Hacker News Reader

Comment by siavosh | Hacker News Reader

I’m pretty ignorant on this topic, but what are the benefits of having a personal VPN?

I am able to route traffic on my mobile device through my home network via the use of their "exit node" option. It allows one of my home devices to act as an exit node for my entire personal tailscale network.

This serves multiple benefits: the main one being that I receive pi-hole filtered ad-free traffic on my mobile device via a Wireguard VPN with my home IP 24/7/365

I can do that without Tailscale though by just using the WireGuard app. What is Tailscale adding to this?

NAT breaking, I can have a wireguard network with Tailscale where every device only has an RFC1918 address and a default route.

Ahhh that is slick

For more background on just how much Tailscale is doing for you with respect to NAT:

https://tailscale.com/blog/how-nat-traversal-works/

Is forwarding a single port that difficult in most circumstances? I do realize there are some instances where that is hard like CGNAT, but if I have easy access to wireguard in my network already what does tailscale buy me?

I was running Wireguard exactly as you describe, but I'm now using Tailscale because convenience.

not having to generate, manage, and distribute wireguard secrets and configurations was good enough reason for me to switch.

Tailscale also provides a "magic DNS" service which lets you resolve your Tailscale device names without setting up unbound etc, and which can relay other requests through to your pi-hole or unbound or whatever, which can then listen only on the tailscale IP address, so no need to run an open resolver or deal with source IP filtering.

e: also, you can share devices between tailscale users without generating, managing, distributing wireguard secrets. You send your pal/partner/kid a link and they can access your fileserver or raspberry pi webserver or pihole server for themselves wherever they are.

> For a Linux user, you can already build such a system yourself quite trivially by getting an FTP account, mounting it locally with curlftpfs, and then using SVN or CVS on the mounted filesystem. From Windows or Mac, this FTP account could be accessed through built-in software.

I do the same, for multiple domains I own. Definitely not difficult.

What other benefits are there? I use a PiHole to block ads on my phone already, but I do it via a PiHole installed on an EC2 instance that I also use as an IRC bouncer and other things.

It means you can self host all kinds of things and never worry about opening a port on your router.

As long as you don't need to share any of your services with non-Tailscale users. Otherwise you'll need to set up some sort of public server.

But you can also try to get them to be Tailscale users and effortlessly share the devices with access control features they built. I share my home servers and game servers with family/friends easily while still keeping everything off the public internet.

But now your friends and family are locked into a proprietary system, subject to whatever the future incentives of Tailscale end up being. How many people can you connect on the free plan?

Everything in Tailscale is Open Source, except the GUI clients for proprietary OS (Windows and macOS/iOS), and the control server.

Headscale [1] allows one to implement a self-hosted, open source alternative to the Tailscale control server.

[1] https://github.com/juanfont/headscale

Almost all of tailscale is opensourced at this point besides the GUI.

Does headscale do all the same NAT traversal that Tailscale is capable of?

Yea, but my friends and family would rather have a service that just works, has apps, etc instead of an open one. Tailscale is a good actor ~for now~ and ~for now~ thats good enough for us. Not everyday in every situation can I be an activist. I have a list of alternatives incl FOSS ones should I need, but I'll cross that bridge only if I need to, since this JustWorks.

You can connect one person on a free plan, but each person can have their own free plan that you share devices between.

It’s pretty similar as far as how it works for you.

It may be cheaper to VPN to home vs a cloud server, and you may avoid issues where sites block AWS. You can also securely forward other ports. Sometimes I print or access other services in my house that aren’t internet safe.

I have the PiHole VPN configured so that only DNS lookups go through it. All other traffic is not tunneled. It means I don't get billed for several gigabytes of traffic from AWS and my traffic doesn't come from an AWS IP, but I still get all the ad-blocking benefits of a PiHole.

At home on my desktop, I just use uBlock Origin in my browser.

oh wow that is cool. I have never heard or thought about putting a pi-hole in the cloud.

It made more sense to me for using a PiHole on my phone. I didn't want to expose a VPN port on my home network, and didn't want to deal with trying to tunnel VPN through SSH.

And the EC2 instance I installed it on was already being used for other toy projects, so it's not like it cost me anything. The additional egress bandwidth is likely fractions of a penny.

Ah, the exit node thing is really cool, always handy to have a residential IP to route through too :)

So then, whats is the difference to run OpenConnect and then connecting to it via activating CiscoVPN on the phone/mobile device?

I used that while I was in China as this allowed me to have my own personal VPN.

I have a server at home with file syncing, personal media, and home automation. I want to be able to access it remotely, but I’d rather some of those things not be publicly accessible for security. I could always do HTTP auth with an nginx reverse proxy, but it’s not a very smooth workflow and it relies on me being able to configure my server/services correctly.

Instead I can bind my services to Tailscales network interface and access it anywhere that I’m connected to my Tailscale network. It’s like authentication for free.

As a side note I know this is an anti pattern since one intruder can access all of my services, but that’s not a vector I’m really concerned about since I’m not exactly a high value target.

I don't think that is an anti-pattern. One well secured point of access is better than various http access points with varying levels of security and maintenance levels, all requiring frequent manual update to stay secure.

I meant that for larger organizations where security is a concern you'd want both -- your network should be secured and the individual applications should be as well. Again it's contextual advice and really doesn't matter for my internal site where there's not too much at stake.

I use it so I can connect to my work machine (dynamic IP on office wifi) from my laptop (dynamic IP, home Wifi).

It's also great to be able to just ssh into your laptop at home when you're at work and you forgot to push whatever you were working on last night.

It's not necessary, but Tailscale makes a lot of things just easier.

> It's also great to be able to just ssh into your laptop at home when you're at work and you forgot to push whatever you were working on last night.

What's the difference between using Tailscale for this and just opening the port on your router?

Someone answered above - it works even if you have no router you can configure, using NAT busting. I do what you suggest though, just setting up wireguard directly on my OPNSense router. I don't want to get any private company involved in my VPN setup.

Easier. And you don't open the port to a public network.

Like a million times more secure.

You can access your home network and any machines on it without exposing anything to the public internet. It's much safer to connect to my home network over a VPN than to expose all of the services to the public internet and hope they're all secure.

Doesn’t putting Tailscale in the middle mean you are now hoping they are secure? I supposed that’s probably better than connecting to the VPN on your home gateway router that your ISP has access to.

I have a model and my own router; I don't use (or even have) one provided by my ISP. I'm not entirely sure how Tailscale works TBH, so yes I'm betting on them being secure.

Tailscale comes with a few other benefits that don't come on other VPN's. I have my home server setup as an 'exit node' which allows me to route my traffic through it when I'm travelling. Super handy sometimes like when I'm travelling and my bank decides not to let me log in.

Some of my friends used it to play older lan games

For me: direct routing between endpoints, thus reducing the lag and spec restrictions you get from routing through a single VPN server.

Other things are seamless transition to local networks, and you can even have local network encryption.

For me, its so I can use Moonlight to stream games from my gaming desktop PC to my iPhone using a Backbone One controller.

Handheld Elden Ring is amazing :)

Though my use-case is extremely simple, and so I just use bare WireGuard

Reply on news.ycombinator.com