Comment by wrxd
14 hours ago
I like Tailascale as a product but I decided to move my homelab to plain WireGuard.
I wasn't using any of the additional features, I can get away with exposing a port on my router and I am changing devices rarely.
News like this make me happy I removed a lot of complexity and attack surface
> I can get away with exposing a port on my router
using wireguard is awesome, but I wouldn't say deploying and maintaining it lacks complexity exactly. and you didn't get rid of attack surface, you just made it your responsibility ;)
Always is your responsibility even with tailscale. Now it is his responsibility without tailscale.
Attack surface almost entirely goes away if you just require a good port knock first! I do that with my protection SSH servers and it works just fine. Also prevents anyone from knowing there even is an SSH server there. Or any server if it doesn't respond to pings either, and only uses reverse tunnels to accept public connections
Wireguard doesn’t respond to malformed packets or handshakes from unknown devices by design.
1 reply →
Is there a way to automate port knocks in your .ssh/config? I think that’s the main reason why I haven’t added it to my home server.
1 reply →
Port knocking is idiotic and amounts to Biff Tannen's "only I know how to start this car".
14 replies →
With AI, the complexity doesn't really matter anymore. Codex or Claude can easily configure complex site-to-site setups and peer configurations on mobile devices. I did this by hand before and it was hard and difficult to get right. Now I just tell AI and it does so perfectly, checks and verifies things. AI made life so easy.
No amount of claude can handle the key thing that Tailscale fixes about wireguard, all of the connection to connection logic is handled be it direct, via all sorts of weird hole punching or via relays. Wireguard itself is horrible to do this with, half the time you're just looking at `wg status` wondering why the packet counter isn't incrementing today. It can never achieve the magic that is a direct connection between plane wifi and a host that's behind NAT on the ground.
7 replies →
This is true, but I still wouldn't discount the possibility of mistakes. It's good to know how your home network works. Even Opus 5.5 can make some pretty dumb mistakes, particularly if it doesn't have the full picture.
1 reply →
I would not personally expose my devices over a VPN that I self-hosted and set up purely through AI unless I felt like I understood how it worked completely. But that's probably just personal paranoia.
1 reply →
It makes no sense at all to configure a >3 nodes wireguard setup with straight wireguard.
Wireguard is the building block for higher level tools like Tailscale to build on.
From the sounds of what info they felt was safe to provide, this wouldn't have impacted you anyway.
Don’t think that refutes their point.
On the road I find WireGuard to be quirky when connecting to DNS names. When I'm on an IPv6 only network (like T-Mobile), connecting to a DNS name that offers A and AAAA, WireGuard on iOS prefers the A record, making me connect over one of T-Mobile's 464XLAT proxies which time out after x minutes. This then makes the connection look dead until I do something on my phone that re-enables it.
Tailscale doesn't have this issue.
Using anything on top of wireguard or plain? I heard headscale adds a nice layer
I use plain WireGuard. My use case is very simple: I have a server and a few clients (phone, laptop) I want to connect to the server when I'm away. I don't care to have VPN connectivity between my phone and laptop
You shouldn’t open a port on your router.
Connect from your home to a public VPS and connect your public devices to that VPS.
What's the advantage of adding a VPS to the mix?
Having a VPS gives you a static, non-shared, stable IP with a whois that doesn’t resolve to a residential ISP.
Lot’s of ISP have moved to CGNAT where port forwarding has become a nightmare. That’s one reason. You can look at it as if your router moved from your home behind a public CGNAT, dynamic, shared IP to a public non-shared, static, stable IP on the internet.
In a workplace setting, connecting to your residential IP will raise suspicions or alarms. That being said, if you go for a cheap VPS, it also might raise alarms. Maybe your 'VPS' should be with whichever cloud provider your employer goes with so you don’t even register as a blip.
It is added complexity, but it is really very simple. Using Wireguard, you connect from a always on server in your home to your VPS. Then, using Wireguard, you configure your laptop to always connect to your VPS. Any local LLM can generate the wg-quick config files in seconds.
Also, not opening a port has become a security checkbox. If your home router isn’t a hardened Linux box, why would you prefer to let a ASUS 'WiFi Router' handle that critical networking function instead of a Linux box you can easily update and audit?
BTW, netbird is a cool alternative also
I prefer it too and I like that it's 100% open source. Server, client, everything. Pangolin also looks interesting if you don't need a full vpn. And if you go that way, Authentik with its embedded proxy is also worth considering.