Hi, looking for some advice to set up a VPN server to get into my home network when traveling.
I have a NAS and an openWRT AP within the network. My router is provided by the ISP and with a built-in VPN. Being a hobbyist in networking, I would like to tab your brains for suggestions and know how:
Should I get my own router to run a wireguard VPN off the router directly, i.e. on the edge of the network, OR run a VPN service off the openWRT AP or the NAS, i.e. from within the home network?
Thanks a lot for your help!
Tailscale. It does some UDP fuckery to bypass NAT and firewalls (most of the time) so you don’t even need to open any ports. You can run it on individual hosts to access them directly, and/or you can set it up on one device to advertise an entire subnet and have the client work like a split tunnel VPN. I don’t know about OpenWRT, but both pfSense and OpnSense have built-in Tailscale plugins.
People are freaking out about their plan to go public, but for the moment, it’s a reliable, high quality service even on the free tier.
I’ve also used Ngrok and Twingate to access my LAN from outside, but they simply use relay servers instead of Tailscale’s black magic fuckery.
I wouldn’t be surprised if they use hole punching. It’s an old but effective technique which Skype famously used back in its heyday.
It does a few techniques depending on the type of network and security obstacles. They posted an article on it that’s interesting.
I’d also check out pangolin or headscale like others recommeded though since you’re already looking to self-host.
It’s based on hole punching, but with extras. The clients punch a hole in their respective firewalls then the service connect the holes so the clients end up communicating directly with each other. They have a lengthy blog post about NAT traversal.