/blame/main/hscontrol/types/confi… And also in the config example: https://github.com/juanfont/headscale/blob/main/config-example.yaml#L3… That said, I would have loved to know how many nodes use Headscale... :)