I can do that without Tailscale though by just using the WireGuard app. What is Tailscale adding to this?

NAT breaking, I can have a wireguard network with Tailscale where every device only has an RFC1918 address and a default route.

For more background on just how much Tailscale is doing for you with respect to NAT:

https://tailscale.com/blog/how-nat-traversal-works/

Is forwarding a single port that difficult in most circumstances? I do realize there are some instances where that is hard like CGNAT, but if I have easy access to wireguard in my network already what does tailscale buy me?

I was running Wireguard exactly as you describe, but I'm now using Tailscale because convenience.

Ahhh that is slick

not having to generate, manage, and distribute wireguard secrets and configurations was good enough reason for me to switch.

Tailscale also provides a "magic DNS" service which lets you resolve your Tailscale device names without setting up unbound etc, and which can relay other requests through to your pi-hole or unbound or whatever, which can then listen only on the tailscale IP address, so no need to run an open resolver or deal with source IP filtering.

e: also, you can share devices between tailscale users without generating, managing, distributing wireguard secrets. You send your pal/partner/kid a link and they can access your fileserver or raspberry pi webserver or pihole server for themselves wherever they are.

> For a Linux user, you can already build such a system yourself quite trivially by getting an FTP account, mounting it locally with curlftpfs, and then using SVN or CVS on the mounted filesystem. From Windows or Mac, this FTP account could be accessed through built-in software.

I do the same, for multiple domains I own. Definitely not difficult.

So then, whats is the difference to run OpenConnect and then connecting to it via activating CiscoVPN on the phone/mobile device?

I used that while I was in China as this allowed me to have my own personal VPN.

What other benefits are there? I use a PiHole to block ads on my phone already, but I do it via a PiHole installed on an EC2 instance that I also use as an IRC bouncer and other things.

It’s pretty similar as far as how it works for you.

It may be cheaper to VPN to home vs a cloud server, and you may avoid issues where sites block AWS. You can also securely forward other ports. Sometimes I print or access other services in my house that aren’t internet safe.

I have the PiHole VPN configured so that only DNS lookups go through it. All other traffic is not tunneled. It means I don't get billed for several gigabytes of traffic from AWS and my traffic doesn't come from an AWS IP, but I still get all the ad-blocking benefits of a PiHole.

At home on my desktop, I just use uBlock Origin in my browser.

oh wow that is cool. I have never heard or thought about putting a pi-hole in the cloud.

It made more sense to me for using a PiHole on my phone. I didn't want to expose a VPN port on my home network, and didn't want to deal with trying to tunnel VPN through SSH.

And the EC2 instance I installed it on was already being used for other toy projects, so it's not like it cost me anything. The additional egress bandwidth is likely fractions of a penny.

It means you can self host all kinds of things and never worry about opening a port on your router.

As long as you don't need to share any of your services with non-Tailscale users. Otherwise you'll need to set up some sort of public server.

But you can also try to get them to be Tailscale users and effortlessly share the devices with access control features they built. I share my home servers and game servers with family/friends easily while still keeping everything off the public internet.

But now your friends and family are locked into a proprietary system, subject to whatever the future incentives of Tailscale end up being. How many people can you connect on the free plan?

Yea, but my friends and family would rather have a service that just works, has apps, etc instead of an open one. Tailscale is a good actor ~for now~ and ~for now~ thats good enough for us. Not everyday in every situation can I be an activist. I have a list of alternatives incl FOSS ones should I need, but I'll cross that bridge only if I need to, since this JustWorks.

You can connect one person on a free plan, but each person can have their own free plan that you share devices between.

Everything in Tailscale is Open Source, except the GUI clients for proprietary OS (Windows and macOS/iOS), and the control server.

Headscale [1] allows one to implement a self-hosted, open source alternative to the Tailscale control server.

[1] https://github.com/juanfont/headscale

Almost all of tailscale is opensourced at this point besides the GUI.

Does headscale do all the same NAT traversal that Tailscale is capable of?

Ah, the exit node thing is really cool, always handy to have a residential IP to route through too :)