Skip Navigation
technology @hexbear.net wheresmysurplusvalue [comrade/them] @hexbear.net

Do you use a mesh VPN?

Recently I've been reading a lot about the topic of mesh VPNs (tinc, Nebula, Tailscale, ZeroTier, Netmaker, Netbird, etc) and find them pretty interesting. Is anyone here using these in some capacity at home or maybe at work?

My problem so far is that many of the options seem to be aimed at corporate use, understandably, so the developers can earn enough to keep doing it. This means the focus is on a centralized control plane, one server which knows everything about the entire network and manages firewall rules for all of it.

This is why I'm leaning towards Nebula, since I think the decentralized design just makes more sense. There is some centralization for issuing certs though. How do I go about setting up PKI? Is there some open source solution for managing certificates and automatically renewing them?

There's also the option of using vanilla WireGuard. This is my current setup, but I really like the idea of meshing, since it means I don't need to care if my devices are physically on the same network or not, the best connection will be used. Basically the layer of abstraction is a nice convenience that lets me think about hosts or services independently of the physical network topology.

I'm interested to hear your thoughts on this topic! What's your setup like and what do you use it for?

16
16 comments

  • I generally steer clear of anything like it because it makes your network less secure. Only one device or server, even remote ones, needs to be compromised and suddenly the attacker can see your internal network. The only exception is that I occasionally enable wireguard for travel so that I can access my network from a single external device.

    What's your use case for wanting a mesh network?

    • Good feedback, thanks. Making sure all my devices are properly firewalled is another concern of mine, since all this NAT traversal stuff is basically a way to bypass firewall rules which are there for a reason. I think most of these solutions have firewalls/ACLs built in. But it does mean that I would rely on their firewall implementation and can't switch it out for something else.

      My use case is I'm hosting a number of services on machines inside my home LAN, and also a few services on a VPS. Two family members use a few of the services hosted in the LAN and on the VPS. For things inside the LAN, for now I've given them WireGuard credentials to access them, but this gives them full access to my LAN. On the VPS they can access a http server from the public internet.

      I also travel a bit, so I connect via WireGuard to encrypt my traffic and have access to my LAN services at the same time. Tailscale offers "exit node" functionality which seemed to work when I tried it.

      So my main goals are:

      1. Encrypt my mobile traffic through a secure tunnel back home, no need to pay for or trust a VPN provider
      2. Ability to give users role-based access to my privately hosted services from anywhere
      3. Close almost all ports on all machines including the VPS, no publicly hosted services at all (maybe not even ssh)
      4. Simplify access to my services in general. Generally just want to be able to e.g. type the same URL and access a service, regardless of whether I'm at home or on a public network. But there are probably other solutions for this point alone.

    • If you're firewalling you can reasonably secure things but it becomes more complicated quick because you need one in front of each end point or else it's all being filtered centrally which defeats the decentralization

  • What's your use case? I can't really think of what I'd do with a mesh VPN at home

    For PKI I think you can automate it using certbot and Let's Encrypt

    • Just wrote up my use case here

      These certificates are custom certificates generated for Nebula clients, I don't think Let's Encrypt can issue them. In this case I have a trusted machine at home which acts as a CA and signs certificates for all other hosts on the network. The certificate is used to authenticate the host, and also can include custom attributes to be used in firewall rules. So the problem I'd need to solve is keeping track of certificate expiry and renewing the certificates, or issuing new certificates when I add new attributes to a set of hosts.

  • I use yggdrasil which, I believe, is wireguard under the hood, but the key generation and routing are all done automatically using LAN discovery or by connecting to peers on the network. I've tested out other overlay netw, rks like tinc and cjdns, but yggdasil has been the most reliable of the bunch. Its nice because the host key is used to derive an ipv6 address that can be physically relocated without doing any manual route changes.

    I used to run a bunch of services over yggdrasil, but I had some economic struggles for a while and I had to delete most of it. I'll bring it back at some point though, this time with even more yggdrasil.

    • Cool! I was really intrigued by yggdrasil, do you use it for a private network only, or do you connect with the public peers? And do you recall any connectivity issues related to NAT or firewalls (if mobile clients are part of your network)?

      • Mostly private, but I've used public peers in the past to give myself more flexibility. I usually have a cheap VPS setup as a gateway. The auto routing is really powerful, I just have a couple of hosts on my LAN that peer directly with the gateway and the rest is handled by local discovery. My mobile clients will usually have the same gateway setup for roaming, but if I'm hanging out at a library I might use a public peer over TLS if my gateway's port is blocked.

You've viewed 16 comments.