Which route did you go for your homeland, a tunnel to your services or setting up tail scale/wireguard and access them on your trailer?
Both.
I have a free vps providing me a public IPv4 address, connected to my opnsense router via tailscale, and use a simple port forward from the VPs to the router’s tailscale IP.
I have certain port/connections coming in either via the tailscale IP or my external IPv6 address all forwarded to my internal Caddy reverse proxy which itself is only running IPv4.
And I use cloudflare for my dynamic DNS resolution of my domain. A records are my public VPS IPv4 and AAAA are my own public IPv6 addresses respectively.
If/when I change to a service provider that doesn’t use CGnat for IPv4, I can stop doing the forwarding from my VPS.
That’s so we can stream music/video without needing to use the VPN.
But, I also run tailscale on my phone, so I can do admin stuff remotely from it, albeit painfully, on this small screen when things break. 🤣
Wireguard.
Dunno if Cloudflare does effective auth for the tunnel or if you have to set that up yourself, but I don’t bother trying to expose services to the internet in any way because some of this stuff was just never designed for proper web security (cough Jellyfin).
It’s still worth setting up a wildcard cert with ACME so you get nice https and a real domain.
Cloudflare has some opt-in auth. Mail-OTP is a nice balance imo: You can allowlist mail addresses per service/subdomain and set expiry for each. Then for access, you first have to enter the mail address, get the OTP and then access the service.
So, nobody without access to allowed mail addresses even gets to knock on you door.
But yeah, that’s why I think about going tail scale: why bother having something exposed when not needed?
I just think, some services might be nice to provide to friends, too - and having them connect to my tailnet for this is a bit too much friction, I guess
How about both? I run the evil Cloudflare Tunnels/Zero Trust with Tailscale as an overlay on the server.
I’m a bit stumped, what do you gain from this setup?
Or do you mean just running some services through the tunnel for easy access and “hide” others behind tailscale?
Pangolin on a free Oracle VPS.
