No more Cloudflare Tunnels for me...

[@dominick253]

I just have a pigeon carry a usb stick to the server. A bit of a hassle to setup but at least I don't have to deal with cg nat!

[@RaidOwl]

This is the optimal way

[@benji_games_]

Jeff Geerling would agree

[@kwith]

Oh your latency must suck! Also, error correction would be a royal pain in the ass too huh?

[@Henry-sv3wv]

@@kwithAnd there are Hawks out there that try to DoS you!

[@CharlesTillerman-m6l]

Kkk

[@pieterrossouw8596]

Tailscale is such a killer solution. We have the enterprise license for work and it eliminated so many time consuming tasks. At home it's running on my Apple TV acting as a subnet router - probably the most set-and-forget and low power solution out there.

[@nghiainthecloud]

To top this, we can self-host Tailscale server with Headscale open-source project.

[@pieterrossouw8596]

@@nghiainthecloud yes headscale is great too if you don't mind the extra management effort.

[@RichardSpragueSpike]

For my jellyfin server I set up a ssh tunnel to an Oracle Cloud instance via a cobbled-together autossh docker service. I'm pretty proud of it, and I learned how to make docker containers in the process. This setup looks a lot cleaner though.

[@NetBandit70]

Shhh. Don't talk about OCI always free tier. He has $43/mo VPS sponsors.

[@darthkielbasa]

@@NetBandit70only our savior owl reads the comments.

[@marlo-ji]

​​@@NetBandit70OCI is $hit. My instances were destroyed 3 times without any reason.

[@ravi2048]

I use RatHole on one of my OCI instance

[@RaidOwl]

Lol idgaf what you use but they give me credits so I use them

[@eliasalcazar6554]

THANK YOU for this. I setup Cloud Flare tunnels before realizing their limits on media types. Very easy to follow, and plus you gave me an excuse to spin up a Linode VPS and play around with it!

[@darthkielbasa]

Been using tailscale within my lab for a bit over a year. Solid bit of kit.

[@RaidOwl]

Big tru

[@TommasoMinuto]

hey , I religiously followed this setup but when I try to reach the service on my server behind cg nat I get a 502 bad gateway. any idea what I could have possibly messed up?

[@shephusted2714]

this was a good evolution - rproxy over wireguard to nginx from apache works well - fairly basic after you wrap your brain around it

[@Glatze603]

Using netbird instead of tailscale because it is completely open source and it can completely be self hosted. I'm still thinking about how I can make it so that the Nginx Proxy Manager web interface (port 81) can only be accessed via the private tunnel and not via the Internet. Shouldn't really be a problem. This would mean that it would no longer be a tragedy that Nginx does not support MFA.

[@3xpired3lements]

Pro tip: Just don't use nginx proxymanager if you care about security. They don't have security policies and there have been really bad cases in the past where critical vulnerabilities have just been ignored. It's basically a one man org, which isn't necessarily bad, but there is also no one reviewing the PRs and the maintainer commits directly. Don't get fooled by the huge amount of stars, they don't mean anything.

[@Jimmy_Jones]

Yeah. Exposing NPM makes me dubious of the setup

[@ytdlgandalf]

Lol those vps prices are insane nowadays. You can get dedicated servers with raid 1 for that money wtf.

[@mspencerl87]

This is exactly what I've been doing for 3 years but using zero tier works great I have Zerotier installed on my router and it acts as a bridge so I don't have to install the client on any of my home devices. Only my router.

[@JamesT65]

Same here nothing compares

[@Jamey_ETHZurich_TUe_Rulez]

for years i was abusing torrent trackers as a "stun server" for home vpn until zerotier.

[@angeloerasto]

I did try this a few weeks ago. Transfer speeds are not great as compared to cloudflare tunnels behind cgnat

[@RaidOwl]

Shucks. Were you using a VPS? Maybe their speeds aren’t good.

[@GrishTech]

Make sure your tailscale is able to negotiate a direct connection without going through a relay.

[@seetcas]

@@GrishTechhow to do that

[@itsmeenebula]

@@GrishTech it can’t behind cgnat

[@angeloerasto]

ill try this thanks@@GrishTech

[@carlosgarcia1165]

it would be great to include headscale in this video, paid tailscale is not necessary when you are using hosted stuff ;) thanks for the video! very useful to see the nginx proxy manager

[@Zedris]

Im a bit confused was the issue with cloudflare tunnels the limitations on video streaming or privacy because right now with this arent you just trusting a different company like american cloud access to your tailscale vpn that comes directly in to your home? You are basically just trusting american cloud instead of cloudflare and by that logic alot more as cloudflare can see only whats being shared on that tunnel?

[@RaidOwl]

You’re gonna have to trust somebody at some point if you’re publicly exposing stuff

[@ear10]

I like the zero trust access controls, they are super convenient. Alternatively just use Tailscale alone with advertised routes and as an exit node if you don’t have public facing services and you don’t need Cloudflare at all

[@NightHawkATL]

Great video! This is something that I want to look into for work so it is good timing.

[@EdgeLordNik]

Hey, this is a near 1 year old video as of Nov2024, I just completed the setup, I used an oracle server and I am hosting my immich, jellyfin and nextcloud apps. The proxy is working and I can access the services but the issue is the assets are loading very slowly and all the services are not usable. Is this an issue because I messed up something in the setup process or something else? Note: The oracle server is close to me and it's in my region.

[@arunoruto]

Depending on the use case, both Cloudflare tunnel and tailscale are viable options. Cloudflare is nice for simple sites like overseer or home assistant, but I would definitely use tailscale for services like jellyfin and Plex!

[@michaelbouckley4455]

Yes Tailscale funnel works behind CGNAT; but for free, the ports are limited: 443 & 10000

[@dunkinDoge]

Just a dumb question since I really can't seem to understand anything when talking about networks / protocols etc what if I already have a static ip? i want to use Cloudflare as a DNS to use a domain name, but then point to my home network that has a static IP, but want to be sure i have encription should i spun up Tailscale as well from one container to others or what? i tried many times reading and trying to understand but i keep faiing to get any grasp

[@hansfranzvandan]

As far as I know, you should be able to use nginx on your own network and use that to encrypt your services, similar to how he did it, just installing it on a raspberry pi or VM on your own network. Just make sure you are comfortable with port forwarding.

What are you saying at the end to be careful about regarding network of the cloud provider? Which kind of fees? Thanks!

[@ohehmgeh]

is it still working for you with tailscale version 1.66.0? Since updating i cant reach my pages anymore but pinging my servers is working normally. **okay i see they added "--stateful-filtering=false" and using this on my VPS fixed my problem

[@J0ermungand]

I've gotten around a shared external IPv4 by using the IPv6 that was unique and then do a NAT from the ipv4 of my external server to the ipv6 of my home system.

[@DavidErato]

If you put it at a friend’s house, would your media have to pass through their home to serve, and thus be limited by their upstream bandwidth? I have decent upstream but have cgnat. My parents do not, but have a public ip.

[@RaidOwl]

Yeah you’ll be limited by their bandwidth

[@munroegarrett]

What about security concerns relating to Nginx Proxy Manager?

[@RaidOwl]

There are security concerns anytime you open services to the outside world. Do you have a specific concern in mind?

[@munroegarrett]

There have been multiple CVEs and my understanding is that it took a considerable amount of time (> 1 year) to address them.

Was that not on the management page? I hope you do not open that to the internet.

[@RaidOwl]

nah its closed@

[@Darkk6969]

@@munroegarrett I've read the same thing so I am using HAProxy in pfsense instead. Also can use tailscale in pfsense. I am not bashing the devs of Nginx Proxy Manager as they have a very small number of maintainers and not alot of time to fix the issues.

[@shat01j]

Why are you not using Linode ? What is the differences?

[@ThatHz-]

Why add a VPS and all this complication vs just using Tailscale alone?

[@RaidOwl]

I mean…you need somewhere to host the Tailscale client

[@JamesTenniswood]

​@@RaidOwljust use their Tailscale Funnel feature

[@rowler952]

You could also host a wireguard VPN or OpenVPN for more restrictive networks.

[@madness1931]

This way you're still opening things up to the internet, like with the normal reverse proxy, but you'll be hiding your IP from your DNS records. Adding a layer of privacy. With just Tailscale, you'd need to setup Tailscale on the server, and each client. It would be more secure, but not feasible for every use case. For me, this method fits my needs perfectly… can't believe I didn't already consider it.

[@rowler952]

Wireguard is secure enough to be exposed on the VPS

[@victorgonzalez9502]

Can we use this for other protocols such as RDP, SMB, FTP, I mean for full local network access?

[@tvpi-z1v]

American cloud i also expensive, and why didn't you have NPM local with tailscale installed, instead of public

[@SavannahTL]

Any luck on setting up Nextcloud Talk thought Cloudflare and NPM?

[@alel1531]

HI. I thought this was also to overcome the upload limit, but instead the request body size limit applies to requests that go through the Cloudflare proxy/CDN, regardless of whether the client is connected to Zero Trust. So in Upload even by applying this beautiful configuration of yours, unfortunately it remains at 100MB.

[@myhomemogapi4128]

thank you. this is so helpful, so great

[@GrenadierPete]

Can somebody explain a use case where I need to go through all this?

[@SamHanna-k9y]

Thank you so much for this

[@Technerden]

Didnt quite catch why this over Cloudflare tunnels? CF tunnel have functions like Geoblocking, WAF, SSO, etc. Does Tailscale? Or why this instead of Wireguard tunnel?

[@RaidOwl]

Tailscale is just a nice interface and uses Wireguard anyway plus I can just connect my personal machines to everything with the Tailscale client. Cloudflare tunnels are still great but with this you don’t have to worry about bandwidth limits (if you aren’t proxying via CF DNS).

[@Technerden]

@@RaidOwl Yeah I agree on this. Its something else than what everyone uses, nice to try something "new"! :)

[@andreassa]

No headscale?

[@RaidOwl]

Not today

[@Morpheus2515]

Great video :) . But can you please explain to me whats the difference with Cloudflared and Tailscale is? Cloudflared you can just install in docker and then you can publish all your internal service from one place via Cloudfare. Wont Cloudflared work behind CGNAT? I know that you have file upload limits with 100MB pr. file if you use cloudflare proxy to your WAN IP. As I understand correctly you still use Cloudflare as DNS and from there to the vps. Still you will have the file upload limits right since you have your DNS via Cloudflare? Keep posting your great videos :)

[@rahilarious]

nah. Why give third party all possible access to you traffic? Just use raw wireguard.

[@yellowboat8773]

I'm not on CG Nat but my ISP blocks.port 80 and 443 meaning I cannot do the DNS challenge for reverse proxy. What are my options?

[@SvRider512]

If you can't expose 80 and 443, then you literally have to use a tunnel. Whether it's Tailscale or Cloud flare, that's up to you.

[@4megii]

If I am correct, this can be done without cloudflare? As long as your domain name provider has their own DNS? Or is cloudflare an integral part of this?

[@RaidOwl]

You can do it without Cloudflare dns. I just like their free proxy.

[@4megii]

I return, The issue I have with NPM is it can't do TCP or UDP, it's only HTTP/S and Traefik is a mess.

[@OliverAllpress]

I Just got this up and running with American cloud, tailscale and a zimaboard on the home end behind 5G cell router. Thanks for the guide really helpful and hopefully my use of your link worked but didnt get any free credit so not sure what happened there.

[@RaidOwl]

The partnership period has ended :/ I’ll have to remove those links

[@OliverAllpress]

@@RaidOwl ah ok no worries seems. Thanks again🙂

[@RogerioPereiradaSilva77]

Can't this be done by simply using SSH reverse tunneling instead of Tailscale?

[@RaidOwl]

Maybe 🤷🏻‍♂️ try it and let me know

[@bugdozer314]

SSH would be a tcp tunnel, which isn't all that great in many situations. Also SSH is a user process, rather than a kernel process, so higher in the stack and maybe competing with other resources more. I've done both, SSH has it's place as temporary or roving needs may dictate (i.e. permit some non-business vendor entity a specific type of access), but you'd really prefer something that's "bolted on" lower in the kernel stack for infrastructure needs. You'll also need to build/write something to keep SSH running, and explore the timeout and keepalive options to get something that's more reliable and recoverable. It's doable, but you'd probably like something else better.

[@rahulkakkarscience]

i'm getting this error: too many redirects. And the page is not opening. Can anyone help'?

[@mohamedatef8424]

Nice, Video if i using firewall can i route traffic from it?

[@RaidOwl]

Depends on what you wanna do 🤷🏻‍♂️

[@KREWAY]

Do I need to purchase a domain name to do this?

[@RaidOwl]

Yes

[@seetcas]

Why did you choose proxied for dns cloudflare ?

[@RaidOwl]

Just safer and easier when everything comes in on 443. You can turn it off if you’re doing something that isn’t http/https traffic

[@darthkielbasa]

Every time I hear the tic tac commercial I think about my wife thinking about me

[@iblackfeathers]

the hardware limitations of the raspberry pi zero restrict the speeds of the service but i thought the goal of this was to do one better than cloudflare tunnels by having no imposed limitations on bandwidth? i guess it is implied one can use faster hardware with the same setup?

[@RaidOwl]

Yeah I did show what the speeds looked like hosting on small LXC container on my server, much faster. The raspberry pi was basically like "hey look you can run tailscale on anything".

[@ohehmgeh]

Get Out of my head! I had the same plan to build this on my Weekend 😂

[@Just5KY]

Just use rathole, much faster and won't need tailscale

[@FUSSSEL]

Rathole is only a reverse proxy like npm and can not connect a subnet via VPN like tailscale the hole point of the video is to bypass a cgnat

[@SirHackaL0t.]

Gotta love that old CGNAT. If we knew what it stood for. Cheers

[@RaidOwl]

Cool Guys Never Act Tough

[@Jimmy_Jones]

Can't Get Network Access. Thanks

[@keywal]

No need for any of this port or monthly cost stuff. Either host the DNS server yourself or add the ip from tailscale to cloudflare for your services. (The IP should be the VM or LXC you have both Tailscale and NPM/Traefik installed on.) Only devices approved on your tailnet can access the services. Nothings 'exposed' and even publicly posting your IP makes no difference as no one can access it unless i approve your device beforehand. :)

[@RaidOwl]

So if you host a Wordpress site you are gonna approve every single public device that wants access?

[@keywal]

Well it’s very unlikely that you’d use Tailscale or a tiny vps for anything that’s to be publicly accessible but you could try with split dns. If I want a family member to be able to access something I have running in my homelab I will invite them to Tailscale and use the ACL to give their device access to that one resource. If they try on another machine it will ask me for approval. Hosting the DNS yourself allows more magic to happen so much so that my family hasn’t even realised how much goes on in the background. They don’t even need Tailscale installed or connected once inside our LAN and if outside they connect to Tailscale and everything continues to work. 😊

[@thespencerowen]

This is the way.

[@lifefromscratch2818]

Very applicable for me.

[@patrickhult]

Do a video with Headscale on a secure vps

[@kurt_hansen]

But you have trust your externel server security where the tailscale client is running, keep the system up to date, install security fixes, upgrade to the next lts release, if there is one. Hardining the System, so that no hackers or other can enter the server. If so, your local services or local network in you homelab are open to the world, isn't it? And exposing NPM Admin Interface to the public is very critical. So, nice tutorial, but i trust more in cloudflare applications with access restriction in combination with tunnels....

[@Jaabaa_Prime]

Hey Brett (small squeaky voice/head), if you are already using a VPS, why don't you run your own HeadScale server on it? Then you don't even need a TailScale account.

[@RaidOwl]

Howdy! Yeah you can def do that! There are plenty of ways to go about this but I’ve always had good experiences with tailscale

[@Jaabaa_Prime]

@@RaidOwlTotally, but I think that your little "Hey Brett" interludes are always fun 🙂 And you left one here for the taking ;-)

[@R-v3x-q4f]

But you need a static ip

[@ChipsNeeson]

I have no idea what any of this means.

[@daillengineer]

Why all of this when you can just use Tailscale ?

[@RaidOwl]

You gonna have every person in the world install tailscale if you want to host a website?

[@ardenswirl7361]

What about tailscale funnel ? I know it has limitations still you can use it right ? any other cheaper solutions like I got the over all I got the over all I idea have been using it for months. Cant afford static ip which is 3$ a month My isp provides Needs to open ort for plex and torrenting cant on my static ip even if i am able to afford as it would be illegal need some otherway around like a cheap vps dmca ignored to do what you did or any other ideas ? Dont say seedbox.@@RaidOwl

[@ExodusX13]

@@RaidOwl Most people wouldn't host a public website from a home server.

[@chuckowens2010]

You know you are alright and informative. I gave you a like you are welcome

[@VladyslavKudlai]

you haven't try Hetzner. Price...

[@ardenswirl7361]

Hetzner is not really useful for plex in this case as they are banning pledx server hosted on their ip, so mainly this is for huge traffic for file serve or a media server Hetzner kind of defeats the purpose lowand box vps seems way to go

[@shat01j]

holy crap your right. Thanks for mentioning