Started with exposed domains with NPM, SSL certificates, etc. Tried out CloudFlare tunnels and wasn’t satisfied, so I landed on Tailscale. Dead simple to set up and use. Fast, secure, what more to ask for?
I just use the UDM-SE App (Teleport). I can connect on demand and get to all of my services, get adblocking while I’m out and about. Teleport on ubiquiti is just wireguard renamed.
I don’t need to expose any services from my home network, because I’m the only one using them. If It wasn’t just me, I’d just have them download the wifiman app, send them a teleport link and boom…they’re in on the local network. Exposing “services” for a convenience factor is just too much of a security risk for myself.
I host all of my websites on github (free) and leverage vercel for CI/CD pipelines (again, free). Domains are the only thing public and that I pay for. (local dns reasons for lets encrypt certs) and for my public websites not associated with my home infrastructure.
I use Wireguard and Tailscale. Some networks block Wireguard connections. Tailscale always works.
Some networks block Wireguard connections.
Dollars to doughnuts they’re blocking the default Wireguard port. Change your wireguard port to something like 8080 or 8443 and you’ll almost certainly make it through
Pretty simple answer: Wireguard.
Why? It’s the fastest of them all, works on almost all devices you can imagine, does not rely on any 3rd party like Tailscale with OICD or other IdP. Tailscale has its use when you are behind CGNAT and don’t want to VPS a Wireguard server somewhere with a static IP, other than that, it has no use in my opinion. I’m fully aware that I get downvotes from people who praise the zero trust principals of Tailscale and all the rest, but they always forget that you can do zero trust since decades with any network equipment (VXLAN) and add Wireguard to the mix. You can even run Wireguard in your local network to encrypt unencryptable traffic like NFS.
Check back in a few hours /u/Silencer306, this comment will have a few if not many downvotes.
Tailscale has its use when you are behind CGNAT and don’t want to VPS a Wireguard server somewhere with a static IP, other than that, it has no use in my opinion. I’m fully aware that I get downvotes from people who praise the zero trust principals of Tailscale and all the rest, but they always forget that you can do zero trust since decades with any network equipment (VXLAN) and add Wireguard to the mix.
People just forget that all Tailscale is is a fancy GUI for managing Wireguard. That’s it.
Wireguard lacks a lot of user management features so you need a service like Tailscale to handle that, but everything zerotier does is something you can already do in wireguard, just simplified.
If you can use Wireguard that is probably a good solution but I would still prefer to have a cloud proxy in front of it because my network can not handle all the attacks and wouldn’t even notice some of them if you use just Wireguard.
I use CF Tunnels firstly because of all the protections and traffic analysis it does, and secondly, because even DDNS wouldn’t work on my network.
excellent reply
Wireguard.
Because I would like to self-host everything myself, so why should I use another 3rd party service?
wireguard as primary, Tailscale as backup.
if I have something I don’t mind Cloudflare and the government taking a look, then Cloudflare tunnel.
I use WireGuard. It is sufficient for me, because I have no need to make my services publicly visible.
How do you access those services from a public network? Say, you want to access something while working from your office or a friend’s computer.
How do you access those services from a public network?
With Wireguard?
Sure, but what if that computer doesn’t have wireguard installed. I don’t see any other way except exposing the service to the public.
I use Tailscale, and you can set up a subnet router for that particular use case.
I’ve used IPSec to connect to my home (and office when I had my own company) networks. It has never failed me and the client is built right into my iphone and mac.
Wireguard because my consumer router has it built-in.
When I cruise around the net I sometimes use Mullvad as an ass-guard.
When I connect to my own server I have SSH, and if I ever need to access a local port I use port redirect over the SSH tunnel.
As a backup of a backup, if I am at a site that blocks access to remotes on port 22, I have sslh running on port 443 in front of my nginx, intercepting TLS for nginx, SSH and openVPN (running in docker) all on the one port, so I have options…
I use both. Cloudflare is for public facing services. Like overseerr and wizarr.
Tailscale is how I access my private services and dashboards.
wireguard because no one else needs to know what services i run in my local network
I use cloudflare with overseerr
I use all three.
-
CF tunnels to access generic apps I want public.
-
Tailscale to have remote access to my home network.
-
Wireguard tunnel going to a VPS for apps that I don’t feel comfortable running through CF due to the bandwidth (Jellyfin, AzuraCast).
I totally could move everything that’s on CF tunnels over to Wireguard, but I see no need to do it. Cloudflare is trustworthy enough and I like the additional protection it offers.
CF tunnels to access generic apps I want public.
I totally could move everything that’s on CF tunnels over to Wireguard, but I see no need to do it
How would you keep the public apps public if you require a wireguard connection to access them?
-
For work, Tailscale between vps and server. It works like cloudflare tunnels but doesn’t have the issues with the TOS excluding media streaming etc.
Keeps the internal server relatively safe and we can stream media/serve media content.
Cloudflare is our registrar and dns provider.