6 ms·

I’m pretty ignorant on this topic, but what are the benefits of having a personal VPN?

gzer0 4y ago
I am able to route traffic on my mobile device through my home network via the use of their "exit node" option. It allows one of my home devices to act as an exit node for my entire personal tailscale network. This serves multiple benefits: the main one being that I receive pi-hole filtered ad-free traffic on my mobile device via a Wireguard VPN with my home IP 24/7/365
- karlshea 4y ago
  I can do that without Tailscale though by just using the WireGuard app. What is Tailscale adding to this?
  - nickysielicki 4y ago
    NAT breaking, I can have a wireguard network with Tailscale where every device only has an RFC1918 address and a default route.
    - karlshea 4y ago
      Ahhh that is slick
    - anderspitman 4y ago
      For more background on just how much Tailscale is doing for you with respect to NAT: https://tailscale.com/blog/how-nat-traversal-works/ https://tailscale.com/blog/how-nat-traversal-works/
    - devman0 4y ago
      Is forwarding a single port that difficult in most circumstances? I do realize there are some instances where that is hard like CGNAT, but if I have easy access to wireguard in my network already what does tailscale buy me?
      - donaldihunter 4y ago
        I was running Wireguard exactly as you describe, but I'm now using Tailscale because convenience.
  - rrix2 4y ago
    not having to generate, manage, and distribute wireguard secrets and configurations was good enough reason for me to switch. Tailscale also provides a "magic DNS" service which lets you resolve your Tailscale device names without setting up unbound etc, and which can relay other requests through to your pi-hole or unbound or whatever, which can then listen only on the tailscale IP address, so no need to run an open resolver or deal with source IP filtering. e: also, you can share devices between tailscale users without generating, managing, distributing wireguard secrets. You send your pal/partner/kid a link and they can access your fileserver or raspberry pi webserver or pihole server for themselves wherever they are.
  - ReverseCold 4y ago
    > For a Linux user, you can already build such a system yourself quite trivially by getting an FTP account, mounting it locally with curlftpfs, and then using SVN or CVS on the mounted filesystem. From Windows or Mac, this FTP account could be accessed through built-in software.
  - LoveGracePeace 4y ago
    I do the same, for multiple domains I own. Definitely not difficult.
- deleted 4y ago
  [deleted]
- Sohcahtoa82 4y ago
  What other benefits are there? I use a PiHole to block ads on my phone already, but I do it via a PiHole installed on an EC2 instance that I also use as an IRC bouncer and other things.
  - pkulak 4y ago
    It means you can self host all kinds of things and never worry about opening a port on your router.
    - anderspitman 4y ago
      As long as you don't need to share any of your services with non-Tailscale users. Otherwise you'll need to set up some sort of public server.
      - vineyardmike 4y ago
        But you can also try to get them to be Tailscale users and effortlessly share the devices with access control features they built. I share my home servers and game servers with family/friends easily while still keeping everything off the public internet.
        apitman 4y ago
        But now your friends and family are locked into a proprietary system, subject to whatever the future incentives of Tailscale end up being. How many people can you connect on the free plan?
        gzer0 4y ago
        Everything in Tailscale is Open Source, except the GUI clients for proprietary OS (Windows and macOS/iOS), and the control server. Headscale [1] allows one to implement a self-hosted, open source alternative to the Tailscale control server. [1] https://github.com/juanfont/headscale https://github.com/juanfont/headscale Almost all of tailscale is opensourced at this point besides the GUI.
- antihero 4y ago
  Ah, the exit node thing is really cool, always handy to have a residential IP to route through too :)
- PinguTS 4y ago
  So then, whats is the difference to run OpenConnect and then connecting to it via activating CiscoVPN on the phone/mobile device? I used that while I was in China as this allowed me to have my own personal VPN.
newaccount74 4y ago
I use it so I can connect to my work machine (dynamic IP on office wifi) from my laptop (dynamic IP, home Wifi). It's also great to be able to just ssh into your laptop at home when you're at work and you forgot to push whatever you were working on last night. It's not necessary, but Tailscale makes a lot of things just easier.
- yeswecatan 4y ago
  > It's also great to be able to just ssh into your laptop at home when you're at work and you forgot to push whatever you were working on last night. What's the difference between using Tailscale for this and just opening the port on your router?
  - pimeys 4y ago
    Easier. And you don't open the port to a public network.
  - colordrops 4y ago
    Someone answered above - it works even if you have no router you can configure, using NAT busting. I do what you suggest though, just setting up wireguard directly on my OPNSense router. I don't want to get any private company involved in my VPN setup.
  - pkulak 4y ago
    Like a million times more secure.
shepherdjerred 4y ago
I have a server at home with file syncing, personal media, and home automation. I want to be able to access it remotely, but I’d rather some of those things not be publicly accessible for security. I could always do HTTP auth with an nginx reverse proxy, but it’s not a very smooth workflow and it relies on me being able to configure my server/services correctly. Instead I can bind my services to Tailscales network interface and access it anywhere that I’m connected to my Tailscale network. It’s like authentication for free. As a side note I know this is an anti pattern since one intruder can access all of my services, but that’s not a vector I’m really concerned about since I’m not exactly a high value target.
- jjeaff 4y ago
  I don't think that is an anti-pattern. One well secured point of access is better than various http access points with varying levels of security and maintenance levels, all requiring frequent manual update to stay secure.
  - shepherdjerred 4y ago
    I meant that for larger organizations where security is a concern you'd want both -- your network should be secured and the individual applications should be as well. Again it's contextual advice and really doesn't matter for my internal site where there's not too much at stake.
stanmancan 4y ago
You can access your home network and any machines on it without exposing anything to the public internet. It's much safer to connect to my home network over a VPN than to expose all of the services to the public internet and hope they're all secure.
- criddell 4y ago
  Doesn’t putting Tailscale in the middle mean you are now hoping they are secure? I supposed that’s probably better than connecting to the VPN on your home gateway router that your ISP has access to.
  - stanmancan 4y ago
    I have a model and my own router; I don't use (or even have) one provided by my ISP. I'm not entirely sure how Tailscale works TBH, so yes I'm betting on them being secure. Tailscale comes with a few other benefits that don't come on other VPN's. I have my home server setup as an 'exit node' which allows me to route my traffic through it when I'm travelling. Super handy sometimes like when I'm travelling and my bank decides not to let me log in.
ziftface 4y ago
Some of my friends used it to play older lan games
GekkePrutser 4y ago
For me: direct routing between endpoints, thus reducing the lag and spec restrictions you get from routing through a single VPN server. Other things are seamless transition to local networks, and you can even have local network encryption.
girvo 4y ago
For me, its so I can use Moonlight to stream games from my gaming desktop PC to my iPhone using a Backbone One controller. Handheld Elden Ring is amazing :) Though my use-case is extremely simple, and so I just use bare WireGuard

I am able to route traffic on my mobile device through my home network via the use of their "exit node" option. It allows one of my home devices to act as an exit node for my entire personal tailscale network. This serves multiple benefits: the main one being that I receive pi-hole filtered ad-free traffic on my mobile device via a Wireguard VPN with my home IP 24/7/365

karlshea 4y ago
I can do that without Tailscale though by just using the WireGuard app. What is Tailscale adding to this?
- nickysielicki 4y ago
  NAT breaking, I can have a wireguard network with Tailscale where every device only has an RFC1918 address and a default route.
  - karlshea 4y ago
    Ahhh that is slick
  - anderspitman 4y ago
    For more background on just how much Tailscale is doing for you with respect to NAT: https://tailscale.com/blog/how-nat-traversal-works/ https://tailscale.com/blog/how-nat-traversal-works/
  - devman0 4y ago
    Is forwarding a single port that difficult in most circumstances? I do realize there are some instances where that is hard like CGNAT, but if I have easy access to wireguard in my network already what does tailscale buy me?
    - donaldihunter 4y ago
      I was running Wireguard exactly as you describe, but I'm now using Tailscale because convenience.
- rrix2 4y ago
  not having to generate, manage, and distribute wireguard secrets and configurations was good enough reason for me to switch. Tailscale also provides a "magic DNS" service which lets you resolve your Tailscale device names without setting up unbound etc, and which can relay other requests through to your pi-hole or unbound or whatever, which can then listen only on the tailscale IP address, so no need to run an open resolver or deal with source IP filtering. e: also, you can share devices between tailscale users without generating, managing, distributing wireguard secrets. You send your pal/partner/kid a link and they can access your fileserver or raspberry pi webserver or pihole server for themselves wherever they are.
- ReverseCold 4y ago
  > For a Linux user, you can already build such a system yourself quite trivially by getting an FTP account, mounting it locally with curlftpfs, and then using SVN or CVS on the mounted filesystem. From Windows or Mac, this FTP account could be accessed through built-in software.
- LoveGracePeace 4y ago
  I do the same, for multiple domains I own. Definitely not difficult.
deleted 4y ago
[deleted]
Sohcahtoa82 4y ago
What other benefits are there? I use a PiHole to block ads on my phone already, but I do it via a PiHole installed on an EC2 instance that I also use as an IRC bouncer and other things.
- pkulak 4y ago
  It means you can self host all kinds of things and never worry about opening a port on your router.
  - anderspitman 4y ago
    As long as you don't need to share any of your services with non-Tailscale users. Otherwise you'll need to set up some sort of public server.
    - vineyardmike 4y ago
      But you can also try to get them to be Tailscale users and effortlessly share the devices with access control features they built. I share my home servers and game servers with family/friends easily while still keeping everything off the public internet.
      - apitman 4y ago
        But now your friends and family are locked into a proprietary system, subject to whatever the future incentives of Tailscale end up being. How many people can you connect on the free plan?
        gzer0 4y ago
        Everything in Tailscale is Open Source, except the GUI clients for proprietary OS (Windows and macOS/iOS), and the control server. Headscale [1] allows one to implement a self-hosted, open source alternative to the Tailscale control server. [1] https://github.com/juanfont/headscale https://github.com/juanfont/headscale Almost all of tailscale is opensourced at this point besides the GUI.
antihero 4y ago
Ah, the exit node thing is really cool, always handy to have a residential IP to route through too :)
PinguTS 4y ago
So then, whats is the difference to run OpenConnect and then connecting to it via activating CiscoVPN on the phone/mobile device? I used that while I was in China as this allowed me to have my own personal VPN.

newaccount74 4y ago

I use it so I can connect to my work machine (dynamic IP on office wifi) from my laptop (dynamic IP, home Wifi). It's also great to be able to just ssh into your laptop at home when you're at work and you forgot to push whatever you were working on last night. It's not necessary, but Tailscale makes a lot of things just easier.

yeswecatan 4y ago
> It's also great to be able to just ssh into your laptop at home when you're at work and you forgot to push whatever you were working on last night. What's the difference between using Tailscale for this and just opening the port on your router?
- pimeys 4y ago
  Easier. And you don't open the port to a public network.
- colordrops 4y ago
  Someone answered above - it works even if you have no router you can configure, using NAT busting. I do what you suggest though, just setting up wireguard directly on my OPNSense router. I don't want to get any private company involved in my VPN setup.
- pkulak 4y ago
  Like a million times more secure.

shepherdjerred 4y ago

I have a server at home with file syncing, personal media, and home automation. I want to be able to access it remotely, but I’d rather some of those things not be publicly accessible for security. I could always do HTTP auth with an nginx reverse proxy, but it’s not a very smooth workflow and it relies on me being able to configure my server/services correctly. Instead I can bind my services to Tailscales network interface and access it anywhere that I’m connected to my Tailscale network. It’s like authentication for free. As a side note I know this is an anti pattern since one intruder can access all of my services, but that’s not a vector I’m really concerned about since I’m not exactly a high value target.

jjeaff 4y ago
I don't think that is an anti-pattern. One well secured point of access is better than various http access points with varying levels of security and maintenance levels, all requiring frequent manual update to stay secure.
- shepherdjerred 4y ago
  I meant that for larger organizations where security is a concern you'd want both -- your network should be secured and the individual applications should be as well. Again it's contextual advice and really doesn't matter for my internal site where there's not too much at stake.

stanmancan 4y ago

You can access your home network and any machines on it without exposing anything to the public internet. It's much safer to connect to my home network over a VPN than to expose all of the services to the public internet and hope they're all secure.

criddell 4y ago
Doesn’t putting Tailscale in the middle mean you are now hoping they are secure? I supposed that’s probably better than connecting to the VPN on your home gateway router that your ISP has access to.
- stanmancan 4y ago
  I have a model and my own router; I don't use (or even have) one provided by my ISP. I'm not entirely sure how Tailscale works TBH, so yes I'm betting on them being secure. Tailscale comes with a few other benefits that don't come on other VPN's. I have my home server setup as an 'exit node' which allows me to route my traffic through it when I'm travelling. Super handy sometimes like when I'm travelling and my bank decides not to let me log in.

ziftface 4y ago

Some of my friends used it to play older lan games

GekkePrutser 4y ago

For me: direct routing between endpoints, thus reducing the lag and spec restrictions you get from routing through a single VPN server. Other things are seamless transition to local networks, and you can even have local network encryption.

girvo 4y ago

For me, its so I can use Moonlight to stream games from my gaming desktop PC to my iPhone using a Backbone One controller. Handheld Elden Ring is amazing :) Though my use-case is extremely simple, and so I just use bare WireGuard