Hacker News Reader

Comment by cassianoleal | Hacker News Reader

Congrats on the launch!

A couple questions from me, if you don't mind.

I currently use Tailscale for my home lab. My current model is similar to old-school road warrior VPNing, where I have my router as a node that routes to the LAN using the internal (non-meshed) IPs. Does your solution support that? How easy is it to deploy and configure it in that way?

Another feature I use is "exit nodes", i.e. my router as a gateway to the Internet, similar to what consumer VPNs (Mullvad, PrivateInternetAccess, etc) do. This offers me 2 things: more security when I'm on insecure networks (airport or other public WiFi, etc); and allows me to access things as though I'm at home when I'm traveling abroad. This is a one-time configuration and I can easily switch it on and off on demand via the desktop or phone app. Is this an option in your product?

Edit: s/customer/consumer/

View on HN

This is probably the #1 use case among our users, so yes it is totally do-able. Depends a bit on the router, since we don't support the full range of OS's yet, but if it is FreeBSD-based or OpenWRT you should be good to go. Otherwise, any Linux computer in your home network can act as the router to the LAN.

I believe we actually had a feature like exit nodes before Tailscale released theirs :) Our is called an "egress gateway" and it acts in pretty much the same way.

My router is indeed OpenWRT-based, but even if that was not directly supported I can run LXC containers on it.

Thanks for your reply, I will try to deploy Netmaker alongside Tailscale and compare for my needs!

Sounds good, let us know how it goes! And be sure to do a speed comparison too :)

What about routers that support wireguard natively, such as Mikrotik?

Routers are hard because they all have their custom OS's, and we need to do system level stuff besides just WireGuard. We're open to expanding the range where needed, and will happily support anyone in the community who wants to port the client to a new OS, but for now we're sticking to OpenWRT and FreeBSD as the supported routers.

Does "FreeBSD" include pfSense and OPNsense, especially in terms of UI integration?

do you have a write up or blog post on your setup?

I don't think we have one specifically for a setup like that, but we have lots of tutorials here: https://gravitl.com/resources

Not really, but it was very simple and easy.

The "hardest" part is managing the tailscale installation on the router, since the OpenWRT packages seem to be quite old. I went old-fashioned and just download the ARM tarballs and uncompress them.

I lifted the init.d script from someone else's blog post [0] and adjusted the path to the binaries.

After that I've pretty much just followed the official docs to implement LAN routing [1] and the exit node [2], then set the router's cert so it doesn't expire, which is done on the Tailscale GUI.

Install the app on the devices, connect everything to the tailnet and Bob's your uncle.

[0] https://willangley.org/how-i-set-up-tailscale-on-my-wifi-rou... [1] https://tailscale.com/kb/1019/subnets/ [2] https://tailscale.com/kb/1103/exit-nodes/

Reply on news.ycombinator.com