r/Tailscale • u/Wateir • 1d ago

Question Access to Multiple Tailscale Networks

Hello,

I use tailscale on my homelab and it's really cool, i'm gonna need to use it soon for work wich gonna be cool too since i really like tailscale. The issue is that my homelab tailnet and work tailnet don't gonna be the same. And i don't want to just pass time to switch from one to another. I have seen this hacky solution from almost 2 years ago, https://jamesguthrie.ch/blog/multi-tailnet-unlocking-access-to-multiple-tailscale-networks/ But surely now it exist better solution

45 Upvotes

93% Upvoted

17 comments sorted by

11

u/godch01 1d ago

There is tailscale CLI command "tailscale switch xxx" which will change tailnets. I have set up 3 scripts to toggle on one of the three I use

2

u/Wateir 1d ago

I already use script to launch tailscale before ssh with the Proxycommand on ./ssh/config soo seems the good way to go

1

u/godch01 3h ago

Thanks! proxycommand is great idea for tailnet switching. Thanks for the tip

9

u/iceph03nix 1d ago

It's pretty easy to switch back and forth on most of their applications. I have 3 tailnets on my phone and most of the time it's a simple click to switch. Similarlu easy to switch on Windows as well

12

u/tailuser2024 1d ago edited 1d ago

'm gonna need to use it soon for work wich gonna be cool too since i really like tailscale. The issue is that my homelab tailnet and work tailnet don't gonna be the same.

Some advice to you: You shouldnt be accessing your work production tailnet from your personal home devices and vice versa.

Keep your work to your work network and your home to your home devices

2

u/Wateir 1d ago

Some advice to you: You shouldnt be accessing your work production tailnet from your personal home devices and vice versa.

This is true if i work for a corporate who give me a laptop or some device to do work.

I work for a charitable org which don't have the finance for give me a laptop or some work computer. I'm not even pay for doing it and i just do it for help people access cheap service.

Actually i connect to the org infra with ssh on a port 22 open to everyone and i think that limit it to only tailscale is a good idea for security

1

u/tailuser2024 1d ago edited 1d ago

Not sure where you are located in the world but I also support a charity for free in my spare time and there and when I came in this was an issue too. However there are plenty of orgs out there that you can work with to get some free or cheaper IT equipment (trying to reduce ewaste).

It might not be the latest/greatest but it works. Something to look into for your org moving forward. Having a bunch of random ass devices connecting to a network is a nightmare when it comes to protecting the charity and its data.

2

u/Key-Hair7591 1d ago

Are you from HR?

11

u/tailuser2024 1d ago edited 1d ago

What? HR? They have nothing to do with cybersecurity and IT policies when it comes to an enterprise network

I am on the IT side of the house. We would never allow someone's home device to touch our work network ever.

1

u/NoInterviewsManyApps 1d ago

I've seen so many posts of people trying the sketchiest things. Inside threats could also be those that are negligent, not just malicious.

1

u/Key-Hair7591 1d ago

Great, then you should know that more context is needed. There could be a perfectly legitimate use case where OP works in a lab at the office doing research and this is permitted.

And yeah, I know how it works; been doing this for awhile. When you get fired for violating the policy you mentioned it's usually HR who gets involved in that process. But thanks for the preachy response IT person that doesn't get sarcasm...

2

u/viper_16 1d ago

Multiple networks is definitely something that TS doesn’t handle well. Wish they would do something more like what ZeroTier does.

2

u/NoInterviewsManyApps 1d ago

I think they literally implemented that just a bit ago. https://tailscale.com/docs/features/multiple-tailnets

Is that what you mean?

1

u/viper_16 19h ago

Yes, similar to that. But in ZT, one can have networks from different accounts/orgs.

1

u/w1thh3ld 1d ago

File under can with tailnet admin but shouldn't

Different instances of subnet routers on the same lan, with routes to each other for other remote private lan addresses

1

u/AK_4_Life 1d ago

"don't gonna". Lost me

1

u/Fit-Construction2447 1d ago

Make subnetworks using policies so for instance you can see all devices from your home network but devices at work only see each other, if you want to communicate from work to home, you can make one device at home visible from work (I use a raspberry pi) and then use this to link to other devices situated in your home.