Live data from Hacker News

ZeroTier – home VPN without a public IP address

blog.tomaszdunia.pl

21–30 of 68 posts

Re: ZeroTier – home VPN without a public IP address

#22

tailscale clone?

The other way around. Tailscale cloned zerotier, but they diverged quite a bit. You can find VPN connected hardware with zerotier if you've got such needs, and that's simply not possible with tailscale.

Also, ZeroTier is layer 2, whereas Tailscale is layer 3. So you can bridge your LAN to ZeroTier at layer 2. https://docs.zerotier.com/bridging/

Re: ZeroTier – home VPN without a public IP address

#23
post #17

Hugged to death but what i like about zerotier is that I can access my Home Assistant instance (and other home services) with same ip address (resolved from dns and then TLS terminated with traefik) from home network and from zerotier. And it does not matter if I have ZT network connected when home. Not sure if that is possible with tailscale (from my understanding, it generates always tailnet ip for hosts).

> from my understanding, it generates always tailnet ip for hosts It does, but it should connect over LAN when both devices are on the same network. The tailnet IP doesn’t exist outside the WireGuard network, so it’s up to the WireGuard routing algorithm.

I thought it was Tailscale that always selects which IP to use as endpoint for other devices, and set that up for Wireguard? If I'm wrong, could I replicate that behavior (using relay on WAN, direct connection on LAN) with Wireguard without external configuration tools?

Re: ZeroTier – home VPN without a public IP address

#24
post #17

Hugged to death but what i like about zerotier is that I can access my Home Assistant instance (and other home services) with same ip address (resolved from dns and then TLS terminated with traefik) from home network and from zerotier. And it does not matter if I have ZT network connected when home. Not sure if that is possible with tailscale (from my understanding, it generates always tailnet ip for hosts).

Tailscale does support this. Using the Subnet routing feature you can expose other devices on the network to the Tailnet. I had to use this for a while with TrueNAS because of the way it handles TS integration (eventually I moved to using a reverse proxy).

Re: ZeroTier – home VPN without a public IP address

#25
post #17

Hugged to death but what i like about zerotier is that I can access my Home Assistant instance (and other home services) with same ip address (resolved from dns and then TLS terminated with traefik) from home network and from zerotier. And it does not matter if I have ZT network connected when home. Not sure if that is possible with tailscale (from my understanding, it generates always tailnet ip for hosts).

> from my understanding, it generates always tailnet ip for hosts It does, but it should connect over LAN when both devices are on the same network. The tailnet IP doesn’t exist outside the WireGuard network, so it’s up to the WireGuard routing algorithm.

Tailscale DNS might cause a bit of trouble, but the overhead isn’t too bad, I’m measuring ~1ms ping difference, which is a lot in relative terms, but in absolute it makes 0.5ms into 1.5ms.

Re: ZeroTier – home VPN without a public IP address

#26
post #19

How is this better than DDclient + WireGuard?

Not all ISP provide a public IP address. Some ISP force you to change your IP every 24h. So you'd have to reconnect your VPN.

DDclient (or an alternative) takes care of the IP change and wireguard is as good as stateless anyway.

Re: ZeroTier – home VPN without a public IP address

#27
post #17

Hugged to death but what i like about zerotier is that I can access my Home Assistant instance (and other home services) with same ip address (resolved from dns and then TLS terminated with traefik) from home network and from zerotier. And it does not matter if I have ZT network connected when home. Not sure if that is possible with tailscale (from my understanding, it generates always tailnet ip for hosts).

> from my understanding, it generates always tailnet ip for hosts It does, but it should connect over LAN when both devices are on the same network. The tailnet IP doesn’t exist outside the WireGuard network, so it’s up to the WireGuard routing algorithm.

Yep, and there is no "ip alias" type of things. On zerotier, I route my home server ip to zerotier ip and then it just works.

Re: ZeroTier – home VPN without a public IP address

#28

Also consider Nebula: https://github.com/slackhq/nebula ZeroTier does not use an OSI approved open-source license. It is under a freedom-restricting "Business Source License". Nebula is MIT licensed. Nebula is much simpler and in most cases faster than ZeroTier.

How does Nebula compare to Wireguard?

Re: ZeroTier – home VPN without a public IP address

#29
post #26
post #19

Earlier quoted context omitted.

Not all ISP provide a public IP address. Some ISP force you to change your IP every 24h. So you'd have to reconnect your VPN.

DDclient (or an alternative) takes care of the IP change and wireguard is as good as stateless anyway.

Wireguard connects to an IP endpoint. It does not resolve the domain for each packet.

Re: ZeroTier – home VPN without a public IP address

#30
post #29
post #26

Earlier quoted context omitted.

DDclient (or an alternative) takes care of the IP change and wireguard is as good as stateless anyway.

Wireguard connects to an IP endpoint. It does not resolve the domain for each packet.

Maybe this has to be solved on the application layer then. All I can say is that my setup with a dynamic DNS entry and WG tunnel on android works flawlessly.
Post reply on HN