Leebra selfhosted
login register

Tailscale + VPN possible?

3 years ago by Lunch to c/selfhosted

save

share

report

Hi peeps, a little lost in the self-hosting world right now, and hoping someone can point me in the right direction.

I've just set up all the *arr apps that i want and need for media, music and books. And am at the step where i am supposed to bind a VPN to my qBittorrent. However, I am ofc running everything behind the beloved Tailscale. But just realised I am not allowed to run tailscale at the same time as another VPN(ProtonVPN in my case).

How do i get past this cross-road? I really want to stick with using Tailscale for accessing my services.

Is a reverse proxy something i should look into instead? I need my server to sit behind a VPN..

Appreciate any tips or tricks for how other people solved this buckle.

charizardcharz 15 points 3 years ago

Tailscale was updated with direct support for Mullvad, but since you already have Proton I'm guessing you wouldn't want to switch.

If you're using containers, you can have one container with your VPN and route traffic from specific containers through the VPN container. You can then have tailscale on the host system.

There's a quick guide on setting up the VPN part here. Tailscaile you set up normally.

save

path: 0 3670912, hotness: undefined, score: 15, children: 8
LunchEnjoyer 11 points 3 years ago

save

path: 0 3670912 3672338, hotness: undefined, score: 11, children: 1
charizardcharz 3 points 3 years ago

That's great to hear! Gluetun looks interesting, I'll check it out and maybe migrate if it works for me.

save

path: 0 3670912 3672338 3672743, hotness: undefined, score: 3, children: 0
ShinyBook 2 points 3 years ago

Have you figured out how to use the Mullvad VPN from Tailscale for a similar setup like you've linked? I cannot figure out how to get a tailscale docker container to properly connect to an exit node.

save

path: 0 3670912 3680602, hotness: undefined, score: 2, children: 2
charizardcharz 1 point 3 years ago

I have Tailscale directly installed on the host and I don't use Mullvad so I haven't tried that setup myself.

Looks like you would need to set the TS_EXTRA_ARGS environment variable in your container to --exit-node= --exit-node-allow-lan-access=true with the exit node name or ip of the Mullvad node. I haven't tried this myself though.

save

path: 0 3670912 3680602 3693247, hotness: undefined, score: 1, children: 0
keyez 1 point 3 years ago

I use a binhex-privoxyvpn container with a mullvad wireguard config in there. That's for my server and containers at least.

save

path: 0 3670912 3680602 3697065, hotness: undefined, score: 1, children: 0
notfromhere 2 points 3 years ago

Do you know how it works with tailscale lock?

save

path: 0 3670912 3671293, hotness: undefined, score: 2, children: 2
charizardcharz 2 points 3 years ago

I haven't used that feature so I can't really say, but I don't see how it would affect it. You're not modifying anything on the tailscale side and you're not adding nodes to your tailnet, you only have the same one for the host system.

save

path: 0 3670912 3671293 3672711, hotness: undefined, score: 2, children: 1
notfromhere 2 points 3 years ago

I subscribed to the mullvad addon to try it out and saw about 30+ mullvad nodes waiting to be signed, probably signed due to the lock. That got me thinking I probably want to configure the NACL so the mullvad nodes I allow on my tailnet are not able to initiate any connections to my other nodes. I didn’t see any documentation on my setup so cancelled the mullvad addon until I have time to dig into it more.

save

path: 0 3670912 3671293 3672711 3672784, hotness: undefined, score: 2, children: 0
qaz 10 points 3 years ago

Tailscale and Mullvad (VPN company) advertise their compatibility and there is an article that goes into further detail. Of course it’s also possible to setup Wireguard yourself and use a VPN service.

save

path: 0 3670366, hotness: undefined, score: 10, children: 3
festus 3 points 3 years ago

I have a Wireguard network setup for my devices that routes through my somewhat distant server. I find when I have both it and Tailscale open, Tailscale tries routing through Wireguard even though both devices might be on the same LAN. Unfortunately I don't believe Tailscale has a way to forbid it from routing over other VPNs or networks.

save

path: 0 3670366 3670642, hotness: undefined, score: 3, children: 1
averagedrunk 2 points 3 years ago

I have a Tailscale subnet router set up locally and added the remote IPs to my router. Tailscale on every device was a crapshoot as to whether it would route locally or through the VPN.

I asked support and they said it should be on every device. Could be something else on my network forcing it to act like that but I don't have enough give-a-shit in me to troubleshoot it.

save

path: 0 3670366 3670642 3675479, hotness: undefined, score: 2, children: 0
LunchEnjoyer 3 points 3 years ago

As much as this would be super neat, I just paid for the Proton subscription... having me reconsider though :P

save

path: 0 3670366 3670828, hotness: undefined, score: 3, children: 0
ErwinLottemann 1 point 3 years ago

what do you mean by 'not allowed to run tailscale at the same time'? who does not allow it? or is it something technical? if it is - you absolutely can 'run' multiple vpn on the same machine at the same time.

save

path: 0 3678997, hotness: undefined, score: 1, children: 1
LunchEnjoyer 2 points 3 years ago

save

path: 0 3678997 3681296, hotness: undefined, score: 2, children: 0
qaz 1 point 3 years ago

save

path: 0 3670354, hotness: undefined, score: 1, children: 0
nyakojiru 0 points 3 years ago

Tailscale + Mullvad They support just a few countries (ignored poor ones), you have to provide your billing address, credit card, full name … and they don’t look very motivated to support more countries. I don’t like the model of these guys.

save

path: 0 3676418, hotness: undefined, score: 0, children: 0
selfhosted
selfhosted

@lemmy.world

login for more options
63043
6824
6218

A place to share alternatives to popular online services that can be self-hosted without giving up privacy or locking you into a service you don't control.

Rules:

Detailed Rules Post

  1. Be civil.

  2. No spam.

  3. Posts are to be related to self-hosting.

  4. Don't duplicate the full text of your blog or readme if you're providing a link.

  5. Submission headline should match the article title.

  6. No trolling.

  7. Promotion posts require active participation, with an account that is at least 30 days old. F/LOSS without a paywall has exceptions, with requirements. See the rules link for details. Tags [CBH] or [AIP] are required, see the links in Rule 8 for details.

  8. AI-related discussions and AI-involved promotional posts have additional requirements for tagging, as noted in Rule 7 and the AI & Promotional Post Expanded Rules post, and find example disclosures here.

Resources:

Any issues on the community? Report it using the report flag.

Questions? DM the mods!

go to feed...