I am confused. Why not simply advertizing a route in Tailscale on the host that supports tailscale? It will work as the gataway to the LAN.
Show HN: TailGuard – Bridge your WireGuard router into Tailscale via a container
31–40 of 40 posts
Re: Show HN: TailGuard – Bridge your WireGuard router into Tailscale via a container
#32You can run a Tailscale node providing LAN access on Apple TV. Just grab Tailscale's Apple TV app. Performance is higher than you'd expect, saturates a gigabit link. This is the perfect "get to parent's network" appliance. Pairs nicely with Eero+, which one might pick for remote network mgmt for reasons such as ad/threat blocking, aside from the cloud management with co-mgmt delegation built in. It can also serve as…
This actually sounds better than I thought, pretty unexpected but valid selling point for Apple TV. :D
Will keep in mind, although my use case is resolved for now.
Re: Show HN: TailGuard – Bridge your WireGuard router into Tailscale via a container
#33I am confused. Why not simply advertizing a route in Tailscale on the host that supports tailscale? It will work as the gataway to the LAN.
There’s unfortunately no always-on host supporting Tailscale. The Apple TV suggestion in the other comment is pretty good though, since it’s easy for anyone to use. Naturally requires having one though.
Re: Show HN: TailGuard – Bridge your WireGuard router into Tailscale via a container
#34I am confused. Why not simply advertizing a route in Tailscale on the host that supports tailscale? It will work as the gataway to the LAN.
There’s unfortunately no always-on host supporting Tailscale. The Apple TV suggestion in the other comment is pretty good though, since it’s easy for anyone to use. Naturally requires having one though.
I still do not understand. You run tailguard in docker, so the host is surely capable of running tailscale. I must be missing something.
Re: Show HN: TailGuard – Bridge your WireGuard router into Tailscale via a container
#35Earlier quoted context omitted.
This is at least a limitation in Android itself: https://developer.android.com/reference/android/net/VpnServi... "There can be only one VPN connection running at the same time. The existing interface is deactivated when a new one is created." Note this is not about routing some traffic to the VPN and other traffic to the clear net. This is about running two VPN connections simultaneously.
Fair enough. I haven't used an Android device since 2017... Do people have these issues on iOS too? On Linux, I have no problem running either bare wireguard or tailscale alongside Forticlient. On Windows and macOS it's a bit more janky, specifically the DNS resolution, but I don't daily drive these platforms so I may be missing some kind of knowledge to fix this.
On a linux box, is it possible to run tailscale/wireguard as an exit node along with Forti vpn?
Aka what I want to achieve is (my-machine + tail/wireguard) --> (server with tailscale/wireguard + forti vpn) --> Corporate network. So wireguard or tailscale to receive traffic and forward it through forti.
Or another option (my machine fortivpn over tail/wireguard) --> (server as exit node) --> corporate network
Rather than using the official forticlient I am using https://github.com/adrienverge/openfortivpn. It has some options to configure custom pppd/routes/dns etc if necessary, which I have not touched as I don't know enough :P DNS resolution is not important for my usecase, only traffic.
Re: Show HN: TailGuard – Bridge your WireGuard router into Tailscale via a container
#36Earlier quoted context omitted.
There’s unfortunately no always-on host supporting Tailscale. The Apple TV suggestion in the other comment is pretty good though, since it’s easy for anyone to use. Naturally requires having one though.
I still do not understand. You run tailguard in docker, so the host is surely capable of running tailscale. I must be missing something.
Yes, the docker container is running outside the network
Re: Show HN: TailGuard – Bridge your WireGuard router into Tailscale via a container
#37Earlier quoted context omitted.
Fair enough. I haven't used an Android device since 2017... Do people have these issues on iOS too? On Linux, I have no problem running either bare wireguard or tailscale alongside Forticlient. On Windows and macOS it's a bit more janky, specifically the DNS resolution, but I don't daily drive these platforms so I may be missing some kind of knowledge to fix this.
On a linux box, is it possible to run tailscale/wireguard as an exit node along with Forti vpn? Aka what I want to achieve is (my-machine + tail/wireguard) --> (server with tailscale/wireguard + forti vpn) --> Corporate network. So wireguard or tailscale to receive traffic and forward it through forti. Or another option (my machine fortivpn over tail/wireguard) --> (server as exit node) --> corporate network Rather t…
I don't know about FortiClient specifically, it's a sorry piece of crap that's more often borken than not.
With openfortivpn, you can usually ignore whatever routes you receive and set up your own. I haven't tried the specific set up you talk about, but I don't see why it wouldn't work. However, you would most likely need to NAT on the machine running the Fortinet client.
Re: Show HN: TailGuard – Bridge your WireGuard router into Tailscale via a container
#38Earlier quoted context omitted.
Fair enough. I haven't used an Android device since 2017... Do people have these issues on iOS too? On Linux, I have no problem running either bare wireguard or tailscale alongside Forticlient. On Windows and macOS it's a bit more janky, specifically the DNS resolution, but I don't daily drive these platforms so I may be missing some kind of knowledge to fix this.
On a linux box, is it possible to run tailscale/wireguard as an exit node along with Forti vpn? Aka what I want to achieve is (my-machine + tail/wireguard) --> (server with tailscale/wireguard + forti vpn) --> Corporate network. So wireguard or tailscale to receive traffic and forward it through forti. Or another option (my machine fortivpn over tail/wireguard) --> (server as exit node) --> corporate network Rather t…
I have heard not so great things about Forti VPNs, sorry to hear you have to work with those.
In theory, as long as the Forti VPN does not overlap with the Tailscale IP address range, the simplest solution is to just run Tailscale and openfortivpn on a single node. You can then advertise the Forti VPN subnets within Tailscale, that's effectively what my image does as well in a nutshell, except that it's parsing the WireGuard config and setting up firewall rules for convenience.
Tailscale does NAT automatically by default, so it will look like all traffic is coming from the openfortivpn client itself.
Re: Show HN: TailGuard – Bridge your WireGuard router into Tailscale via a container
#39Earlier quoted context omitted.
On a linux box, is it possible to run tailscale/wireguard as an exit node along with Forti vpn? Aka what I want to achieve is (my-machine + tail/wireguard) --> (server with tailscale/wireguard + forti vpn) --> Corporate network. So wireguard or tailscale to receive traffic and forward it through forti. Or another option (my machine fortivpn over tail/wireguard) --> (server as exit node) --> corporate network Rather t…
I don't know about FortiClient specifically, it's a sorry piece of crap that's more often borken than not. With openfortivpn, you can usually ignore whatever routes you receive and set up your own. I haven't tried the specific set up you talk about, but I don't see why it wouldn't work. However, you would most likely need to NAT on the machine running the Fortinet client.
Sounds like I'll need to learn how to setup custom routes and it's syntax. I have tried to run away from it all my professional life but maybe now I need to.
> However, you would most likely need to NAT on the machine running the Fortinet client.
Could you please elaborate a little more here? NAT from where to where?
Re: Show HN: TailGuard – Bridge your WireGuard router into Tailscale via a container
#40Earlier quoted context omitted.
On a linux box, is it possible to run tailscale/wireguard as an exit node along with Forti vpn? Aka what I want to achieve is (my-machine + tail/wireguard) --> (server with tailscale/wireguard + forti vpn) --> Corporate network. So wireguard or tailscale to receive traffic and forward it through forti. Or another option (my machine fortivpn over tail/wireguard) --> (server as exit node) --> corporate network Rather t…
I have heard not so great things about Forti VPNs, sorry to hear you have to work with those. In theory, as long as the Forti VPN does not overlap with the Tailscale IP address range, the simplest solution is to just run Tailscale and openfortivpn on a single node. You can then advertise the Forti VPN subnets within Tailscale, that's effectively what my image does as well in a nutshell, except that it's parsing the W…
When I just try to run tailscale and forticlient together naively, tailscale does not like it very much heh. Looks like I'll need to study what your image is doing in depth