Hacker News Reader

Comment by pseudosavant | Hacker News Reader

I love Wireguard, but if you want to do this, I think there are only two ways that make sense for most users.

The best option is just to use tailscale, either on your router or on a device on the network that is always on, and set it as an exit node. It uses Wireguard under-the-hood, and it way easier to setup.

If you really must use Wireguard directly, get a router like a GL.iNet with OpenWRT that has a Wireguard server built-in. It'll handle creating certs for users, etc.

View on HN

Tailscale has some fundamental security assumptions that some people may not like for it to be so reflexively suggested all the time, but also, the last mile of user interface issues plague the whole of cryptography systems.

I used a GL.Inet yellow hockey puck device 8 hours a day for about 6 months in the exact configuration mentioned. Interface and form factor, all are great, but your internet speed will be limited by the CPU. It was woefully under powered for VPN crypto.

This looks promising: https://www.gl-inet.com/products/gl-be3600/

Tailscale is slloowwww and I'm not a big fan of someone else controlling my network. Yeah, tailnet lock at all that, I know, but still...

You can use headscale [1] (open source) as the mothership, and all the published clients (AFAIK) support pointing them to an alternative mothership.

I set it up, and it worked, but regular Tailscale works so well out-of-the-box that I just used that instead of maintaining headscale.

[1] https://github.com/juanfont/headscale

Tailscale in most cases establishes direct links between the nodes so it can't be any slower than the speed of the network you're already using.

As someone who previously led development of a commercial VPN system, I assure you, there are about 100 ways for a VPN to go slower than the network hosting it. Unfortunately.

Two cases I can think of are MTU misconfigurations and constrained CPU on either endpoint, where the node CPU can handle non-VPN network demands but can't handle the VPN demand.

And when it doesn't (which is often the case behind NAT), you're at the mercy of their relays which are not particularly fast.

Reply on news.ycombinator.com