• sandwichsaregood
    link
    fedilink
    English
    arrow-up
    7
    ·
    edit-2
    4 days ago

    You can do most everything Tailscale does with native Wireguard, it’s just a lot of work to manage any of what Tailscale does beyond the most basic. It’s a lot of convenience on top of Wireguard. If you just need a basic “I want my phone to easily get back to my home network” then I would probably stick to Wireguard (and maybe a GUI on top like wg-easy). If you want to do more complicated stuff, like link multiple sites, mesh routing between multiple networks, sophisticated user access controls, etc, Tailscale starts to be maybe be worthwhile. Or another solution, I personally actually prefer to use Netbird, which is basically similar.

    One thing it does do that native Wireguard does not is it includes a relay server, so that if two hosts can’t actually reach each other directly they can still negotiate a direct connection or even fall back to using the relay server to communicate. This is useful if you’re stuck behind something like CGNAT or other networking schemes where hosts may not be able to have a publicly routable IP address.

    Tailscale (and Netbird) also offer one extra convenience which is they both have built in reverse proxies that integrate with the VPN network they generate. Strictly speaking that part is separate from Wireguard; you can also do that yourself but it’s rather convenient. This lets you have publicly trusted TLS certificates and stuff for your internal sites and depending on how you use it can replace stuff like Cloudflare tunnels. So you can host sites without port forwarding.

    FWIW I primarily use a native wireguard server with wg-easy for most of my VPN needs and I only really use Tailscale (actually, Netbird) for some specialized uses. Mostly replacing Cloudflare tunnels with something I fully control.