21
submitted 10 months ago* (last edited 10 months ago) by wheresmysurplusvalue@hexbear.net to c/technology@hexbear.net

Recently I've been reading a lot about the topic of mesh VPNs (tinc, Nebula, Tailscale, ZeroTier, Netmaker, Netbird, etc) and find them pretty interesting. Is anyone here using these in some capacity at home or maybe at work?

My problem so far is that many of the options seem to be aimed at corporate use, understandably, so the developers can earn enough to keep doing it. This means the focus is on a centralized control plane, one server which knows everything about the entire network and manages firewall rules for all of it.

This is why I'm leaning towards Nebula, since I think the decentralized design just makes more sense. There is some centralization for issuing certs though. How do I go about setting up PKI? Is there some open source solution for managing certificates and automatically renewing them?

There's also the option of using vanilla WireGuard. This is my current setup, but I really like the idea of meshing, since it means I don't need to care if my devices are physically on the same network or not, the best connection will be used. Basically the layer of abstraction is a nice convenience that lets me think about hosts or services independently of the physical network topology.

I'm interested to hear your thoughts on this topic! What's your setup like and what do you use it for?

you are viewing a single comment's thread
view the rest of the comments
[-] Maoo@hexbear.net 6 points 10 months ago

I generally steer clear of anything like it because it makes your network less secure. Only one device or server, even remote ones, needs to be compromised and suddenly the attacker can see your internal network. The only exception is that I occasionally enable wireguard for travel so that I can access my network from a single external device.

What's your use case for wanting a mesh network?

[-] drinkinglakewater@hexbear.net 3 points 10 months ago

If you're firewalling you can reasonably secure things but it becomes more complicated quick because you need one in front of each end point or else it's all being filtered centrally which defeats the decentralization

[-] wheresmysurplusvalue@hexbear.net 3 points 10 months ago* (last edited 10 months ago)

Good feedback, thanks. Making sure all my devices are properly firewalled is another concern of mine, since all this NAT traversal stuff is basically a way to bypass firewall rules which are there for a reason. I think most of these solutions have firewalls/ACLs built in. But it does mean that I would rely on their firewall implementation and can't switch it out for something else.

My use case is I'm hosting a number of services on machines inside my home LAN, and also a few services on a VPS. Two family members use a few of the services hosted in the LAN and on the VPS. For things inside the LAN, for now I've given them WireGuard credentials to access them, but this gives them full access to my LAN. On the VPS they can access a http server from the public internet.

I also travel a bit, so I connect via WireGuard to encrypt my traffic and have access to my LAN services at the same time. Tailscale offers "exit node" functionality which seemed to work when I tried it.

So my main goals are:

  1. Encrypt my mobile traffic through a secure tunnel back home, no need to pay for or trust a VPN provider
  2. Ability to give users role-based access to my privately hosted services from anywhere
  3. Close almost all ports on all machines including the VPS, no publicly hosted services at all (maybe not even ssh)
  4. Simplify access to my services in general. Generally just want to be able to e.g. type the same URL and access a service, regardless of whether I'm at home or on a public network. But there are probably other solutions for this point alone.
[-] ZWQbpkzl@hexbear.net 4 points 10 months ago

I have the exact same use case and I use headscale on a VPS + tailscale on my devices.

I haven't figured out how to give lay-friends access though. I can make them a user in headscale but it seems cumbersome to make them use tailscale to connect. Wireguard directly seems even more cumbersome.

[-] wheresmysurplusvalue@hexbear.net 2 points 10 months ago

During my research I came across ngrok, maybe this could be useful in your situation. I also came across zrok, which seems like an open source version of the same thing based on OpenZiti. Both of them seem like ways to give public portals to your private services. So you could give your friends access that way without them needing to use a VPN.

[-] ZWQbpkzl@hexbear.net 2 points 10 months ago* (last edited 10 months ago)

Update: I found a guide to use traefik to tunnel into the VPN. Idea is:

  1. Setup headscale behind traefik on a VPS.
  2. Connect all my local devices to the tailnet.
  3. Connect to the VPS to the tailnet. So its running both headscale and tailscale.
  4. Traefik can now proxy to any device on the tailnet.

Step 1 however is a gigantic pain in the ass. Traefik is overkill for anything non-enterprise. It was just three lines of Caddyfile to make it work with Caddy.

http://hs.example.com {
  reverse_proxy * http://localhost:8282
}

Step 4 is almost exactly the same

http://app.example.com {
  reverse_proxy * http://node:8080
}

You can also use tailscale funnel instead any reverse proxy but then your exposing ports not sub domains. And whatever service you're funneling to is responsible for SSL.

[-] ZWQbpkzl@hexbear.net 1 points 10 months ago

:now-this-is-pod-racing:

this post was submitted on 19 Apr 2024
21 points (100.0% liked)

technology

23559 readers
28 users here now

On the road to fully automated luxury gay space communism.

Spreading Linux propaganda since 2020

Rules:

founded 4 years ago
MODERATORS