Comment

Comment on VPNs, self hosting & security

Tsubodai@programming.dev ⁨11⁩ ⁨months⁩ ago

I definitely didn’t set up any port forwarding or routing tables when setting up the inbuilt VPN.

Tailscale is great, and very handy to edit my compose files from, for example, work. But I didn’t think I could use it to access my services?

I’ve become pretty familiar with docker over the years, so I’m tempted to spin up a container just to see how it works.

I currently expose around 20 services through the reverse proxy, but only those ones that I can set a user/password for.

I don’t mind investing the time to learn more about all this. Networking stuff has always been akin to dark magic for me, it’s time to jump in…

Thanks!

source

Sort:hotnew top

lemmyvore@feddit.nl ⁨11⁩ ⁨months⁩ ago
Tailscale is great, and very handy to edit my compose files from, for example, work. But I didn’t think I could use it to access my services?

Tailscale has two features that can optionally expose a node to the LAN (subnets) and to the Internet (exit node).

You can use the subnets feature. You can install a Tailscale container on the NAS, mark it as using the subnets feature, and then you have two options:

Use the “host” network mode on the Tailscale container, which will give it access to your NAS machine’s host network interfaces, and set up the subnet mask to your LAN’s subnet. You will be able to access your services on the NAS’s LAN IP and whatever service ports you expose to the host, just as if you were on the LAN.

You leave the Tailscale container to use a private docker network, you create a “tailscale” docker network, you declare the Tailscale subnet as the docker network subnet, and you connect to it the Tailscale container plus any other containers that you want to access (in their docker compose files). This is more secure (in the absolute, abstract sense) because Tailscale traffic doesn’t pass through the LAN, and you only expose a short explicit list of containers to Tailnet. On the other hand you have to juggle container network names, and it just makes things more complicated.
source
Guadin@k.fe.derate.me ⁨11⁩ ⁨months⁩ ago
In that case, enjoy! It's a great feeling when you get it working.

If you're going to do it on your synology, see if you need to fix the TUN error. Also, you need to add ip routes to your synology to have the IP's from your VPN on docker forwarded to docker. Make sure these are persistent or added on every startup.

Make sure you allow the VPN to work by adding it to the synology firewall.

You need to setup port forwarding on your router. It needs to point to your synology to the port which is linked to the docker container. You also need to add the route to your router to be able to access your network. For instance, if your VPN has 10.0.3.* and your LAN uses 10.0.0., your LAN/router won't know where to send the response packets to the VPN network. So when connected to your VPN you will never be able to load stuff. If you add that 10.0.3. needs to route to your synology, and your synology knows that range needs to be routed to the Docker VPN container everybody knows where it needs to go.

source
- Tsubodai@programming.dev ⁨11⁩ ⁨months⁩ ago
  Brilliant, many thanks!
  
  source