cross-posted from: https://discuss.online/post/34942012
I find everyone using different services, so unsure how to best manage (and balance) concurrent access in Ubuntu/Debian to:
- Local network services
- Tailscale services from userA
- Tailscale services from userB
- Wireguard (OpenVPN also option) from userC
- Twingate from userD
Each user is wanting to share different services via VPN, and pressuring any to change their production setups to a different style of VPN is not going to happen.
- Management via software
- Possibly up a routing device along the lines of OpenWrt or OpnSense.
- Could even distribute such devices between these friends.
Thanks for all thoughts!
Wireguard should be the default here. The rest is just networking configuration implemented in both routing and firewall. I never understood why people use Tailscale, like why would you intentionally pay someone to be man in the middle of your virtual private network? Twingate I am not familiar with.
Personally, I would do this in docker. That way you can have clearer separation between services and networks. But it’s not a hard requirement.
I would just do it, as you wrote. For example, on the account of jellyfin server, configure the tailscaleA client, then wireguard client, etc. Set those up as separate user services/processes/system services if root permissions needed and that’s it. Then on other services set the needed connections separately.
It might be handy to set up traefik, so things served via vpns can go through the same routes as local traffic, so you use the same path as your users doWhen you have a service that serves something on a port, you are not limited to only one connection. It can be accessed through different clients, the only needed part is that those clients connect to their respective vpn networks and pass the traffic correctly
I don’t see a need for a separate device for that routing
Are you sharing your Linux PC with a bunch of different users? Or are you sharing your Linux server with a bunch of different users?
It is a bunch of friends attempting to share with me. They are all implementing VPN access in various ways.
If it’s a bunch of users sharing a bunch of resources from behind a bunch of different VPNs, I guess the most simple way is to tell them to expose it to the internet
Are you running your services directly on the host or via docker? All the VPN services listed provide docker images which I think should allow you to run multiple instances without them interfering with each other, although I’ve only played around with Tailscale myself. The setup would be slightly different depending on if your services are containers or not
What do you mean? Is it working now? To my understanding this stuff either works or it doesn’t, what is going wrong for you? What are some things you’d like to make more seamless?
This is just basic network routing and subnetting.
Okay, although it certainly doesn’t seem basic.
You didn’t really include any details about your current VPN setups, your subnets, your routing rules, etc for anyone to give you a useful answer.
I’m not sure what you’d like here. You didn’t give much info.
Did you want someone to literally work out a full config for you in here? We don’t know what you’re even running.
Example setup:
- Jellyfin user access from TailscaleA
- Nextcloud user access from TailscaleB
- Jellyfin user access from Wireguard
- Jellyfin user access from Twingate
- Jellyfin user access from local services
How would you manage this in a somewhat seamless manner?
