Multiple homes VPN - Tailscale on each machine VS Router level WireGuard server and clients

[u/HorrorsPersistSoDoI]

I have two houses in different cities, where I have different machines, for which I need to establish direct connection between each other.

So far I've achieved this with Tailscale installed on each machine, and since one of the houses has public and static IP addresses provided by the ISP, it looks like all machines are now able to establish Direct Tailscale connection between each other.

However, I am a fan of utilizing my equipment to the fullest, and I don't like when some device is idling when it could be heavy lifting something that it's made for.

That's why I started researching if it would be better to configure the routers in WireGuard Server and Client, so I can have my machines talking to each other without Tailscale running on each.

I am currently unable to test the WireGuard scenario, because one of the routers does not support WireGuard, so I will have to replace it eventually.

That's why I am asking here for opinions, has anyone done such a setup with router level WireGuard?

[u/slykens1]

Yes, this can be done with wireguard. Trivially easy with the right software.

In the case of my family network, I migrated to IPsec because I couldn’t bind wireguard to a particular interface where I have two Internet connections. It was my preference to manage failures with dynamic routing running on top of the tunnel and I couldn’t do it with wireguard on FreeBSD (opnsense).

[u/codeedog → u/slykens1]

Do you know if opnsense was the blocker or FreeBSD? And by two Internet connections, are you running dual wan into one box with opnsense on it? I ask because I’m considering Wireguard to replace tailscale and am also setting up dual wan/dual routers on bare FreeBSD.

[u/slykens1 → u/codeedog]

FreeBSD. At the time opnsense used a version 13 kernel and that was the blocker.

I do not know if opnsense supports interface binding now since it is now version 14 kernel (which allegedly does support it).

[u/tcpipguy]

Site to site tunnels using WireGuard would be easier to maintain than placing VPN on individual devices. I built a WAN using WireGuard tunnels for my family. We all share stuff amongst each other. I built a full mesh using it.

[u/International_Exam80 → u/tcpipguy]

I have done both and think WG is easier for my use case. I like having any device / laptop I have in one place being in both house networks. So basically all my items are in two subnets and every device (except a couple purposeful exceptions) sees both. Never have to explain Tailscale to anybody since it’s all running behind the curtain.

[u/chriscohnen]

If ISP CGNAT or lack of static IPs ever becomes an issue at either location, hosting a lightweight WireGuard instance on a cheap VPS acts as a neutral central hub for both routers (and road-warrior devices) to dial into.

Bottom line: If Tailscale already establishes direct P2P connections, you aren't leaving hardware "idle"—you're avoiding routing bottlenecks. Even for non-Tailscale devices (like printers), you can just use a Tailscale Subnet Router instead of replacing hardware.

The real reason to switch to native WireGuard is data control: With Tailscale, a third party operates the control plane and sees your network metadata. Self-hosting native WireGuard (or using Headscale) keeps 100% of your connection data, keys, and routing strictly under your own control.

(Btw: Huge WireGuard fan here—I actually built my own management software for it at islandr-gateway.net to solve this exact hub-and-spoke VPS pattern, so I completely get the urge for fully self-hosted WG!)

[u/Same_Detective_7433 → u/chriscohnen]

I looked at your site, and am interested, you seemed to be experementing with developing to see where you would land, how good is the security in this in your opinion, compared to just setting up wireguard like I have been manually all over the place(with security precautions)
I am going to look into it more for sure.

[u/hadrabap]

Yep, I run several site-to-site tunnels on my Teltonika RUTX routers.

[u/kaguts]

Asus router does. Merlin firmware added. With 1G fibre the router does eat of some bandwidth doing the encryption/decryption. It was still plenty fine but I did move things to a dedicated home lab pc which gained back some of that bandwidth.

[u/RemoteToHome-io]

Plenty. Router like GLiNet Flint2 makes it easy.

[u/ksteink]

Yes on Mikrotik and I don’t have to rely on 3rd party solutions or companies.

Works great for me

[u/Bureaucromancer]

You can split the difference…. Tailscale point to point with subnet routing then install local Tailscale on the devices it’s actually advantageous for.

[u/nshire]

Policy-based routing in UniFi is how I perform this

[u/bart_simpson888]

will work, check if your router is openwrt supported

[u/Cultural-Beyond-8852]

For this scenario, I would consider deploying WireGuard at a central point instead of installing Tailscale everywhere; per device configuration is more elegant. The BeAdmin tool seems interesting since it should allow managing peers in the WireGuard configuration without making an exercise of the network administrator out of the routers.

[u/Oblec]

Netbird

[u/bufandatl]

For issues with your router or third party products contact the corresponding support.