Which router should I get - Connect from remote location to use Home Internet

jdub · 2023-01-08T00:39:54.708Z

Without an exit node, only traffic bound for the LAN will actually go over the Tailscale interface - which may be what you want depending on your application. But yes, it’s basically the easiest way to set up a VPN server at the moment, and relies on something many people have sitting around

Almahadeus · 2023-01-08T01:11:43.237Z

Thanks again. Yes, I am starting to slowly get my head around it. What an amazing piece of networking tech and so glad that GL.iNET have managed to start its implementation on native UI. I hope that they will be able to iron out all the teething issues {with the help of the techies here like your good self).

jdub · 2023-01-08T01:53:46.394Z

Almahadeus:

What an amazing piece of networking tech

Yeah, it’s undeniably slick. I personally prefer nebula for most uses, which I find to be faster and easier to maintain. That said, nebula doesn’t do exit-nodes or full tunnel routing because of technical reasons, so it’s not great for this application. Tailscale usually incurs a performance penalty on the order of OpenVPN (since most implementations are in userland), but it’s pretty crazy how well it just works.

LupusE · 2023-01-08T07:50:34.785Z

I do think the discussion goes in the wrong way.

In fact you are searching for a VPN solution. A VPN is build of 2 Endpoints. Your working device in your hands and a fixed endpoint with public reachable IP.

For the mobile solution I’ve started with the Beryl. Than I switched to the Slate AX and now I’ve stick with the Slate Plus.
The Beryl got the biggest storage at this time. Important for future updates and projets. The Slate AX has the greatest power in performance as well consumption, my wife is now happy with it. And the Slate Plus is perfect in physical size and power to transmit data.

For a mobile only gateway to your home, the Shadow also is a great device. Much smaller in size, but powerful enough to get access with a few clients from the hotel or camping site.

The much more complicated work is on the other site. You can use a VPN provider, but in this case you are able to say in which country your IP comes from, but not from your home.
Solution 1: Buy a second GL-Inet router. As a Server the Mango would du, but in my home Network, I would rather place something like the Brume 2 or Slate AX. Who knows if it will be uses as a guest network or other projects in future.
Solution 2: I have some Proxmox hosts running, with a bunch of virtual machines. So I just installed another LXC container with Linux as OS and a wireguard server. But you should have se experience with servers, networks and so on. Else use Solutuion 1.

jdub · 2023-01-08T11:30:37.710Z

LupusE:

I do think the discussion goes in the wrong way.

In fact you are searching for a VPN solution. A VPN is build of 2 Endpoints. Your working device in your hands and a fixed endpoint with public reachable IP.

How so? Tailscale is a modern mesh VPN. It can accomplish exactly what the OP is trying to do. Saying a VPN is “built of 2 endpoints” is an old paradigm that is increasingly at odds with a push to zero-trust topologies.

LupusE:

The much more complicated work is on the other site.

This is precisely why Tailscale is such a good solution, particularly for people who want - as you will note the OP does - to have their IP show up from home, not from another VPN provider. Of course the solutions you note in the post work, but as you note they require some level of expertise. The fact that you can install a program on a Windows PC and click a couple of buttons to get a working VPN endpoint at your house that handles all of the firewalling and NAT-traversal for you is hugely valuable. (I try to think of “could my father do it?” as a good normalizing question here. For Tailscale, the answer is yes. For anything else, the answer is no.)

Again, I would be quite interested to know exactly why you think this discussion is going in the wrong direction.

LupusE · 2023-01-08T12:38:31.180Z

jdub:

Again, I would be quite interested to know exactly why you think this discussion is going in the wrong direction.

Maybe, because I am too old for this new world.

I couldn’t imagine someone is able to build a VPN Infrastructure, build a Gateway and say ‘this GW over this net is your exit’, and think this is easier than set up something like a Raspberry Pi, setup a VPN Server and say this is a cascading router/gateway.

If there is a one-click solution. Great, pay for it as long as the provider is trustworthy.

But again, this is my small and dusty view of the world. I am not an expert. Just some random guy with internet and some experience.
If any answer here is better than mine, and works for the situation: Fine for me, I don’t need to be right.

Skynett · 2023-01-08T12:46:44.538Z

Many thanks to you and everyone else, I forgot to mention at the Moment I have a Mango gl router which I have had for a while but dug it out yesterday updated the firmware and setup Openvpn which works on it, However I would like to upgrade that as well and perhaps pick up the Brume 2 / Slate AX as suggested.

I wasnt away of Tailscale until yesterday! I have setup tailscale on an always on Windows 2019 Server I have at home with on Homeassistant running on Virtualbox and also set it as the exit node.

IF go for the Slate AX because of Wifi, is it safe it will be able to do everything I want to achieve if I went with the Brume 2?

Edit:- Can Tailscale be installed on the glinet routers so that it connect to the home tailscale and use that as the exit node?

Many thanks in advance.

jdub · 2023-01-08T13:00:58.109Z

Skynett:

IF go for the Slate AX because of Wifi, is it safe it will be able to do everything I want to achieve if I went with the Brume 2?

Yup. You’ll be good to go.

LupusE:

If there is a one-click solution. Great, pay for it as long as the provider is trustworthy.

Did I mention it’s free for up to 20 devices, or you can self-host your own control server if you don’t trust the provider?

LupusE:

I couldn’t imagine someone is able to build a VPN Infrastructure, build a Gateway and say ‘this GW over this net is your exit’, and think this is easier than set up something like a Raspberry Pi, setup a VPN Server and say this is a cascading router/gateway.

I’d encourage you to look into it. It’s all powered by WireGuard underneath, but the real magic is in automatically configuring and connecting clients, along with all sorts of goodies you don’t get in a normal WG install (e.g. key rotation, etc.). The control server merely connects clients together and manages access lists, where WireGuard does the tunnel building piece.

I was skeptical that it would be useful at first too (after all, I’ve got a decade-old OpenVPN solution I’m still using in production), but I’m really thinking hard about how to integrate it into what we’re doing (with a self-hosted control server, of course).

LupusE:

I couldn’t imagine someone is able to build a VPN Infrastructure, build a Gateway and say ‘this GW over this net is your exit’, and think this is easier than set up something like a Raspberry Pi, setup a VPN Server and say this is a cascading router/gateway.

Again, I’d encourage you to look at it. Install two clients, click “allow-exit-node” on one of them, go to the admin interface and enable that route, then click “use exit node” on the other client. Done. And it’s a one-click change between exit nodes.

LupusE:

If any answer here is better than mine, and works for the situation: Fine for me, I don’t need to be right.

I don’t need to be right either, but I was a bit taken aback by your assertion that my proposed solution was “in the wrong direction” - particularly when from my perspective it’s the easiest way for the OP to get things set up (as he’s confirmed he was able to do). It just seemed like a pretty aggressive statement in the context of the thread. Perhaps that’s not how it was intended, but it came across as, “Look guys, you’re talking about this non-VPN thing and it’s not a solution for the problem.”

Skynett · 2023-01-08T13:11:11.235Z

One last question please, Can Tailscale be installed on the Slate AX so I use it to connect to the Home instance as exit node?

Thank you so much

jdub · 2023-01-08T13:47:05.078Z

Skynett:

One last question please, Can Tailscale be installed on the Slate AX so I use it to connect to the Home instance as exit node?

Not yet, at least not without a custom firmware builds. GL.iNet say they are working on this.

Almahadeus · 2023-01-08T20:30:55.166Z

2023-01-08_2028431918×936 90.9 KB

jdub · 2023-01-08T20:41:33.676Z

Yeah, the problem is that exit node functionality doesn’t work yet - or at least it didn’t work as of two days ago, even if you set it in the CLI. It’s possible that it’s fixed in the latest snapshot, but I’m not holding my breath.

LupusE · 2023-01-10T11:02:51.989Z

jdub:

I was a bit taken aback by your assertion

Please don’t get offended by a random guy with half knowledge in the internet.

I have had in mind Taliscale don’t work well on all Gl-Inet devices. So I thought it is a little much to install packages over Luci, compile some sources or use a custom (even OpenWRT images) firmware, based on this basic question.
And when I read the latest reply, maybe I remembered it right. But everything that works is a solution.

Sounds promising. Especially the selfhosting and configurable Exit-Node.
I don’t think 20 devices is enough for me. I have now 53 configurations on my Wireguard Server. If I’d clean up, maybe 3 or 4 less. But it sounds interesting, I will take a look, if Gl-Inet is supporting it by default.

jdub · 2023-01-10T12:58:52.662Z

If you want to self-host, you’ll want to look at headscale. The process is pretty straightforward. It takes a little getting used to the new paradigm (e.g. have your VPN installed everywhere and use the magicdns to route things), but it’s really pretty useful once you do. It’s honestly to the point where I would feel comfortable not running a VPN at all on the router and just running it on clients behind the router.

It would be nice if GL.iNet could get decent support together, but it’s not there yet. And there’s a real performance penalty (think OpenVPN, not WireGuard). But unless you’re doing heavy network traffic a lot, it’s really a great solution.

jza00425 · 2023-01-14T21:10:37.078Z

Could you explain a bit more about how the IT team will find out that I am not at home address? If I have vpn server router at home and bring a travel vpn router with me, and turn off GPS on my work laptop, will the IT team still figure that out? or what other measures do you recommend to hide my track?

jdub · 2023-01-15T11:33:01.566Z

Depends on how good your IT team is, how good you are, and to some extent where you’re going.

Don’t check your email or visit any work related site on your phone, don’t go to personal sites on your work computer, make sure the work computer never connects to a non-VPN source, etc. The problem is that humans aren’t very reliable at doing this stuff because it’s inconvenient and they screw up sooner or later. And depending on how good your adversary is and how much they care, the number of times you have to mess up can be as low as 1 - and there are far more ways to mess up than I just listed.

In some sense this is a case where to ask the question is to answer it.

gabjen · 2023-01-16T23:43:55.602Z

Quick question:

I got 2 slate ax, created a vpn server on one and download the configuration to add it to the other one as a client. took the 2nd one, uplaod the configuration, now is setup as a client.

What would be the next step to complete the process? If I were to use it as is, will it make any connection go through the VPN to make sure nothing leaks?

Does firmware 4 have a killswitch?

agent_smith · 2023-01-17T12:54:02.603Z

gabjen:

Does firmware 4 have a killswitch?

Hi,
yes, it does, but it’s called now “Block Non-VPN Traffic”. It must be on, if you need it.

Unbenannt3124×1275 176 KB

gabjen · 2023-01-17T14:25:54.085Z

And that needs to be “ON” on the client side right?

agent_smith · 2023-01-17T14:48:07.488Z

gabjen:

that needs to be “ON” on the client side

Yep. To prevent leaks, the checkbox must be enabled. This option is only available on the client side, server side doesn’t need it.
Also, if you need to use the Internet without VPN, then this checkbox should be disabled.