Hacker News Reader

Comment by jedberg | Hacker News Reader

This seems like a good place to ask: What is the current state of the art for connecting back to my home network while remote? I want:

access to my home server

ability to stream US TV when abroad (by exiting from my home network)

ability to make it easy for others with non-tech backgrounds to connect with their devices (parents, kids, etc)

ability to have remote linux servers connect automatically on boot. This one is because I can't get OTA TV at home and want to set up a simple streaming box at someone else's house to do it that connects back to my house, so we can stream off all of our devices.

I'm guessing tailscale will be a part of this setup which is why I ask here.

View on HN

Tailscale will enable all of this.

Set up a US device as an exit node, and configure other devices to proxy through it.

> ability to stream US TV when abroad (by exiting from my home network)

Should note that Tailscale does not work natively with hdhr for mpeg television streams b/c wireguard doesn't natively support udp multicast/broadcast. Also can't directly port forward b/c hdhr sets a default ttl of 2.

My understanding is that most VPNs in general don't support udp multicast due to operating on the network layer rather than data link, though iirc OpenVPN supports multicast traffic through its virtual TAP (Layer 2) rather than TUN (Layer 3).

Tailscale does create a TUN/TAP virtual network[0], though udp multicast is still not natively supported.

[0]: https://tailscale.com/docs/concepts/tailscale-osi#data-link-...

https://github.com/tailscale/tailscale/issues/1013

https://github.com/tailscale/tailscale/issues/11134

By 'stream US TV' I assume they just mean using popular streaming services like Netflix. If that's the case, than UDP multicast packets aren't involved at all, since it's all unicast.

Your advice would apply if they're using a local TV tuner or IPTV setup to share live TV on the local network or something, but that seems unlikely. But for content coming from mainstream Internet streaming services, it's good bet they're not using multicast.

For $5 a month you can also get a Mullvad VPN exit node. It’s billed directly through Tailscale which makes it painless.

When I’m outside the U.S. I get much better speeds through the Mullvad exit node than through my (U.S.) home exit node. I’m not sure why, since my home internet is gigabit fiber and I confirmed that I had a direct connection (no DERP relay).

Where's the Mullvad exit node located? It may just be geographically closer to your travel location than your home is. Even if it's about the same distance geographically, the routing path is different and traffic to whatever datacenter is running the mulvad node can be routed to more efficiently than your residential ip.

poking around with MTR (traceroute and ping combined) using various exit nodes and destinations would give you some more information if you're interested.

They offer a ton of locations around the world, like most VPNs. But I mostly used locations in the U.S. near my home exit node. I suspect it is something related to routing.

Yes, you've described Tailscale + Exit Nodes + Tailnet that you invite your family to. Install Tailscale and enable some devices as exit nodes - it's pretty much as simple as that.

I just use WireGuard to connect my local network. I see no point in throwing a middleman into the mix.

This comment might be of interest to help you understand what Tailscale does that WireGuard cannot: https://news.ycombinator.com/item?id=47064875

I would phrase that as what Tailscale does that is more convenient than wg. If you “barely know what a subnet is” go for it. wg is easy as pie though, and just don’t maintain 90 tunnels… You don’t need a full mesh. An extra hop or two, especially within a lan, won’t hurt.

I would recommend WireGuard as well, I primarily use it with Tailscale as backup. WG is straightforward to set up, and with LLM the knowledge gap is now nothing if you have trouble with it

Tailscale is probably what you want, but if you care about privacy you'll have to be sure to disable the telemetry/logging/spying option on each of your nodes.

By default it will leak your so-called “private” network behavior to Tailscale (connections on what port, from what node, to what node, opened when, closed when): https://tailscale.com/docs/features/logging

I'm using tailscale for this and am finding it great. I have an Unraid home server/NAS, which has quite nice tailscale integration. The server can be used as an exit node, and each containerized application/workload can be configured to use tailscale and get a nice (https) address that works in your tailnet. I'm not close to hitting the free tier limits, though I'd be happy to pay for it (and I do pay for mullvad through them)

I found good success with OpenWRT/Tomato and WireGuard.

The interface is bad when it comes to provisioning but it can be done with a QR code and once it works the native experience of turning on the VPN was just stunningly fast. In this day and age you expect things to be slow with negotiation and various unreliable steps but it was just amazing that I tap the VPN button on iOS and it's connected in a fraction of a second.

Related question: how are people handling adding family members of varying technical abilities to your tailnets? Does each family member get a separate user so you can manage their access? For my immediate family I was just logging tailscale in as me on their devices, but that becomes a pain when they get logged out and need me to log in again before things go back to working.

- For homes with close family (parents and siblings), I setup a subnet router and local DNS server on a Dell Wyse, making it one of their DNS servers so it can point them to services

- Yes, they should have their own account. However you can only add a few before you need to move to a paid version

- You can disable the expiry for nodes, which should keep it connected and prevent you needing to sign in again for them, for the most part

Surprised noone mentioned netbird. I got annoyed of unpredictable speeds I'd get via tailscale and the fact that I am not in charge of my VPN. I now rent a 5 euro VPS at Hetzner(get an ip with it) and host netbird running on it and my home server/pc as an exit node.

tailscale has a feature called "funnel" that will let others connect to a service running on your tailnet, even if they dont use tailscale themselves

if you are behind cgnat (both ipv4, ipv6) then vps, have public ipv6 then you can connect via public domain (ddns openwrt) and if you have a public ip, wireguard it is

Reply on news.ycombinator.com