I’ve made a few posts in the past about my experimentation with connecting various devices and servers over a VPN (hub and spoke configuration) as well as my struggles adapting my setup towards a mesh network.
I recently decided to give a mesh setup another go. My service of choice is Nebula. Very easy to grasp the system and get it up and running.
My newest hurdle is now enabling access to the nebula network at the same time as being connected to my VPN service. At least on iOS, you cannot utilize a mesh network and a VPN simultaneously.
TLDR: Is it a bad or a brilliant idea to connect my iOS device to a nebula mesh network to access for example my security camera server, as well as route all traffic/web requests through another nebula host that has a VPN such as mullvad on it so I can use my phone over a VPN connection while still having access to my mesh network servers?
You need a VPN that can split tunnel by ip via CLI (although I think it’s also possible to set it up in an ovpn file, but I haven’t tried it). The only one I’ve found that can do this natively is proton, specifically the python community version.
I don’t know how this next part works if you use something that isn’t tailscale, but if you do then just set proton’s split tunneling for 100.64.0.0/10
Then, still on this machine, advertise the exit node from tailscale (you also have to allow it from your tailscale admin console). Connect to it from your phone, making sure to use the server as an exit node, and head over to ip.me to see if it’s working
I’ve done this with Tailscale and a VPS running WireGuard on one interface and Tailscale on another on Alpine Linux. I just set up routing so that any Internet traffic coming from tailscale0 is masqueraded/NAT over the wg0 interface. It took me months of screwing around to figure it all out, but I can provide all the necessary commands here if anyone wishes.
It should be generic enough to use with any two interfaces given one is your “internal” VPN and another is some other VPN (probably from a commercial offering).
You are not logged in. However you can subscribe from another Fediverse account, for example Lemmy or Mastodon. To do this, paste the following into the search field of your instance: !selfhosted@lemmy.world
A place to share alternatives to popular online services that can be self-hosted without giving up privacy or locking you into a service you don’t control.
Rules:
Be civil: we’re here to support and learn from one another. Insults won’t be tolerated. Flame wars are frowned upon.
No spam posting.
Posts have to be centered around self-hosting. There are other communities for discussing hardware or home computing. If it’s not obvious why your post topic revolves around selfhosting, please include details to make it clear.
Don’t duplicate the full text of your blog or github here. Just post the link for folks to click.
Submission headline should match the article title (don’t cherry-pick information from the title to fit your agenda).
No trolling.
Resources:
selfh.st Newsletter and index of selfhosted software and apps
You need a VPN that can split tunnel by ip via CLI (although I think it’s also possible to set it up in an ovpn file, but I haven’t tried it). The only one I’ve found that can do this natively is proton, specifically the python community version.
I don’t know how this next part works if you use something that isn’t tailscale, but if you do then just set proton’s split tunneling for 100.64.0.0/10
Then, still on this machine, advertise the exit node from tailscale (you also have to allow it from your tailscale admin console). Connect to it from your phone, making sure to use the server as an exit node, and head over to ip.me to see if it’s working
I’ve done this with Tailscale and a VPS running WireGuard on one interface and Tailscale on another on Alpine Linux. I just set up routing so that any Internet traffic coming from
tailscale0is masqueraded/NAT over thewg0interface. It took me months of screwing around to figure it all out, but I can provide all the necessary commands here if anyone wishes.It should be generic enough to use with any two interfaces given one is your “internal” VPN and another is some other VPN (probably from a commercial offering).