"Simple" overlay network / VPN on NixOS?

Help
21

Okay, to your credit, this did actually work. Though I’d remove step 2, since the module already does that, and step 3’s port has a dedicated option (.openFirewall in the tailscale module).

I guess the plan now is to set up my network with tailscale and then hopefully drop in headscale later on.

And for those interested, it seems the tailscale folks did actually explain the magic sauce behind their tool (to some degree), e.g. How Network Address Translator (NAT) works | Tailscale.

1 Like
22

I have had strange issues with NAT before on Nebula. I think Tailscale’s holepunch is categorically better. Thanks for giving it a shot, though!

1 Like
23

I have the same need, and ended up with having chisel server running on one machine on home network. When I am away, through a cloudflare tunnel, chisel client allow me to access any tcp/udp services on my home network.

24

Can you please share your Netbird flake. I have been trying to set it up but been stuck on it for few days now.

25

Just for completeness:

  • wgautomesh, which uses lan broadcast and occasional messages between members of the mesh to discover the current endpoint IPs of (static) mesh members. It’s a small rust deamon in a single file of easily readable code, without all the extras for dynamic nodes and authentication services if you don’t need them
2 Likes
26

I personally use zerotier because my opnsense firewall.
I just use it for clients and it’s not a nixos config. Sorry.

27

Tailscale for ease of use.

Headscale when I want to self host.

Wireguard when i need control over the config.

Nebula/innernet/zerotier when messing around.

OpenVPN when infra team is scared of anything else.

Tinc when everything else fails or i really really need a mesh.