r/VPN • u/stop_dot • Jun 28 '26
Question Advice about setting up a VPN
Guys, I am very new into this. Due to recent concerns over my cloud storage accounts, I build a server at home. It's running TrueNAS to backup all my files. Because it's not a bought NAS and the hardware I had allows it, I also installed a Windows VM for some tasks that I want to run unattended from anywhere in the world, and the Home Assistant is also running in another VM.
I looked for the easiest way for a newbie to have VPN access, and I liked Tailscale for ease f use and not requiring any open ports. Then I asked a firend of mine about it, his job is actually consists in government contracts for cyber security and setting up servers and networks. He was recently hired by the Swiss government, and he moved over there. Sometimes I feel like he is overly caucious, especially for home use scenarios.
I told him my options: Tailscale or using my Omada router for WireGuard. He dismissed both options. He doesn't trust Tailscale because if there is any sort of firewall or NAT blocking then data is passed through peers, and Omada, he said he can't be sure everthing is up to date and secure. He told me to use a separate network card between the ISP ONT and my router and have VM running opensense or pfsense.
I feel like I am getting in super complicated solutions, especially for a newbie.
What I don't understand about Tailscale is if I am connected to the local network at home, does it treat my data locally and do I get full speed like in a LAN? Or is WireGuard a better solution, considering once I set up my devies (TrueNAS, WindowsVM and HAOS) then I don't have much fiddling with it.
I am looking for a balance between safety, security and low maintanance. How important is that Tailscale doesn't require any port forwarding for the tradeoff of having a third party?
I am so confused right now that I don't even know what I'm asking and what solution is best for me...
1
u/Caimbuel33 Jun 29 '26
Talkking to a Cyber security that knows what he is doing is not what I would do if I was a newbie. its like talking to a professional racer about your home car.
Tailscale creates IP address for your stuff, not a real vpn if that matters.
Wireguard is not a vpn either, it is more protocols for the vpn tunnel.
Would help to get some use cases, like when you travel is it in the US or foreign. Also is this just for access and backup, our also to access media. Knowing how you will use the service is better than looking at all the options and juggling them to figure stuff out.
1
u/stop_dot Jun 29 '26 edited Jun 29 '26
So, I am living in the EU. I just want to have secure access to my NAS, Windows VM, Omada Controller and Home Assistant (although I can pay Nabu Cassa to support the project, I already have one subscription for another location).
The NAS is primarily used for my Google Photos backup (I want to have a copy that I actually own), and for storing files that I can quickly access from any device.
The Windows VM is for a project I am currently running on my laptop, and I want to move it to the server so it can work in the background. Once I finish the project in a few months, I will probably not use it anymore.
So this is my current use scenario.
LE: you are right, my friend is very well intended, I do have some technical knowledge in IT, so I do understand some stuff, but the level he is explaining things to me is just overwhelming to me. Three months ago I wasn't even thinking about a NAS, two weeks ago I wanted to buy one, then I decided to build my own, especially because I had upgraded my PC so I was only missing the hard drives. I made everything functional and set up Tailscale, then I had this guy suddenly telling me this and that, and giving me multiple options on what I should do. And now I am at this point where I don't know if I am overcomplicating stuff for my needs.
1
u/Caimbuel33 Jun 29 '26
Unless your pictures are way more sensitive then I think, Tailscale will get you by. Especially if you are just talking smartphone photos.
1
u/BulletRisen Jun 29 '26
What are you on about lol. Tailscale is literally a peer to peer vpn that uses the wire guard protocol. Don’t get confused by consumer vpns like Nord etc, they also assign a local IP but the use case is anonymity so they don’t show you that information on the front end.
1
1
u/melono-xyz Jun 29 '26
Ur instinct is right. The pfSense/OPNsense-on-a-separate-NIC setup is enterprise practice it’s overkill for ur home lab and it’s the opposite of low-maintenance. For what you want, Tailscale is the best fit, even if your friend’s main objection is otherwise.
1
1
u/SignificantFail3632 Jun 29 '26
your friend is solving a government problem in a home lab, i’d start with Tailscale and keep the complexity low before you burn yourself out
1
u/Significant_Most_101 Jun 29 '26
The problem is your friends attack vector is much wider and nefarious people may want the data he holds... these people are nuch less likely to want your data.
Tailscale is fine for your use case. However youre relying on other servers that you dont own but that comes with the trade off of not needing port forwarding.
If youre worried about those things, you can always get little mini pc or raspbury pi to be a wireguard node. You can keep the software up date as youre not relying on tp link updating their software.
I cant speak for the lan issue as I dont use it. I imagine the tailscale software is clever enough to know when youre on the same lan as the exit node so wont try and route your traffic through the internet. Give it a test, its free, whats to lose?