2y ago

Recommendation: Tailscale VPN

I have been using Tailscale VPN with my servers for about 6 months now and I would recommend it to anyone.

I'm running it on both of my Proxmox machines, my laptop, a raspberry pi, and my Android phone. It makes it super easy and secure to access my local services while away from my house.

Very simple set up, minimal initial configuration, and versatile.

There are apps for Linux, Windows, Mac, Android, and iOS.

Is anyone else currently using Tailscale? I'd like to hear what you all think.

62 comments

One common criticism about Tailscale is it has too many features for a networking product, which increase the likelihood of bugs that can lead to security compromise (e.g. Tailscale SSH ), especially when compromised tailscale network means the malicious actors have full access to your internal network.

It's not self-hosted, I refuse to use anything that relies on any third party
- Check out Headscale, pretty stable on my end
  
  Does using headscale reduce the available functionality in any way? I read Tailscale's AMAZING article on NAT traversal and was wondering if that was impacted by moving to headscale in any way. Does headscale replace DERP too?
- You could checkout a very similar product, ZeroTier (Open Source Community Edition) assuming your use case is non-commercial.
  ... if you're willing to use an older release, you could potentially do whatever you want as the software uses a BSL license with a change date fallback license of Apache 2.0.

What is the benefit of this over just running Wireguard?
- It's a mesh network unlike plain Wireguard, and it's much easier to set up (with the caveat that there's a third party involved to coordinate connections and stuff)
  
  I still don’t fully understand the benefit over plain WireGuard for a home lab use case…
  I set up wg-easy (WireGuard socket container with built in web interface to easily generate certs for clients) in about 5 minutes on an odroid (like a raspberry pi). Opened a single port on my router. Generated certs for my phone and laptop using the web interface in about 30 seconds. Changed one line in my client configs to only route network on my home’s IP range over the VPN so I can connect without disrupting my internet connection. Then I just activate the VPN and I can access all of my home services. (writing all that out kind of makes it sound complicated but literally this was done in like 10 minutes total and never had to touch it again except to log into the web admin to make certs for new clients occasionally)
  Since Tailscale is a mesh VPN like Nebula, wouldn’t I need to install and set it up on all of my servers and VMs instead of just one to access everything? And then every new VM I make I would have to manually set that up too? Wouldn’t that be harder to setup over all than a single wg-easy container?
  I feel like maybe I don’t fully understand how Tailscale works because it never seemed more convenient or better than vanilla WireGuard and it just uses WG protocol under the hood anyway but with the added dependency of a 3rd party service I have to trust and that can go down disabling my access to my home network…
- Elegant, easy to use web based admin panel. Google authentication. Exit nodes (routing all traffic through a peer). Subnet routes. Funnels. It's the best tech I've used lately.
- The main benefit is it can punch thorough double NATs. Can't use wireguard if you can't even see your wireguard server when you have a shitty ISP that put their customers behind CGNAT.
  
  Not trying to defend CGNAT because I hate it, but as someone who works for what most of you would consider a "good ISP", we use it simply because don't have enough IP addresses to do 1:1 NAT for every connection, and buying the amount of IP addresses required to do so would literally cost us somewhere in the neighborhood of ~4 million dollars - on top of the headache that we don't know the history of these IP addresses which could cause issues if they are on blacklists, etc.

It's not self-hosted but it's incredibly useful for self-hosting as it makes public access to locally hosted services a breeze. It's user-friendly, feature-rich and scalable.
- U can use headscale and make it pretty much 100% self hosted
  
  I hope it becomes easier to deploy for less techie users.

I tried it, its great if you want to get started. or you want to run a vpn on a server that doesnt support wireguard. My main gripe with the client is that it can't do high speeds, it's just too cpu bound. Like going close to a gigabit transfer.
With wireguard I was able to get to 98% gigabit transfer. It was fine for a month I was using it, in the end I just setup a wireguard mesh with Netmaker.
There is headscale where you can run your own hosted central server, so you're not using the tailscale one.
In the end netmaker did what I wanted, however they tend to introduce bit of changes in their releases, so if you're not super technical it might pose a challenege with upgrading until they reach a super stable version. Like jump from 0.10.X to 0.20 had some big changes for the whole netmaker internals. Bit that does not impact wireguard connectivity.

I like it, but it consumes copious amounts of battery on my Android phone. I only use it for 1) ssh and 2) services that I don't want / need to be accessible over the Internet (admin tools)
- I run pivpn with wireguard alongside tailscale for this exact reason. Wireguard in the phone, tailscale on PCs.
  
  If you already have to setup and maintain WireGuard, what’s the added benefit of Tailscale for your use case?
- I have the same issue with 1.1.1.1 and cloudflare tunnels. It really kills my battery
- you use tailscale for ssh instead of termux?
  
  I didn't know what Termux was before this
  But if it's ssh on Android, I use Termius (which I haven't used all that much tbh)
- It does. I only turn it on when I need it.

I run a single headscale node on one of my free Oracle OCI instances, and connect about a dozen devices to it. No fear of adding friends either, since it's free.

I'm sat behind a CGNAT for my home internet, so I can't really forward ports in. Tailscale has been great as a free thing to let me get a quick-and-easy VPN set up so I can remote into my network reliably.

That's awesome to hear. I'm looking to set up some self-hosted stuff, and I see a lot of recommendations for Tailscale for the VPN element.

Isn’t tailscale just a company abstracting over a more barebones VPN? I haven’t looked into it, but want to operate a VPN into my home network in the future.
Why would I choose tailscale over just selfhosting wireguard?

This looks like a paid business vpn.. are you even hosting it? I don't get it
- If you want to self host, you can run the API server yourself with headscale.
  
  I didn't actually know this. Now I won't get anything done on my honey-do list this weekend...
  
  Neat
- The free license is so generous that a home user really should have no reason to ever pay for it.
  are you even hosting it
  No but as andrew mentions below you CAN self host it.
- It's free for personal use, although they offer paid versions for enterprise. It's built using Wireguard, so there is a coordination server that's accessed using the web app, but all the traffic is encrypted from client to client.

I was using this for a bit actually, only reason I stopped was the network filters at work broke it...but I might try headscale down the road to see what that does....

I was using tailscale to transport files between devices quickly but I got an email about a vulnerability that leaked some info. I don't even use it for the vpn part so I just made a protal on a vps that I use now for file transfer. Tailscale was pretty fast at that though, and they were open about the exploit, so I think they're pretty cool.

I prefer ZeroTier, I'm not sure why Tailscale has taken off so much in recent years (perhaps just the cleaner UI and better marketing).

62 comments