Hi everyone
Thanks for all the advice on buying a domain. Its a big week for me. Getting on grapheneos, buying a domain, and I also recently started self hosting my contacts and calendar. I love this way of life.
My original plan was to one of the xyz 1.1111b domains for $1 a year but most of the feedback I got said just go with cloudflare. Its a lot more money than I had planned but all the security features are baked in and I feel that’s worth the extra money.
Here are my questions. I use the latest version of truenas community
- How do I connect my domain to my server apps? I’ve got a series of apps I’d love to he able to access without tailscale and solely use the domain.
- I have heard the term DNS a million times but don’t really understand it. What do.I need to know about DNS to keep security up and stay protected
- I’d like to let family access my media server, are there any considerations I need to make?
- How can I use one domain to access multiple services on my server? Do I need to pay extra for subdomains?
Thank you for any advice
This is where I get really lost. I’m probably going to get this wrong so here goes
My understanding was tailscale is to connect different machines across the internet, but that a traditional VPN hides your information
I got a domain so I could use my traditional VPN and access my server. At the moment, every time I want to access my server, I have to turn off my VPN so I can turn on tailscale. That’s the exact scenario I’m trying to avoid by getting the domain.
Again, I’m sure I’ve got some stuff wrong here but that’s my current understanding
Yes, mobile devices typically cannot run two VPNs at once. There are two issues here, when at home and when out on other networks.
At home, the solution is not to round-trip out to your VPN provider and then back into your network via the public Internet using your domain. Unfortunately. That creates a huge latency and bandwidth penalty when you are physically at home and unnecessary complexity.
Instead, if you must use your VPN service while at home, you need to find the split tunnel settings to allow your phone to access the local network while connected to the VPN service. They usually hide that setting because it opens up the security of said services and allows some leaks, but it should be there.
When out on other networks, it gets harder. If you get creative with networking, you could connect a computer to your commercial VPN service and have all your tailnet devices use it as an exit node, which has the nice benefit of paying the VPN service for “one device” and using as many as you want, but is dependent on your home network speed and a PITA to set up.
Tailscale does integrate with one VPN provider so you can use one app for both tasks, but it may not be the provider you want. I don’t know If their direct competitors do the same, maybe shop around a bit. One VPN app for both use cases is what you want, not two different VPN apps.
Finally, if none of the above works for you, then yes, you are back to accessing your self-hosted services via the public internet and your domain name while travelling and using your commercial VPN. You will have to secure the service, and that will take some learning to do safely. That will be a journey and not something you want to just throw together quickly. You might be able to restrict incoming connections to just your commercial VPN IP address range (in addition to all of the other proper config required) to further reduce the attack surface. Sorry, that is a bit of bad news.
Edit: I have been seeing mTLS (client certificates) come up in selfhosting discussion more and more lately. If the particular service you are running has a walkthrough for that, including support for whatever client apps, it gets you almost to VPN level security. But most do not, and if they do, its alpha stage. However, keep an eye out for that in the self-hosting world as it may solve your issue in the future.
You got it! When you google VPN services, you get all these companies selling products for encrypting your internet traffic (90% snake oil IMHO). Main usecase nowadays seems to be making your browsing appear like you are in a different country. This is not what people are referring to in this thread by “VPN”, even though it is the exact same underlying technology.
Tailscale is actually trying to simplify the original VPN idea, which is to create a secure private “network” over the internet, so your devices can securely talk to one another, no matter where they are physically (over the internet). When you are out on the road, your phone can see your home server just like they were on the same home network, and there’s no way for an attacker to see the traffic or get access to those machines. You might also read about Wireguard or Zerotier -same idea, the first is more rudimentary but is used by Tailscale for the actual encrypted traffic part, the second is their main compeditor (all three are legit good options depending on your priorities). Tailscale is pretty good at being easy to get going because it takes care of authentication, routing, and port forwarding for you. They even helpfully proxy your encrypted traffic if the machines fully cannot connect p2p with each other for whatever reason (slow, but can save your butt). The apps are pretty decent too. I used Tailscale for a long time then eventually self-hosted it once I knew what I was doing sufficiently. I still use their apps.
If you really want to, you can use tailscale to home, then route your outbound traffic over the other VPN. But that’s a bit tricky to set up and it’ll probably be pretty slow.
Using a VPN for privacy is overrated, unless you have a government or ISP that is actively snooping on your traffic. The majority of connections are already encrypted with https.