Comment by lolinder

What makes Tailscale more secure, or more reliable, than just a direct Wireguard tunnel?

Tailscale's complexity and features make sense when you have 200 nodes, or maybe 20 nodes at least. When you have 3-5 nodes, I think it's overkill, and a bunch of extra dependencies which may fail, and lock you out of your private nodes when you need it most.

> If you aren't comfortable with trusting them with control over your network

Wrt the possibility of Tailscale being compromised, there's the in-beta tailnet lock feature:

> Tailnet lock lets you verify that no node is added to your tailnet without being signed by trusted nodes in your tailnet. When tailnet lock is enabled, even if Tailscale infrastructure is malicious or hacked, attackers can't send or receive traffic in your tailnet. [1]

[1] https://tailscale.com/kb/1226/tailnet-lock

Or, for those who are paranoid about relying on a company, setting up headscake is relatively quick and painless too - currently using it to sync between devices across multiple cities.

Tailscale is a VPN, how is it "better" than using a VPN?

Unraid added native Tailscale support in 7.0, now you can just add an "app" (a docker container) and tick a checkbox and it'll appear in your tailnet directly.

For the most part I like Tailscale, but there's weirdness on Android with their app + Private DNS.

or zerotier

How did you automate it to start on networks which are not yours?

This is like the only piece of the puzzle for me.

I have wg into home and wg into an aws instance. All my mobile and laptops can reach them.

On Android devices? If so: how? :)

It doesn't need to be an exit node unless you want to direct all traffic through that node, like a traditional VPN.

The beauty of Tailscale is that it will only direct traffic to a node that is meant for that node, everything else goes via the internet.

I think what they meant is that if it's hosted online / home-network, only allow access to all services through a VPN. Wireguard is relatively easy to setup, and you can configure all your services to only be available through wireguard.

Ever since ssh almost got backdoor-ed, the only thing "exposed" on my servers is Wireguard, which is UDP based and therefore harder to know if it's running. SSH also goes over wireguard.

Although not perfect, I added a couple features to help ensure uptime:

* LAN components are on a UPS, helps keep continuity between power blips and breaker flips

* Dynamic DNS, cron runs a script 4x per day to ensure a DNS name points to my IP, even if issued a new one by the ISP

* Rebooting everything occasionally to ensure the network and services come back up on their own and I didn't make a mistake with some config that loads at boot, etc.

Ssh exposed on a non-standard port, with root disabled, using key-based auth should be pretty non-controversial.

The security through obscurity (non-standard port, no root) are both kinda silly but why not.

That said, with awesome services like TailScale, it's pretty hard to get locked out of your network. TailScale is so so good at "just working".

These solutions are composable. Just run it on a VPS over a VPN.

You can also enjoy your vacation instead :)

You can fix them both in one. In your local network you host a local DNS, in my case I’m using pihole. It has records which point to the local IP of a reverse proxy. With this setup you can have SSL for your domain names on your local network.

To make it then work outside your local network, in tailscale settings you use “split dns” to set your DNS to be the IP of your pihole in the tailnet for your domain. Now when you try hit your local domains you should receive the same local IPs that you do at home. Then in the tailscale route settings of your machine hosting the reverse proxy you make it advertise the subnet of those local IPs. Now when you receive the local IPs your devices using the tailscale VPN should go to your home server with SSL and no external DNS.

Hope that’s somewhat clear enough

There is a solution for the first. I have setup my home server torun Tailscale _and_ be a router to 192.168.2.x network (you can set this up in the Tailscale UI). I have server.mydomain.com to resolve to 192.168.2.x address and this way I can access it from the outside via Tailscale and from inside without the need to turn on Tailscale. I have https setup via DNS-01 challenge as well and updated automatically.

In my case I simply create two wireguard tunnels (one called "vpn", the other called "guest") and use firewall rules to block all traffic from the "guest" tunnel to all service except the one that should be "public" (in my case a minecraft server).

I think you could technically do it with a single tunnel by using firewall rules that refer to the IP address of the single peer but it's less convenient.

NOTE: I also added a dedicated dnsmasq instance only for the "guest" tunnel so that they have DNS working and can use hostnames instead of IP address.

This setup is trivial with both OpenWrt and OpnSense, but it should be doable also with manual setup

You can do this on tailscale with their ACL. It is super flexible for nailing down exactly which users/devices can talk to what on your network.

Yeah, definitely don't do turn off auth for things that matter, if only because I'm not perfectly disciplined at keeping my guests off my main network. I'm talking about tiny services that do one thing—ollama, tts/stt, and similar. Stuff where the worst case scenario is someone using up some processor cycles, not data leaks.

I'm not running a business, I'm running a home. The threat models are totally different and I adjust my security posture accordingly.

Besides, I don't bother with auth for simple services, not stuff that actually hosts data. If someone unauthorized is inside my network they're not going to be interested in using my TTS/STT service or in finding out the last barcode I scanned or in using my tiny consumer GPU to generate tokens on an LLM—there are way worse things they could be doing at that point than fiddling with the many tiny services I have set up.

Also: I couldn't set up so many silly, inconsequential services if I didn't have a VPN. With my setup, every new idea I have can be a quick service on my network accessible by me anywhere in the world. If I had to expose each of these things to the internet I wouldn't bother running them at all lest they have an exploit that ends up being an entrypoint into my network.

You need to understand your own risk tolerance and, more importantly, effort/resource threshold. Zero-trust is great if you have the resources to put to it, and companies should do it. But individuals trying to manage multiple companies worth of services, alone, on their own network? There's going to be corners cut.

That's a comically uncharitable extrapolation on what was said.

self hosting is entirely different than enterprise security practices. You're a little out of touch with reality if you don't realize this.

I'm being serious - please educate us, how do you think that we can do better in a homelab setting? How do you apply zero-trust principles in homelab environment with reasonable effort and without relying on 3rd party services?

Any serious approach to security begins with a reasonable and clearly defined threat model, and my threat model for my home network doesn't currently include a team of superheros targeting my file backups in an effort to save the world. But I'll definitely keep your advice in mind when I do decide to start executing on my evil plots.

For now my threat model consists of script kiddies and abusive corporations. Self-hosting gets me away from the corporations and keeping my stuff off of the public internet keeps me away from script kiddies.

> There's plenty of well-written explanations for why perimeter based security doesn't work

It certainly helps when your attack surface consists of numerous web apps of unknown quality.

Drive-by RCEs (e.g. log4j) then suddenly become much less of a headache when none of it is reachable by the world at large.

Exactly how you do that, whether via an authenticating reverse proxy or VPN doesn’t really matter.

Could you provide an example of one of the well written explanations?