Build Your Own VPN with Headscale & Tailscale
HTML-код
- Опубликовано: 27 июл 2024
- Deploy Headscale to create your own VPN! I'm setting this up to create a mesh network so that I can create my own private cloud.
Docker-Compose: github.com/JamesTurland/JimsG...
Headscale Documentation:
github.com/juanfont/headscale...
Headscale UI:
github.com/gurucomputing/head...
Discord: / discord
Twitter: / jimsgarage_
Reddit: / jims-garage
GitHub: github.com/JamesTurland/JimsG...
00:00 - Introduction to Headscale and Tailscale
02:45 - Docker Overview & Configuration
13:37 - Accessing UI
17:27 - Creating Users
19:21 - Android Walkthrough
24:12 - Adding Ubuntu and Windows
29:08 - Routes
34:18 - Outro 
Наука
Jim - not going to lie. This looks super complicated, and I sometimes watch your videos because of your calming voice.
I feel like I could fall asleep if he narrated cosmology videos.
I wish it would work on my kids!
WireGuard is probably the right choice for most people. I'm experimenting with headscale but I'll see how it works out.
@@Jims-Garage Narrate how to create your own VPN to them 😂
SQLite is actually quite fast even with heavy usage , the problem is that you usually want to run your DB and your App separately and that's a non-starter for sqlite.
So if you are fine with running your app and db on the same system , sqlite is a good choice in my opinion.
"Not going to explain this in detail again"
- * Proceeds to explain in detail*
💜
Hi Jim. Thank you for your channel. It was one of the things why I decided to start my home server journey. It’s absolutely fantastic to have comprehensive information how to setup things. My setup is going great and growing every day. One thing I’m struggling now is how to structure my network regarding I’m being CGNAT. Your videos about NetBird and Headscale helped a lot. Could you consider to make a video for newbies with general overview how to structure setup for those pure things stucked without port forwarding. E.g. you have your docker containers, their networks, network of Proxmox VM, your Opnsense/Pfsense and VPS for self hosting NetBird/Headscale and maybe few more things in docker. How to configure flow of data, do you need to have reverse proxy at home and/or at VPS in this setup, do you need DMZ and so on. Just traffic flow and general structure, considering that all vms and basic networks already set up. It sounds like a lot but such video would be a lifesaver for those who just starting out and don’t understand why one needs certain things.
@@user-so2zx5pc8n thanks, that's a good topic, I'll consider that (it's a little more difficult as I don't have that problem so I need to replicate). In my head I'd still be using a reverse proxy (DNS challenge) to make sure all services are SSL etc and play nicely within the browser.
Currently I use headscale on all my devices, I did it based on your old video, thanks for update
@@omerta3393 hey, that's awesome.
Are you comfortable using a deployment with alpha versions and spotty web UI? Provided you are going abroad and would want to have the most stability possible as in case it goes down your out of luck :/
Are you planning a redundant access like wire guard or the cloud Tailscale just in case?
I really prefer selfhosted but I don’t know how polish this is.
Typically no, but it's very close to tailscale and semi supported. I do have fallback to WireGuard if needed.
It's not me going on vacation, it's my mini server. That's why I'm setting this up so I can remote manage/use it.
@@Jims-Garage sorry I misunderstood what is going on vacation hahahah! Thanks for the response.
I’m in a similar situation but it’s me who is going on vacation and got really paranoid about remote access to my homelab. And thought about the most robust solution considering I have a dynamic ip.
A couple docker ddns containers updating a duckdns and a cloudflare dns to work with wireguard as it requieres an ip/domain to work. A wireguard docker+wireguard vm in another bare metal server just in case (I found the docker wireguard to have less performance, ok for ssh but lackluster for remote gaming)
But what has never failed me was Tailscale, the home assistant raspberry with an addon, a docker Tailscale, a vm running Tailscale… no need to worry about dynamic IP or ports, and works every time, maybe not as performant as a direct connection to wireguard but good enough for ssh/webserver/troubleshooting
Another great tutorial. I had better performance with wireguard in my testing but good to have options.
Yes, I suspect WireGuard will be faster. I'm going to do some testing though.
@@Jims-Garage it's very close speed wise but I had much more artifacts when streaming games with moonlight/sunshine when using tailscale vs WG.
@@john__johnson interesting, I'll be sure to check that out
Thank you for this compréhensive tutorial. I love your curated videos! Could you also make a video about nebula overlay network. This would be great! There are only very few tutorials to be found about it.
Thanks, I'll take a look at it.
Excellent demo Jim. I'm planning try all of the self hosted SDN options before I commit. Bit concerning that it's been 12 months since the last production release, i wonder if Netbird is more active.
@@substandard649 I was also surprised by the distance between releases. I will be checking out netbird soon.
@@Jims-Garage +1 for a netbird video plz 😁
I went with Netbird, and love it.
Headscale was just not streamlined or robust enough for my tastes.
Hi Jim, greetings from Brazil! I've been loving your content and rebuilding my homelab following your videos! I'm eagerly waiting for the video about Netbird, as I found the service very interesting. Keep up the good work!
@@brksnunes thanks, I almost have it working. Video as soon as I do
❤
Hey Jim, great video. Any chance for self hosted netbird demo?
Yes, I'm going to netbird in the near future.
Perfect timing.....almost. I'm in the middle of doing what you're planning. I have a Synology NAS that I've been backing up to iDrive E2 block storage. I've maxed out the tier I'm on....and tired of paying $300US/yr. I bought a 16TB external USB drive and connected a Raspberry Pi4 to it and using is as an ssh remote target for Synology HyperBackups. I have a little vacation trailer on a lake and finally got a decent internet connection there so I'm going to use this as my offsite backups. Been looking for a solution better then a simple OpenVPN link. I like that this solution would give me access into the network there as well. I await your followup video on how you get that working...hope it's not too far in the future :)
@@AndrewHargreave it'll be the next video, but I'm also going to check out netbird as an alternative.
I'd be careful with a USB, I'd certainly recommend a HDD over it (2 if budget permits).
I thought you would do a net bird one
@@pksrbx292 it'll be in the near future. I mention it at the end of the video.
@@Jims-Garage Is the netbird better in your opinion?
@@PW-72648 I haven't used it enough, but from a technical perspective they're basically the same.
@@Jims-Garage self hosted netbird was unstable
@@Jims-Garage in my experience netbrid is a lot more refined than headscale. requires more ressources to run, but gives you a great UI for management.
At 22:17, it shows the IP address and MAC address of your phone. The IP and MAC are identical on my screen for my phone. I assume this is a bug...?
@@HunterGeophysicsAustralia the IP is likely the first in the default range, the MAC is probably a similar thing (not sure why it's random though). Good spot!
Hi Jim. Love all your videos. Just wondering if you could please make a tutorial for installing OpenProject (as a Docker container) using Traefik as the load balancer? The official documentation only provides instructions for Nginx or Apache, and I'd rather use Traefik as I have no other need for those two and have plenty of other needs for Traefik, so would rather just use that if it's possible. Thanks for considering.
@@HunterGeophysicsAustralia thanks, I'll take a look at it
@@Jims-Garage thank you heaps for considering it. I've been wracking my brain trying to get it to work for the last few weeks. 🤦♂
as always, high quality content and I was able to spin up headscale and register android and windows devices.
I have one question though, what would be an advantage of running self-hosted headscale instead of using official one?
I know free tier limits users and devices, but I wonder if there's any other good reason to run the headscale in my home server?
again, thank you for the video!
@@kiloy1006 the real answer is not really, but it does help with privacy as tailscale won't know your node IPs. There is a case when traffic can be rooted through tailscale servers but even then it's end to end encrypted
Great video! How would you compare Twingate vs Headscale/Tailscale?
Thank you. I'm yet to test out Twingate, I'll be doing it in the near future (hopefully!).
I noticed, you are creating a user per device. Is that recommended way? Would there be some disadvantage to have one user per multiple devices?
@@urzalukaskubicek9690 you could do either, I was simply using a user per device.
If you delete a user, I think it deletes your devices. My plan is to have users tied to people and devices to their devices. I'm the admin, so the infrastructure is probably going to be tied to my user. Though maybe I'll make a user for myself and a user for admin separately?
It's probably more important once you start adding ACLs.
thanks for the video, very detailed. There is a way to share some ip ranges of your internal network from headscale without installing tailscale or adding routes?
@@javisartdesign there's an option to allow LAN access per client. This will use NAT to enable it.
@@Jims-Garage thanks, I will take a look
hello! thanks for your explanatory videos. i am unfortunately unable to access my internal services which are behind reverse proxy (traefik) through the headscale network, using the https address . (this address works locally, e.g without the tailscale network), if i use the ip address it works without any problems.
any solution?
@@TheXalloumi it's probably the DNS setting for the client. Change it to use your internal DNS and ensure it can reach it.
@@Jims-Garage thanks for your reply. unfortunately that is not working. i have changed the dns settings in the application to not using the tailscale dns, i also changed the dns settings of the config.yaml file, but without success. is that working for anybody?
How to do this on a NAS lets say Synology? Cant use ports like 80 there etc. And what if we dont use proxy as network? EDIT: Tried lots of things. But it wont work for me.
Not recommended to newbie there head and tail will spin all day try it on simple but really easy to understand and you can tell the video is heavily edited most people like to see you do it on screen so they can follow your video.
Not sure I follow, I did do it on screen and referenced previous videos for more details where necessary.
Hi Jim, is there a backup of your plex video that got taken down? Maybe on peertube or Odysee?
It's on X
@@Jims-Garage Do you have a direct link? Without account I can not see your posts.
@@IgnoreMyChan x.com/jimsgarage_/status/1808231260583530826?t=lNv6MA-VnGeRuC--G8VIrw&s=19
@@Jims-Garage Awesome! Thank you so much! ❤
@@IgnoreMyChan you're welcome
pls add info about defguard
Does headscale-admin work better if you uncheck "legacy api (headscale < 0.23)"? Because you're running the 0.23 alpha. I'd imagine the checkbox is for people who don't want to run the alpha.
Good spot, forgot to discuss that. It made no difference in my testing.
@@Jims-Garage The api node access stuff _looks_ correct in the headscale-admin code at a cursory glance. Headscale docs say you need to be running headscale over TLS/https for remote access to work with 50443 open to allow in the rpc traffic. You're running behind traefik, but headscale itself is running through http, so that could possibly be a problem? If that was the problem, though, I don't know why headscale-ui would work but -admin wouldn't.
I've just been looking into it for a very short period of time, though, so I don't know whether rpc is what they're using for the api. I don't run my headscale behind a reverse proxy, and it only works with https, and the api seems to be what headscale-admin is looking for, but I'm running v0.22.3, so unfortunately it's annoying for me to dig into it more without a big chunk of time.
I'm curious about why the ugreen is on permanent vacation. A little hint?
I'll be using it as a remote server
8:26 "because it was created elsewhere, when I setup traefik" huh? what am I supposed to do?
You simply need to change the proxy network to whatever network your proxy is on. If you don't have one check out the video I discussed (I use Traefik).
@@Jims-Garage That makes sense. I am using caddy bare metal though.
first
first++
4