The Homelab Show Episode 64: Tailscale and Headscale

[@bikerchrisukk]

Really appreciate this, I've just managed to get TailScale working, thanks for motivating me!

[@CilusseYT]

Been using Tailscale for years, it’s awesome

[@stevdodd7515]

worth watching. Feel like a finished book

[@Mikesco3]

I so appreciate the extended conversation about this. I am relying on Zerotier quite a bit. It would have been nice to hear about how would tailscale would be different with Zerotier.

[@itsmith32]

Tried ZT little bit, but in basic config my phone loses connection via tunnel even when I'm jumping from cell to WiFi

[@Muaahaa]

What are the best practices for securing a headscale server on a public IP? Running outside of home lab? Port forward from router? Reverse proxy running outside of lab? Something else?

[@LAWRENCESYSTEMS]

I guess you could lock it down to only allow the IP addresses you will be coming from.

[@camaycama7479]

Very hard to find tuto about the Headscale part. The git page isnt super clear to me.

[@LAWRENCESYSTEMS]

kzbin.info/www/bejne/Y2rKiYNslsaUr9k

[@alphakamp]

what about netmaker?

[@LAWRENCESYSTEMS]

¯\_(ツ)_/¯ have not had time to test it.

[@mathewmickle3116]

Can you do headscale on a raspberry pie?

[@LAWRENCESYSTEMS]

They do have an ARM version, but you would still need to make sure it has access via a public IP

[@pepeshopping]

Secure networks do not allow RANDOM UDP or TCP ports in or out. Period. Yes, adds inconvenience when somebody “decides” to start using a new service or application, but if you don’t have control of your network, somebody else will! Trojans/spyware usually use non standard ports when trying to connect or send data to their command and control server.

[@LAWRENCESYSTEMS]

The old malware used to use random ports, now modern C&C servers use 443 and Let's Encrypt Certs to better obfuscate the traffic.

[@TechySpeaking]

First