• 2 Posts
  • 91 Comments
Joined 1 month ago
cake
Cake day: June 4th, 2024

help-circle



  • I use Tailscale to do this. I install the software on everything I can, but for resources on the LAN that don’t have Tailscale running I use its Subnet Router feature to masquerade the traffic and connect to those clients.

    As for the commercial VPN, it’s a bit more involved. I have a few Exit Nodes (VPS) that take incoming Tailscale traffic destined to the Internet and re-route it via the commercial VPN’s WireGuard network interface.

    This was a huge challenge for me (lots of iptables, ip6tables rules) but I have it down to a reproducible script I can provide if you’d like an example.

    My next goal is to containerize the two VPS servers into one with Docker. Tailscale is a bit annoying that you can’t have multiple Nodes running on the same machine (hence my temporary two VPS solution).

    Note: capitalized terms are Tailscale feature names





  • You won’t be “on a different local network,” you’ll be accessing specific networks (or subnets) via the VPN tunnel rather than some other network interface on your machine.

    So if you’re at home with a 192.168.0.0/24 network and you want to access an office resource on the 192.168.141.0/24 network, likely what will happen is your machine with have a route to 192.168.131.0/24 via the network the VPN provides (let’s just say 10.0.0.1).

    Depending on how everything’s configured, the server you’re accessing might see it coming from the VPN server (masquerade) or it could very well be passed on as-is (which would only work if the server has a routing table back to you via the VPN).

    Typically when people use VPNs for internet access, the traffic is sent out masqueraded so that it appears to come from the VPN’s WAN IP address.




  • That’s a good point too.

    I’m primarily a web developer so essentially my entire toolkit is already FOSS and it doesn’t make sense to even run half of it on Windows. Windows is usually the odd one out with weird hacks to make it play nice.

    I use macOS a lot too and because it’s UNIX my Linux toolset is available and ported to the OS with (what I understand to be) minimal changes.

    And I’ve never needed to deploy to some Windows Server either (the thought frightens me).