Recently I've been reading a lot about the topic of mesh VPNs (tinc, Nebula, Tailscale, ZeroTier, Netmaker, Netbird, etc) and find them pretty interesting. Is anyone here using these in some capacity at home or maybe at work?

My problem so far is that many of the options seem to be aimed at corporate use, understandably, so the developers can earn enough to keep doing it. This means the focus is on a centralized control plane, one server which knows everything about the entire network and manages firewall rules for all of it.

This is why I'm leaning towards Nebula, since I think the decentralized design just makes more sense. There is some centralization for issuing certs though. How do I go about setting up PKI? Is there some open source solution for managing certificates and automatically renewing them?

There's also the option of using vanilla WireGuard. This is my current setup, but I really like the idea of meshing, since it means I don't need to care if my devices are physically on the same network or not, the best connection will be used. Basically the layer of abstraction is a nice convenience that lets me think about hosts or services independently of the physical network topology.

I'm interested to hear your thoughts on this topic! What's your setup like and what do you use it for?

  • wheresmysurplusvalue [comrade/them]
    ·
    9 months ago

    Good feedback, thanks. Making sure all my devices are properly firewalled is another concern of mine, since all this NAT traversal stuff is basically a way to bypass firewall rules which are there for a reason. I think most of these solutions have firewalls/ACLs built in. But it does mean that I would rely on their firewall implementation and can't switch it out for something else.

    My use case is I'm hosting a number of services on machines inside my home LAN, and also a few services on a VPS. Two family members use a few of the services hosted in the LAN and on the VPS. For things inside the LAN, for now I've given them WireGuard credentials to access them, but this gives them full access to my LAN. On the VPS they can access a http server from the public internet.

    I also travel a bit, so I connect via WireGuard to encrypt my traffic and have access to my LAN services at the same time. Tailscale offers "exit node" functionality which seemed to work when I tried it.

    So my main goals are:

    1. Encrypt my mobile traffic through a secure tunnel back home, no need to pay for or trust a VPN provider
    2. Ability to give users role-based access to my privately hosted services from anywhere
    3. Close almost all ports on all machines including the VPS, no publicly hosted services at all (maybe not even ssh)
    4. Simplify access to my services in general. Generally just want to be able to e.g. type the same URL and access a service, regardless of whether I'm at home or on a public network. But there are probably other solutions for this point alone.
    • ZWQbpkzl [none/use name]
      ·
      9 months ago

      I have the exact same use case and I use headscale on a VPS + tailscale on my devices.

      I haven't figured out how to give lay-friends access though. I can make them a user in headscale but it seems cumbersome to make them use tailscale to connect. Wireguard directly seems even more cumbersome.

      • wheresmysurplusvalue [comrade/them]
        ·
        9 months ago

        During my research I came across ngrok, maybe this could be useful in your situation. I also came across zrok, which seems like an open source version of the same thing based on OpenZiti. Both of them seem like ways to give public portals to your private services. So you could give your friends access that way without them needing to use a VPN.

        • ZWQbpkzl [none/use name]
          ·
          8 months ago

          Update: I found a guide to use traefik to tunnel into the VPN. Idea is:

          1. Setup headscale behind traefik on a VPS.
          2. Connect all my local devices to the tailnet.
          3. Connect to the VPS to the tailnet. So its running both headscale and tailscale.
          4. Traefik can now proxy to any device on the tailnet.

          Step 1 however is a gigantic pain in the ass. Traefik is overkill for anything non-enterprise. It was just three lines of Caddyfile to make it work with Caddy.

          http://hs.example.com {
  reverse_proxy * http://localhost:8282
}

          Step 4 is almost exactly the same

          http://app.example.com {
  reverse_proxy * http://node:8080
}

          You can also use tailscale funnel instead any reverse proxy but then your exposing ports not sub domains. And whatever service you're funneling to is responsible for SSL.