[sa-code]

I can recommend tailscale for creating private networks. It has a generous free tier and would reduce the attack surface considerably compared to ngrok

Better yet would be setting up your own wireguard instance and not relying on free lunches. But as far as free lunches go tailscale would be my preferred option

[bonsai_spool]

Head scale is a good middle option - it uses Tailscale’s DNS system but you are able to control your network as you would with Wireguard

[baq]

tailscale has a much better chance to work when you need it most. WireGuard is blocked by too much stuff.

[ffsm8]

Tailscale uses wireguard.

What it provides is a opinionated configuration management - which is admittedly great which is why I use it as well, but it's nonsensical to say tailscale works in places where wireguard is blocked.

You're likely just noticing the preconfigured nat traversal which tailscale provides and never set one up yourself, as you'd need a static IP for that and it's unconfigured by default.

[BrandoElFollito]

> it's nonsensical to say tailscale works in places where wireguard is blocked

I have two machines on my desk, I configure a wg service on both. I also configure tailscale on both. Everything works.

I move one machine to another network, at a friend's place.

Wg does not work anymore. Tailscale works. So this is very much sensible to say what GP said.

Now, you can have all kinds of explanations about why wg dos not work and ts does, you know STUN, DERP, ts using wg under the hood, and whatnot but the facts are cruel: I cannot wg to my machine, but I can ts.

[ffsm8]

I was just pointing out that the statement wrt "wireguard being blocked while tailscale works" is nonsensical.

It remains nonsensical no matter how uninformed the user may be - even if he's proud of being such, as you seem to be.

This was not a discussion about what tool to use if the person doesn't know about networking and is generally ... "less technical".

[solarkraft]

Right, it’s that specific person’s Wireguard configuration, which is likely a typical one as a result of Wireguard‘s defaults. Tailscale‘s defaults work better, hence the surface-level impression that plain Wireguard does not work in cases in which Tailscale does.

[BrandoElFollito]

As I said above - how would you set up plain Wireguard in a place without the possibility of exposing a port, or even that does not have a public IP - and initiate the connection from outside that place? I would love to learn something. Without rebuilding tailscale (or whatever other solutions with STUN or whatnot).

[BrandoElFollito]

> even if he's proud of being such, as you seem to be

Of course on Internet nobody knows you are a dog. But hey, I may be someone who wrote a part of the Linux kernel in 1994, ran IT operations for a company that was big (big!) and then almost vanished (not my fault :)) and produces open source that you may have even used if you are "technical" as you say.

And set up WG in so many places, including a frontend that unfortunately did not get the worldwide success it should have :)

With this modest introduction - tailscale works where wireguard does not. I am not sure why my example was not obvious. You can reach the machine at my friend's with tailscale, not with plain wireguard. Of course if you open ports in the right places then yes! And check a few more things.

Now - how would you set up plain Wireguard in a place without the possibility of exposing a port, or even that does not have a public IP - and initiate the connection from outside that place? I would love to learn something. Without rebuilding tailscale (or whatever other solutions with STUN or whatnot).

[roflchoppa]

I’ve never noticed wireguard be blocked by something, have you experienced this?

[baq]

many times in public/hotel wifis. it's usually places which blanket ban UDP and allow TCP 80 and 443 exclusively. tailscale somehow manages to get a connection.