57
Cloudflare launches private mesh VPN (Tailscale-like) offering (blog.cloudflare.com)
submitted 6 months ago by to c/selfhosted@lemmy.world
40 comments fedilink hide all child comments
 

It’s a 10 minute read when it should probably be a 2 minute read, likely due to LLMs fluffing it up (I got that vibe from skimming it). But what do you all think, is there anything in here that would compel you to switch from your current VPN solution to this?

you are viewing a single comment's thread
view the rest of the comments
[–] 54 points 6 months ago (11 children)

There's nothing I'd like to do more than let the US internet-monopolizing company handle all my vpn traffic /s But without being snarky, for homelabbing purposes just use wireguard directly, it's fun and not that hard to handle. Automate peer configurations using Ansible or some other automation tool if it gets hard to manage manually.

  • permalink
  • fedilink
  • source
  • hideshow 11 child comments
    •
  • [–] 14 points 6 months ago (4 children)

    I tried, but I don’t understand how to bypass a cgnat. With Tailscale it just works. Also, I tried Netbird, it’s very similar, and it works well too. I’d love to simplify this, but I have no knowledge at the moment. Would love someone pointing into the right direction.

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 4 child comments
    •
  • [–] 4 points 6 months ago (3 children)

    CGNAT and changing IPs make this harder. What I'd consider in this scenario is renting a small vps at a local provider (a tiny/cheap machine is enough). Then use this one as a hop to your network, basically homelab->vps<-client. Here is a post that talks about something like that: https://taggart-tech.com/wireguard/

    I haven't used this method personally, but I've done something similar for incoming web traffic before, when you want to host things behind a CGNAT. You can actually keep all the traffic confidential by having just an L4 proxy on the vps, then the http traffic is still end-to-end encrypted between the client and the service, so you don't even have to trust the vps provider when it comes to them snooping. They still get some metadata, but not significntly more than the ISPs.

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 3 child comments
    •
  • [–] 3 points 6 months ago

    But Tailscale is free, works very easily and reliable and it is set up in minutes. I will only be motivated to look into all that when tailscale isn't free and reliable anymore... I guess that will eventually happen at sometime in the future.

  • permalink
  • fedilink
  • source
  • parent
  • [–] 1 point 6 months ago

    I have done basically that before and it worked. But I find Tailscale with a headscale server easier to manage. Maybe I'll take a look into selfhosting netbird at some point too.

  • permalink
  • fedilink
  • source
  • parent
  • [–] 1 point 6 months ago*

    Thanks. It’s still much more work than I’d like can afford to have at the moment, so I’d stay with what I have for a while. But I have an obsolete Intel Atom machine as a server at work. It’s my personal web and file server, plus Syncthing node. The sysadmin thinks that’s for our website to work. (It’s not used for that at the moment.) I can emulate some for-work things if/when needed, but at this point nobody cares.

    Nobody else, including the boss is aware. But I don’t do anything sketchy there. Just a separate offsite node, plus they have some decent power backup system. We did have massive blackouts in winter (I live in Ukraine), and not a single time the server went offline! Bonus thing, they have a static IP.

    I’m hesitant to move to something bigger there though, as the future of me with the company is not very clear. I can get a higher position at some point and also replace the sysadmin (he plans to retire at some point). If so, I may move the entire company to completely self-hosted everything. And add a couple of servers to myself. But if not, I don’t know. Perhaps I could use that server till it would die its natural death, even if I’d part with the company. I’d still visit them sometimes.

    I wonder whether that’s much better than a cheap VPS. Power wise, I guess it’s the same, it’s really underpowered, two cores, a gigabyte or two of ram, nothing fancy at all.

  • permalink
  • fedilink
  • source
  • parent
  • [–] 3 points 6 months ago (2 children)

    I'm trying to set up the same at some point. How do you solve the changing IP address problem?

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 2 child comments
    •
  • [–] 2 points 6 months ago* (last edited 6 months ago)

    If you're not dealing with CGNAT, Dynamic DNS (DDNS) is relatively easy to set up, doesn't require a VPS and is designed specifically for dealing with changing IP address endpoints.

    Instead of connecting using your (sometimes changing) IP address, you use a URL that dynamically updates when your IP changes. For instance, with DDNS you would access your home network using mynetwork.ddnsservice.com. The DDNS service returns your current IP and your connection can complete. Most routers have built DDNS clients that update the DDNS service when your home IP changes.

    There are various DDNS services out there, but I like DuckDNS. It's free (or you can choose to donate), easy to set up and has worked flawlessly for me for years.

  • permalink
  • fedilink
  • source
  • parent
  • [–] 2 points 6 months ago*

    The simplest would be renting a VPS I think.

    I grabbed an Oracle free-tier many moons ago. The x86 one with 4 gig of memory I think? The arm have a much more core and memory but unless you go with Pay As You Go (PAYG) account ( need a one time refundable $100 credit) it's virtually impossible to grab it.

    My free tier account is sufficient as pure VPN for accessing stuff, you get 10 TB/month egress traffic. The downside is it's Oracle, and you are at their mercy ( they can purge it without notice )

    I never tried it because CGNAT but maybe Dynamic DNS could also solve this.

    Other than that, Tailscale / CF tunnel etc are a fine solution ( for now )

  • permalink
  • fedilink
  • source
  • parent
  • [–] 2 points 6 months ago

    Yeah, you can't just use wireguard directly on a home network depending on provider (CGNAT) and you can't just switch providers as most providers are in a non-compete with other providers. So, Cloudflare Mesh or Tailscale is the best option for those.

  • permalink
  • fedilink
  • source
  • parent
  • [–] [S] 1 point 6 months ago

    I always get so close to just setting up wireguard and being done with it. I barely ever change the devices on my tailnet, anyway.

    I do have a couple friends on my tailnet to give access to some stuff, so that might be annoying to migrate. That and Tailscale handling all the other networking stuff I might not even know about like cgnat.

  • permalink
  • fedilink
  • source
  • parent