4 ms·

I love Wireguard, but if you want to do this, I think there are only two ways that make sense for most users. The best option is just to use tailscale, either

I love Wireguard, but if you want to do this, I think there are only two ways that make sense for most users. The best option is just to use tailscale, either on your router or on a device on the network that is always on, and set it as an exit node. It uses Wireguard under-the-hood, and it way easier to setup. If you really must use Wireguard directly, get a router like a GL.iNet with OpenWRT that has a Wireguard server built-in. It'll handle creating certs for users, etc.

FL410 1y ago
Tailscale is slloowwww and I'm not a big fan of someone else controlling my network. Yeah, tailnet lock at all that, I know, but still...
- moduspol 1y ago
  You can use headscale [1] (open source) as the mothership, and all the published clients (AFAIK) support pointing them to an alternative mothership. I set it up, and it worked, but regular Tailscale works so well out-of-the-box that I just used that instead of maintaining headscale. [1] https://github.com/juanfont/headscale https://github.com/juanfont/headscale
- LeoPanthera 1y ago
  Tailscale in most cases establishes direct links between the nodes so it can't be any slower than the speed of the network you're already using.
  - The_Fox 1y ago
    As someone who previously led development of a commercial VPN system, I assure you, there are about 100 ways for a VPN to go slower than the network hosting it. Unfortunately. Two cases I can think of are MTU misconfigurations and constrained CPU on either endpoint, where the node CPU can handle non-VPN network demands but can't handle the VPN demand.
  - FL410 1y ago
    And when it doesn't (which is often the case behind NAT), you're at the mercy of their relays which are not particularly fast.
th0ma5 1y ago
Tailscale has some fundamental security assumptions that some people may not like for it to be so reflexively suggested all the time, but also, the last mile of user interface issues plague the whole of cryptography systems.
speakspokespok 1y ago
I used a GL.Inet yellow hockey puck device 8 hours a day for about 6 months in the exact configuration mentioned. Interface and form factor, all are great, but your internet speed will be limited by the CPU. It was woefully under powered for VPN crypto. Not recommended: https://www.gl-inet.com/products/gl-mt300n-v2/ https://www.gl-inet.com/products/gl-mt300n-v2/ This looks promising: https://www.gl-inet.com/products/gl-be3600/ https://www.gl-inet.com/products/gl-be3600/

FL410 1y ago

Tailscale is slloowwww and I'm not a big fan of someone else controlling my network. Yeah, tailnet lock at all that, I know, but still...

moduspol 1y ago
You can use headscale [1] (open source) as the mothership, and all the published clients (AFAIK) support pointing them to an alternative mothership. I set it up, and it worked, but regular Tailscale works so well out-of-the-box that I just used that instead of maintaining headscale. [1] https://github.com/juanfont/headscale https://github.com/juanfont/headscale
LeoPanthera 1y ago
Tailscale in most cases establishes direct links between the nodes so it can't be any slower than the speed of the network you're already using.
- The_Fox 1y ago
  As someone who previously led development of a commercial VPN system, I assure you, there are about 100 ways for a VPN to go slower than the network hosting it. Unfortunately. Two cases I can think of are MTU misconfigurations and constrained CPU on either endpoint, where the node CPU can handle non-VPN network demands but can't handle the VPN demand.
- FL410 1y ago
  And when it doesn't (which is often the case behind NAT), you're at the mercy of their relays which are not particularly fast.

th0ma5 1y ago

Tailscale has some fundamental security assumptions that some people may not like for it to be so reflexively suggested all the time, but also, the last mile of user interface issues plague the whole of cryptography systems.

speakspokespok 1y ago

I used a GL.Inet yellow hockey puck device 8 hours a day for about 6 months in the exact configuration mentioned. Interface and form factor, all are great, but your internet speed will be limited by the CPU. It was woefully under powered for VPN crypto. Not recommended: https://www.gl-inet.com/products/gl-mt300n-v2/ https://www.gl-inet.com/products/gl-mt300n-v2/ This looks promising: https://www.gl-inet.com/products/gl-be3600/ https://www.gl-inet.com/products/gl-be3600/