Before we get into the main part of this article, let’s go over some networking basics.
Most networks are Local Area Networks (LANs) – these are networks that operate in a limited space, such as a home, office or building. These networks are local in that only the devices connected to the local infrastructure can access the network. In order to access services and computers outside of this network, a gateway (a router) is needed to forward traffic out of the LAN.
Large networks, such as the Internet, are Wide Area Networks (WANs). These are networks made up of publicly accessible servers and services.
So, how do we get our LANs accessible from outside of our homes? Putting your private devices on the public internet is a terrible idea. You wouldn’t want anyone on the internet to be able to log in to your home server and see your files, would you? This means that we will not be using port forwarding or putting our stuff on a public domain.
So how can we put our stuff online safely? A VPN is the answer.
VPNs and Tailscale
A Virtual Private Network (VPN) is a type of network that creates an encrypted tunnel that traverses the public internet. Imagine it like a wire – the metal inside is your precious data, and the rubber coating of the wire protects that data. The network is virtual as it does not require more infrastructure; it routes traffic over the public internet, but inside its own tunnel.
There are a few types of VPN, but the most common one is IPsec.
Tailscale is a new take on the old VPN architecture. It is as secure as any other VPN and runs on the legendary WireGuard technology, but gives it a modern twist. Simply sign in to your Tailscale account, add a device and it becomes part of your Tailnet – your own private network that you can access from anywhere.
Getting started
To get started with Tailscale, head over to their website.
In the top right-hand of the nav bar, click ‘Log in’. Mine says ‘Admin console’ as I am already logged in. Once clicking this, it will take you to a screen where you can create your account. Tailscale uses ‘Identity Providers’, which are basically other services such as Google, Apple, and Meta that have your personal data and can verify your details. This means your account is permanently linked to the identity provider you used and that none of your details are stored by Tailscale.
Create your account and approve any prompts needed by 2FA.
You should now be at a screen where you will be asked to add your first device to your Tailnet. This is extremely easy. I added my Mac to my network first as this is where I was signed in to my management console.
Simply download the Tailscale app from the App Store.
The app will install but won’t open (at least for me it didn’t) until you click the Tailscale icon in the menu bar and sign in with an account. Once the app was paired with my account, my Mac was added to my Tailscale. It automatically gets assigned a unique name based on the local hostname and an IPv4/IPv6 address – cool!.
A VPN with only one device is not very useful, and so, back on the website, we are prompted to add a second device. Here, I’ll be adding my server, Mayflower.
Back on the installer, click the OS type as ‘Linux’, and the UI will change to give you a curl command which you can paste into your terminal.
SSH into the server and enter the root directory ‘/’. Run the following command.
This is a script file which downloads and installs the Tailscale agent onto the Linux system. This process was extremely fast and Tailscale was ready to go in around 30 seconds.
After installation is complete, I ran the command, and it loaded the agent. After a few seconds, it generated a link for me to paste into my browser to log in to my Tailscale account. Once done, my server was now added to my Tailnet VPN.
Setting things up
So now I had a way to connect to my server from my Mac on any network, anywhere in the world. But before I could deploy this safely, I wanted to take care of a few things on the server side.
Creating a VPN SMB share
Whilst I do trust this service to provide secure access to my files, I felt much more comfortable creating a separate network share for less sensitive documents. The plan is to put all documents in this VPN share and then, when I get home, move them over to their final location on my other, more secure network shares.
Once I created this share and mounted it via SMB, it appeared on my network, and I was able to access it and upload files (although much slower than my local gigabit Wi-Fi).
Creating an OMV user for the VPN service.
Despite Tailscale being incredibly secure and needing my account and authenticator and IP before someone can access my network, I still wanted to lock things down just in case.
In Open Media Vault, I created a new user.
I disallowed this user from modifying their own account so ,there is minimal chance for privilege escalation, should my tailnet be compromised. I also limited the shares this account could access, so that whilst it was prevented from accessing my personal documents, it did have access to the new VPNShare folder I had just created.
Creating firewall rules
As a simple measure, I also created some quick firewall rules to drop all incoming traffic from devices on the VPN where the source IP address did not match the Tailnet IP assigned to my Mac.
If my Mac attempts to mount the SMB share and the source address is what is expected by the firewall, all traffic is permitted. If, however, a new device joins my Tailnet, it cannot connect to anything on the server as the source IP will not be allowed. It’s simple and another layer of security.
Advanced configuration
Now that I had my own VPN and a secure way of connecting to my server from anywhere in the world (for free!), I wanted to tinker around with it to suit my use cases.
Allowing Jellyfin to run on the VPN
There have been a few times when I have wanted to watch something stored on my media share, but haven’t been able to, as I was not connected to my LAN. By configuring Jellyfin to run its port on the VPN, I could now access my media server from anywhere.
This change was super easy and only required me to add a new line in the Docker Compose file. Soon after making this change and restarting the container, I was able to access Jellyfin’s Web UI page, albeit slowly.
This slowness is most likely due to my ISP link only getting around 18Mbps up. Since all data must first flow through my router before it can be sent over the VPN, this is the limiting factor.
Connecting my iPhone
Another use case is backing up photos. I use this great little app called PhotoSync, which has a million ways to back up photos and videos. With this app and a one-time payment, you can back up photos over SMB or directly to cloud services. I actually booked a trip to Japan in September this year, and so this will allow me to back up all of my precious photos from all the places I visit. No chance of them being lost.
Conclusion
Of course, there are loads of different things I could do. I could make all of my Docker containers accessible, host a music streaming service to replace spotify or even allow my friends to access my media share. For now though, this is perfect for me.
If you do decide to host stuff and want to make it accessible outside of your LAN, security should be your main concern.
Thanks for reading!