Since Tailscale was founded in 2019, customers have been forced to choose between either Tailscale or Mullvad without the ability for them to co-exist.
Since Tailscale was founded in 2019, customers have been forced to choose between either Tailscale or Mullvad without the ability for them to co-exist.
Today we announce a partnership with Tailscale that allows you to use both in conjunction through the Tailscale app. This functionality is not available through the Mullvad VPN app.
This partnership allows customers of Tailscale to make use of our WireGuard VPN servers as “exit nodes”. This means that whilst connected to Tailscale, you can access your devices across Tailscale’s mesh network, whilst still connecting outbound through Mullvad VPN WireGuard servers in any location.
Edit: Don’t be intimidated by the word “advanced”. I struggled with this a bit at first (was also adapting it to use at home instead of on a VPS that’s tunneling to home) but I got it working eventually and learned a lot in the process. Willing to assist folks who want to set it up.
Set Gluetun up to connect to your VPN (they support a huge number of providers) and then set the Tailscale container to use the Gluetun’s network. Then, use that Tailscale container as your exit node.
As an aside, I wish technical documents like this would stop saying “Wireguard client” and “Wireguard server”. Wireguard doesn’t have clients and servers - everyone is a peer, and whether you can route through the peer or not is just based on the routing table and nftables/iptables rules.
The issue with Tailscale is that in phone it uses the VPN and you are not able to a vpn or a Adblock service like Adguard. But now I believe it will be interesting to have a exit node with Mullvad vpn to block all shit on all devices inside the tailscale nerwork . Another good thing of tailscale it makes services like jellyfin, plex and syncthing easier.
I use tailscale with next dns, it works great. I don’t use magic DNS, however, but it’s a trade off I’m okay with for the benefit of blocking at the edge
I’m not the guy you asked but I do the same thing. In the tailscale dashboard you can set up a default DNS for every device that is connected to your tailnet. They support nextdns and a couple other things. I have mine pointed to my personal adgaurd home server that is within my tailnet and it works great. I used nextdns for a while but didn’t want to pay for it. It also worked great with tailscale.
Do people use Tailscale to be able to access local things on their network like Plex media servers when they’re not home? Tailscale looks interesting but I haven’t found a usecase where it would benefit me
It’s accessing literally anything you self host from home, with minimal latency and without any port forwarding on your router or exposing your services to the Internet.
It’s primary benefit is how fast it is, how much easier it is to set up for even the most novice of users, and how ubiquitous all the clients are.
Plus it’s free for 100 endpoints, which is far more than most individuals will need for home labs. And even that you can get around by using subnet routing.
If you’ve ever wanted to run your own sort of Dropbox or Google docs (Syncthing/Next cloud) but didn’t want to deal with the security hassle of exposing it to the Internet, this removes that completely. No more struggling with open ports, fail2ban, or messing with reverse proxies.
Plex probably isn’t the best example, but yes, you can use Tailscale to create a sort of mesh network to access devices within private networks. Essentially any device that’s connected to tailscale can be contacted by other clients connected to tailscale. There are extra routing things you can do to use a tailscale device as a sort of “exit node”, but that’s the basic gist.
I don’t really use it for this, but here are some things I do use it for:
metrics scraping on servers without needing to open ports or worry about ssl encryption. Works great for federating Prometheus instances or scraping exporters
secure access to machines not directly exposed to the internet. I.e. ssh access to my home box while I’m traveling
being an exit node for web traffic while traveling. I.e. maybe you are traveling and have a bank who is giving you grief about logging in – masquerade that connection from your home IP
Could somebody help me out? I setup Tailscale on my media server box, trying to use it alongside Windscribe has basically bricked ssh on the box. With this news, am I to understand that Tailscale will not work with any vpn other than mullvad?
I don’t know what’s up on your case, but I would not jump to the conclusion that it’s impossible to use tailscale with any other VPN in any circumstance.
Rather, tailscale and Mullvad will now work easily and out of the box. For other VPNs, you may need to do understand the topology and routing of virtual devices and have the technical ability and system permissions to make deep networking changes.
So I’d expect one can probably find a way for most things to coexist on a Linux server. On a non-rootrr android phone? I’m less confident.
In Tailscale you can set up an exit node which lets you access the entire internet via its internet connection.
You could set up an exit node that would let you access the internet via some (anonymizing) VPN providers like Mullvad or any other.
This sounds like Tailscale is simply setting up this exit node for Mullvad on their side and providing it as a service. So it’s not like using another VPN anonymizers is impossible, it’s just convenient to use Mullvad.
Wow this is great. I’ve been having trouble getting exit nodes working properly with these two. Sad that mullvad dropped port forwarding though so I’m not sure if I’ll stay with them.
I’m pretty sure it’s entirely disabled. Their announcement post says it’s being removed and doesn’t call out any exceptions.
I run my clients through a gluetun container with forwarding set up and ever since their announced end of support date (July I think?) I have had 0B uploaded for any of my trackers.
Yeah the Proton VPN gui app for Linux does not include port forwarding. I believe only their Windows app does at the moment. However, if you use their Wireguard certs and then follow their port forwarding instructions, it works quite well. Make sure you either disable IPv6 on your system or set IPv6 to link-local and add ::/0 to AllowedIPs, otherwise your IPv6 will leak since ProtonVPN does not support IPv6 at the moment.
Yeah I’ve been using it for about a year and half or so on my main devices and it’s been wonderful. I’m likely going to down the list of supported providers from the gluetun docs and decide from there. Throwing my torrents and all that behind a vpn was the catalyst for signing up so I’ll continue to look for that support first and everything else is secondary.
I have the utmost respect and appreciation for mullvad but I don’t need a vpn without port forwarding so I cancelled my sub. They are still objectively the vest vpn, this is the only sticking point.
You need it for file sharing apps like BitTorrent or Soulseek, if you don’t want to be seen as a leech, and/or you want to use private trackers where you need to maintain a good ratio. :)
Most private trackers don’t allow you to browse the tracker site from a shared VPN, but I’ve never seen one that doesn’t allow your torrent client to connect over one. That would make no sense.
I haven’t personally seen a private tracker that blocks your actual bittorrent announces to the tracker with a VPN, though I know a couple prevent you from browsing the site itself with one.
Why would you use a seedbox if you have a home server? The home server can be the seedbox. A lot of homelabbers would have a good enough connection for it.
Edit: Using a VPN with port forwarding, of course.
Generally when you download files over torrent through your ISP, you end up getting love letters from rightsholders. I personally use a homelab NAS as my seedbox and for my public tracker stuff (as well as anime downloads over XDCC) I use Mullvad. I don’t seed overly much on public trackers because of it, but my ratio on private trackers is sky high because ISPs won’t send love letters for private trackers.
Another use case (in addition to the BitTorrent use case) is if you want to host a site but hide your IP. You can run Nginx and configure it to listen on a port the VPN service has allocated to you. Good VPN services like AirVPN let you choose ports, and those ports are always allocated to you.
sure illegal content can be accessed over a vpn without port forwarding, but when someone is hosting a child porn site over a mullvad ip, that is clearly a larger problem
Yeah, I assume the kind of people that runs a VPN doesn’t mind copyright infringement that much, but any sane person wouldn’t like to contribute to the distribution of CSAM even if they are legally not doing anything wrong.
That’s one of the main issues that criminals are more likely tonvalue privacy (for survival) than the average user that considers it a plus. And by criminal it can stretch from benign stuff like copyright infringement to being a hitman.
I always wanted this mesh feature in mullvad. But how this works with privacy? I mean, does the combination with a user loged service like tailscale diminish the privacy of anonymous mullvad accounts?
You are not logged in. However you can subscribe from another Fediverse account, for example Lemmy or Mastodon. To do this, paste the following into the search field of your instance: !selfhosted@lemmy.world
A place to share alternatives to popular online services that can be self-hosted without giving up privacy or locking you into a service you don’t control.
Rules:
Be civil: we’re here to support and learn from one another. Insults won’t be tolerated. Flame wars are frowned upon.
No spam posting.
Posts have to be centered around self-hosting. There are other communities for discussing hardware or home computing. If it’s not obvious why your post topic revolves around selfhosting, please include details to make it clear.
Don’t duplicate the full text of your blog or github here. Just post the link for folks to click.
Submission headline should match the article title (don’t cherry-pick information from the title to fit your agenda).
No trolling.
Resources:
selfh.st Newsletter and index of selfhosted software and apps
I’m glad these two great companies found their way together, love to see it!
Acronyms, initialisms, abbreviations, contractions, and other phrases which expand to something larger, that I’ve seen in this thread:
8 acronyms in this thread; the most compressed thread commented on today has 11 acronyms.
[Thread #116 for this sub, first seen 7th Sep 2023, 21:05] [FAQ] [Full list] [Contact] [Source code]
Good bot
If anyone wants to achieve something similar without using Tailscale or with alternative VPN providers, the setup outlined in this LSIO guide is pretty neat: https://www.linuxserver.io/blog/advanced-wireguard-container-routing
Edit: Don’t be intimidated by the word “advanced”. I struggled with this a bit at first (was also adapting it to use at home instead of on a VPS that’s tunneling to home) but I got it working eventually and learned a lot in the process. Willing to assist folks who want to set it up.
You can also achieve this with any VPN by using two Docker containers:
Set Gluetun up to connect to your VPN (they support a huge number of providers) and then set the Tailscale container to use the Gluetun’s network. Then, use that Tailscale container as your exit node.
You can also combine this with a self-hosted Headscale (https://github.com/juanfont/headscale) instance.
As an aside, I wish technical documents like this would stop saying “Wireguard client” and “Wireguard server”. Wireguard doesn’t have clients and servers - everyone is a peer, and whether you can route through the peer or not is just based on the routing table and nftables/iptables rules.
The issue with Tailscale is that in phone it uses the VPN and you are not able to a vpn or a Adblock service like Adguard. But now I believe it will be interesting to have a exit node with Mullvad vpn to block all shit on all devices inside the tailscale nerwork . Another good thing of tailscale it makes services like jellyfin, plex and syncthing easier.
I use tailscale with next dns, it works great. I don’t use magic DNS, however, but it’s a trade off I’m okay with for the benefit of blocking at the edge
Sound interesting. Can you tell me how do you configure it and if you did it in both android and iOS? Thank you
https://tailscale.com/kb/1218/nextdns/
Easy to set up, mine is working great.
Yeah found the guide after looking around . Ty
I’m not the guy you asked but I do the same thing. In the tailscale dashboard you can set up a default DNS for every device that is connected to your tailnet. They support nextdns and a couple other things. I have mine pointed to my personal adgaurd home server that is within my tailnet and it works great. I used nextdns for a while but didn’t want to pay for it. It also worked great with tailscale.
Thank you!
Do people use Tailscale to be able to access local things on their network like Plex media servers when they’re not home? Tailscale looks interesting but I haven’t found a usecase where it would benefit me
I use it to reach all of my services when I go out.
I’ve audiobooks, RSS, music, and cloud.
Yes, exactly that.
I use it to SSH into my devices all the time.
It’s accessing literally anything you self host from home, with minimal latency and without any port forwarding on your router or exposing your services to the Internet.
It’s primary benefit is how fast it is, how much easier it is to set up for even the most novice of users, and how ubiquitous all the clients are.
Plus it’s free for 100 endpoints, which is far more than most individuals will need for home labs. And even that you can get around by using subnet routing.
If you’ve ever wanted to run your own sort of Dropbox or Google docs (Syncthing/Next cloud) but didn’t want to deal with the security hassle of exposing it to the Internet, this removes that completely. No more struggling with open ports, fail2ban, or messing with reverse proxies.
That’s super convenient
Plex probably isn’t the best example, but yes, you can use Tailscale to create a sort of mesh network to access devices within private networks. Essentially any device that’s connected to tailscale can be contacted by other clients connected to tailscale. There are extra routing things you can do to use a tailscale device as a sort of “exit node”, but that’s the basic gist.
I don’t really use it for this, but here are some things I do use it for:
I mostly just use it for metrics scraping though
Not Plex, but yes. I use it with Microsoft Remote Desktop if I need to access a work-related computer that I keep at home while traveling.
I also use it for the more typical use case of a cloud server that I can ssh into even though it exposes zero ports publicly.
Could somebody help me out? I setup Tailscale on my media server box, trying to use it alongside Windscribe has basically bricked ssh on the box. With this news, am I to understand that Tailscale will not work with any vpn other than mullvad?
I just it with protonVPN on Linux with no issue.
I don’t know about exit node on Tailscale because I don’t use it but the rest is working absolutely fine.
I don’t know what’s up on your case, but I would not jump to the conclusion that it’s impossible to use tailscale with any other VPN in any circumstance.
Rather, tailscale and Mullvad will now work easily and out of the box. For other VPNs, you may need to do understand the topology and routing of virtual devices and have the technical ability and system permissions to make deep networking changes.
So I’d expect one can probably find a way for most things to coexist on a Linux server. On a non-rootrr android phone? I’m less confident.
In Tailscale you can set up an exit node which lets you access the entire internet via its internet connection.
You could set up an exit node that would let you access the internet via some (anonymizing) VPN providers like Mullvad or any other.
This sounds like Tailscale is simply setting up this exit node for Mullvad on their side and providing it as a service. So it’s not like using another VPN anonymizers is impossible, it’s just convenient to use Mullvad.
Well that’s awesome news.
Wow this is great. I’ve been having trouble getting exit nodes working properly with these two. Sad that mullvad dropped port forwarding though so I’m not sure if I’ll stay with them.
Yeah I swapped over to ProtonVPN after they dropped support for port forwarding. Shame really because I did really enjoy Mullvad’s VPN service.
Does the port forwarding works on Linux CLI? Last time I checked it was only through their GUI app
I’m pretty sure it’s entirely disabled. Their announcement post says it’s being removed and doesn’t call out any exceptions.
I run my clients through a gluetun container with forwarding set up and ever since their announced end of support date (July I think?) I have had 0B uploaded for any of my trackers.
E: realized you may be asking about proton, oops
Yeah the Proton VPN gui app for Linux does not include port forwarding. I believe only their Windows app does at the moment. However, if you use their Wireguard certs and then follow their port forwarding instructions, it works quite well. Make sure you either disable IPv6 on your system or set IPv6 to link-local and add
::/0to AllowedIPs, otherwise your IPv6 will leak since ProtonVPN does not support IPv6 at the moment.Yeah I’ve been using it for about a year and half or so on my main devices and it’s been wonderful. I’m likely going to down the list of supported providers from the gluetun docs and decide from there. Throwing my torrents and all that behind a vpn was the catalyst for signing up so I’ll continue to look for that support first and everything else is secondary.
Well hot damn this is pretty awesome
fwiw I’ve been using cloudflare tunnels with mullvad for almost a year and never had problems accessing my stuff.
I have the utmost respect and appreciation for mullvad but I don’t need a vpn without port forwarding so I cancelled my sub. They are still objectively the vest vpn, this is the only sticking point.
What does port forwarding gain you on a VPN? Sorry if the question is ignorant
You need it for file sharing apps like BitTorrent or Soulseek, if you don’t want to be seen as a leech, and/or you want to use private trackers where you need to maintain a good ratio. :)
Most private trackers don’t allow a shared VPN like Mullvad anyway. Some do but most don’t.
Most private trackers don’t allow you to browse the tracker site from a shared VPN, but I’ve never seen one that doesn’t allow your torrent client to connect over one. That would make no sense.
I haven’t personally seen a private tracker that blocks your actual bittorrent announces to the tracker with a VPN, though I know a couple prevent you from browsing the site itself with one.
Then you can just use a seed box on top of your downloading
You’re putting a lot of trust into these services that can just disappear one day. I’d rather rely on my own TrueNAS system, thanks.
Why would you use a seedbox if you have a home server? The home server can be the seedbox. A lot of homelabbers would have a good enough connection for it.
Edit: Using a VPN with port forwarding, of course.
It can still ruin your ping when downloading.
Not if you properly setup your limits… and symmetrical fiber has become much more common.
Generally when you download files over torrent through your ISP, you end up getting love letters from rightsholders. I personally use a homelab NAS as my seedbox and for my public tracker stuff (as well as anime downloads over XDCC) I use Mullvad. I don’t seed overly much on public trackers because of it, but my ratio on private trackers is sky high because ISPs won’t send love letters for private trackers.
For the record, I’m pretty sure using Mullvad for XDCC is super overkill, but I wanted to have an excuse to break out userspace wireguard in a project and writing it all in Go made it so damn easy: https://github.com/Xe/x/commit/3d0647e946014516df33de0b18d2a16eec835bed
That’s why you use a VPN that allows port forwarding.
From what I’ve read you need it for Bittorrent or at least the chance of failed downloads is higher without it.
Another use case (in addition to the BitTorrent use case) is if you want to host a site but hide your IP. You can run Nginx and configure it to listen on a port the VPN service has allocated to you. Good VPN services like AirVPN let you choose ports, and those ports are always allocated to you.
although people hosting illegal content using port forwarding is likely one of the reasons they removed it, so its a tricky problem
One of the main reasons people use VPNs is for illegal content… Port forwarding doesn’t change that.
sure illegal content can be accessed over a vpn without port forwarding, but when someone is hosting a child porn site over a mullvad ip, that is clearly a larger problem
Yeah, I assume the kind of people that runs a VPN doesn’t mind copyright infringement that much, but any sane person wouldn’t like to contribute to the distribution of CSAM even if they are legally not doing anything wrong.
That’s one of the main issues that criminals are more likely tonvalue privacy (for survival) than the average user that considers it a plus. And by criminal it can stretch from benign stuff like copyright infringement to being a hitman.
Did they change something? I’ve been port forwarding for a couple of years now.
https://mullvad.net/en/blog/2023/5/29/removing-the-support-for-forwarded-ports/
They removed port forwarding back in July
https://mullvad.net/en/blog/2023/5/29/removing-the-support-for-forwarded-ports/
I think it was something todo with CSAM hosting. It’s shit but understandable to why they removed it
https://mullvad.net/en/blog/2023/4/20/mullvad-vpn-was-subject-to-a-search-warrant-customer-data-not-compromised/
https://mullvad.net/en/blog/2023/5/2/update-the-swedish-authorities-answered-our-protocol-request/
Well. That’s what I get for using a service without giving them my email and not checking their blog.
Yeah, unfortunately because of this decision from Mullvad, they also lost me as customer and I had to move to another.
It kinda sucks because I loved Mullvad. They had great servers, customer service, and I do like their Android & Linux program.
Yeah, sorry, still turning elsewhere since port forwarding a no go.
I always wanted this mesh feature in mullvad. But how this works with privacy? I mean, does the combination with a user loged service like tailscale diminish the privacy of anonymous mullvad accounts?
I think it’s diminished, yes. Regardless of whatever PR spin they might pull, I don’t think there’s any way around it.
Only available in a few countries, not in Latin America. It is not mentioned anywhere.