3 ms·
You don’t need any port forwarding, even in infinitely complex corporate networks: All users in the private network connect to a Wireguard access VPN that runs
by aborsy 4y ago
You don’t need any port forwarding, even in infinitely complex corporate networks: All users in the private network connect to a Wireguard access VPN that runs on a VPS, and talk to each other.
That VPN needs to listen to a port. But with mesh VPN, that’s exchanged with a coordination and/or relay server that listen to a port and facilitate the connection, at a minimum in the initial phase. There are open ports in mesh VPNs too.
The advantage of the old school access VPN is that, 1) fewer third parties are to be trusted, 2) your VPS is likely going to be in your geographical area area, so if you are in a restrictive corporate network (considering that you emphasized this example), you get fast connection speeds vs potentially slow relays.
You may say, the access VPN may be far from the users. If you have a global business, sure, you need several VPS, which you may replace with several DERP nodes around the world in Tailscale, but for home users and some businesses, users are often in the same region.
Don’t get me wrong. I like mesh VPNs. They are convenient and useful, especially for small businesses. I tried Tailscale, it was simple and clean. But sometimes people make incorrect statements; just pointing this out.
- xena 4y agoSure you don't need it, but you may _want_ it. Consider that some people really don't want to set up a reflector server in the cloud (not to mention how that means your reflector server's bandwidth limit becomes your whole VPN's bandwidth limit). Having the nitty-gritty of the data plane be peer to peer as much as possible means that your network has practically unlimited data. If I am trying to SSH into one of the machines under my desk I shouldn't need to poke a server in a datacenter downtown to do it. There's also a bunch of people that want the convenience of being able to access things like their Synology NAS remotely. I'm almost certain that none of them want to set up a server in the cloud, or even understand what that means. Not everyone is super technically apt, and as a matter of policy we shouldn't try and make things with the assumption that everyone using them is a computing god already. People have to start from somewhere and it's perfectly okay for some people to not want to deep dive into the unrestrained horror of managing linux servers. Things you don't have to do are easier than things you have to do.
- jsmith45 4y agoUsing a wireguard vpn concentrator “works”, but it has limitations like having a higher chance of interfering with access to the the local network while connected. (Because the private addresses the remote network is using have a reasonable chance of clashing with the addresses on the local network.) Also, you absolutely need either port forwarding (or other forms of static NAT mapping) for the concentrator, or to run the concentrator outside of the NAT. (Which might be by running the software on the router that does NAT, or a seperate device with a routable address). Setting up vpn concentration solutions that limit your network access to only specific devices depending on who you sign in as is often quite complicated, to the point where I rarely see it done well. Often if you are you are connected, you get full access to several corporate subnets, and you are mostly limited by things like router acls not allowing VPN connections direct access to the some production subnets.