• EN

Better than Just VPN for the Home Lab

HunterLAFR
Userlevel 7
Badge +8

Hi everyone!
I wanted to write today about a tool that happily surprised me and now has made my life easier, related to VPN and connectivity, its called Tailscale

The main slogan says :

Secure remote access to shared resources

Tailscale connects your team's devices and development environments for easy access to remote resources.

I’ll try to put it on my own words, in my use case, I’ve been using it at the beginning to connect to my Home Lab remotely from my house to my “Jump Station” over RDP, then, I started to use some advanced features:

  • VPN Access to a single client
  • VPN to Remote Site, to access other devices not capable to install the Client
  • Proxy / Traffic router when Im out of the house or in a untrusted network
  • Web central console for configurations, users creation and management.
  • Easy to use client for Linux, Windows, Android, OSX, iOS, etc.

The client is very neat, clean and easy to use, 
also the documentation is great!
Im gong to post a few screenshots and will make a future entry with an example setup.

The “Free” version comes with great features to start using it, as I said, in my case, at my home lab,

https://tailscale.com/pricing/

One of the positive things for me, is that I dont need to setup a firewall + opening ports for connecting from / to my hose / homelab, the Iphone / Ipad client works “like a champ” and I can access all I need, and secure my traffic navigating from my home when needed.

Web Main Console
OSX Client
Iphone Client

 

Hopefully you like it and if you give it a try lets comment the use cases and features you like the most.

I will try to post in a few days a “demo” or test with different machines.

 

thanks

 

Luis.

Luis F.- HunterLF - HunterLAFR - lfconsulting.org

26 comments

coolsport00
Userlevel 7
Badge +17

Looks like a nice, clean, simple, yet powerful tool. Thanks for sharing Luis!

Shane Williford - Veeam VMCA/VMCE | Veeam Legend | VUG Leader | VCP-DCV | Twitter: @coolsport00
Chris.Childerhose
Userlevel 7
Badge +20

Looks like an interesting tool Luis.  Thanks for sharing.

Chris Childerhose - VMCA2022 | VMCE2023 | Veeam Vanguard 7* | Veeam Legend 3* | vExpert 5* | VCAP-DCV/VCP-DCV | Object First Ace | Cisco Champion | Twitter: @cchilderhose | Blog Site – https://just-virtualization.tech
Iams3le
Userlevel 7
Badge +9

Awesome @HunterLAFR! The free version looks great. I will test and blog about it https://tailscale.com/pricing/

[Microsoft MVP | Veeam Legend 5* | VMware vExpert 4* | Cisco Champion 3* | Object First Ace]
Geoff Burke
Userlevel 7
Badge +22

Can confirm this is an excellent product!

 

VMCA2022, VMCE2023, CKA, CKAD, KCNA, LFCS, PCA,TARS
jcolonfzenpr
Userlevel 4
Badge

Tailscale is a service with great features. I use it to access my homelab, for that I have a rasberry pi connected to tailscale where I propagate the internal subnets of my homelab. Best of all, you don't need to have dedicated public IPs and everything is securely connected.

Nothing to show.... I'm just a simple guy | https://techmyth.blog/
Scott
Userlevel 7
Badge +8

I’m sold. I was looking into this for work already but will move to the homelab next. Great writeup

A
Userlevel 5
Badge +1

Hello, Thanks,

I am thinking about switching my existing/working homelab VBR from local ip to tailscale.
Right now, there is one VBR and one VAgent running on my laptop.

Currently, if I am traveling, from my laptop, I start a openvpn connection to my home.
and run VAgent. That works fine.


The VBR and VAgent both use hostnames/ipaddresses on a 192.168.62.x subnet.

Now, how can i convert existing VBR from using local ipaddress to tailscale without a full uninstall/reinstall/setup?
 


 

Chris.Childerhose
Userlevel 7
Badge +20

Hello, Thanks,

I am thinking about switching my existing/working homelab VBR from local ip to tailscale.
Right now, there is one VBR and one VAgent running on my laptop.

Currently, if I am traveling, from my laptop, I start a openvpn connection to my home.
and run VAgent. That works fine.


The VBR and VAgent both use hostnames/ipaddresses on a 192.168.62.x subnet.

Now, how can i convert existing VBR from using local ipaddress to tailscale without a full uninstall/reinstall/setup?
 


 

Would you not just install Tailscale on the VBR server then in the Agent configure the repository if you are using one on VBR to point to it?

You should be able to install it on your laptop as well to connect to the server.  It is a VPN client so should work similar to openvpn.

Chris Childerhose - VMCA2022 | VMCE2023 | Veeam Vanguard 7* | Veeam Legend 3* | vExpert 5* | VCAP-DCV/VCP-DCV | Object First Ace | Cisco Champion | Twitter: @cchilderhose | Blog Site – https://just-virtualization.tech
A
Userlevel 5
Badge +1

Would you not just install Tailscale on the VBR server
I have had tailscale on that server and laptop for over a year now.

then in the Agent configure the repository if you are using one on VBR to point to it?
Sorry, not understanding?

The VBR and client are setup to use local hostnames/ipaddress.
Need to convert that to use tailscale hostnames/ipaddresses?
How do I convert that setup to use tailscale without uninstalling anything?

The VBR seems to be able to use local and tailscale sometimes?

but here VBR entry is using only DNS name

 

See that my laptop, EN10, uses only 192.168.62.235.
How do I switch that to tailscale ip without having to delete and re-create it?

 

Another way to look at it, forget about tailscale, for a moment.
Let’s say that my local lan changes from 192.168.62.x to 192.168.22.x
What are the minimal changes in VBR and VAgent that are required?

 

Chris.Childerhose
Userlevel 7
Badge +20

Would you not just install Tailscale on the VBR server
I have had tailscale on that server and laptop for over a year now.

then in the Agent configure the repository if you are using one on VBR to point to it?
Sorry, not understanding?

The VBR and client are setup to use local hostnames/ipaddress.
Need to convert that to use tailscale hostnames/ipaddresses?
How do I convert that setup to use tailscale without uninstalling anything?

The VBR seems to be able to use local and tailscale sometimes?

but here VBR entry is using only DNS name

 

See that my laptop, EN10, uses only 192.168.62.235.
How do I switch that to tailscale ip without having to delete and re-create it?

 

Another way to look at it, forget about tailscale, for a moment.
Let’s say that my local lan changes from 192.168.62.x to 192.168.22.x
What are the minimal changes in VBR and VAgent that are required?

 

You would need to change IPs and ensure DNS gets updated with the new IP addresses.  That would be the minimal changes and then ensure the Veeam Console launches and all the Managed Servers show without errors and you can rescan them.

It seems that you need a new Reverse IP Zone in DNS with the IP for the VBR server and the Agent.  Then adding the records for the VBR server and Agent so they have two each - 1 to the normal IP and 1 for the Tailscale IP.  It all comes down to the configuration of DNS to enable name resolution if you are going to use that but if you use IP then it should work with the IP for tailscale on each device.

Chris Childerhose - VMCA2022 | VMCE2023 | Veeam Vanguard 7* | Veeam Legend 3* | vExpert 5* | VCAP-DCV/VCP-DCV | Object First Ace | Cisco Champion | Twitter: @cchilderhose | Blog Site – https://just-virtualization.tech
A
Userlevel 5
Badge +1

Please ignore,

Chris.Childerhose
Userlevel 7
Badge +20

Please ignore,

Did you fix the issue?

Chris Childerhose - VMCA2022 | VMCE2023 | Veeam Vanguard 7* | Veeam Legend 3* | vExpert 5* | VCAP-DCV/VCP-DCV | Object First Ace | Cisco Champion | Twitter: @cchilderhose | Blog Site – https://just-virtualization.tech
A
Userlevel 5
Badge +1

Did you fix the issue?
I believe so, so far, I have tested the following.

Triggered backups of my laptop using:

  • VBR console running on VBR server
  • VBR console running on laptop
  • VAgent GUI
  • VAgent command line.
    "C:\Program Files\Veeam\Endpoint Backup\Veeam.EndPoint.Manager.exe" /backup "7409d307-9c4a-4983-84c6-dffff4c5cc5f"
Chris.Childerhose
Userlevel 7
Badge +20

Did you fix the issue?
I believe so, so far, I have tested the following.

Triggered backups of my laptop using:

  • VBR console running on VBR server
  • VBR console running on laptop
  • VAgent GUI
  • VAgent command line.
    "C:\Program Files\Veeam\Endpoint Backup\Veeam.EndPoint.Manager.exe" /backup "7409d307-9c4a-4983-84c6-dffff4c5cc5f"

Great! Glad to hear you addressed the issue.

Chris Childerhose - VMCA2022 | VMCE2023 | Veeam Vanguard 7* | Veeam Legend 3* | vExpert 5* | VCAP-DCV/VCP-DCV | Object First Ace | Cisco Champion | Twitter: @cchilderhose | Blog Site – https://just-virtualization.tech
A
Userlevel 5
Badge +1

For anybody else wanting to convert VAgent from local ip to tailscale ip.
Very easy to do, no need to uninstall/reinstall, no need to change DNS.

1. from VBR, find the agent machine and ‘Remove from configuration.
2. from VBR, add the machine using tailscale ipaddress

Chris.Childerhose
Userlevel 7
Badge +20

For anybody else wanting to convert VAgent from local ip to tailscale ip.
Very easy to do, no need to uninstall/reinstall, no need to change DNS.

1. from VBR, find the agent machine and ‘Remove from configuration.
2. from VBR, add the machine using tailscale ipaddress

Thanks for posting the solution as I am sure it will help others.

Chris Childerhose - VMCA2022 | VMCE2023 | Veeam Vanguard 7* | Veeam Legend 3* | vExpert 5* | VCAP-DCV/VCP-DCV | Object First Ace | Cisco Champion | Twitter: @cchilderhose | Blog Site – https://just-virtualization.tech
A
Userlevel 5
Badge +1

Hi All, Now a new issue.

I am on the road, not at homelab.

I tried to do a backup and VAgent is stuck for over 20 minutes, trying to connect to VBR in my home lab at using local lan ip of 192.168.62.233 but it should be using the tailscale ip which is 100.122.213.46
So why is VAgent using local lan instead of tailscale?

See that VAgent is using my laptop has correct tailscale ip 100.109.123.23

Here is the full error message

Error: Connection problems. A connection attempt failed because the connected party did not properly respond after a period of time, or established connection failed because connected host has failed to respond 192.168.62.233:10005

FWIW, ping works fine
Reply from 100.109.123.23: bytes=32 time<1ms TTL=128

just now, using my python backup script, no problem backuping to home server over tailscale.
and i am RDP to my homeserver over tailscale

and with tailscale

and see inside VBR, see that my laptop EN10 is connected to VBR over correct tailscale ip and is Online

So I cannot figure out why VAgent is not using tailscale and is using home private lan ip?
Thanks, David

Chris.Childerhose
Userlevel 7
Badge +20

So based on the message it is a connection problem to the required ports for Veeam.  I know ping works but that is a basic test to ensure response.  Check the log files on VBR to see if there is any more details there that might lead you to why - C:\ProgramData\Veeam\Backup\AgentJob

Also is VBR controlling the Agent backup or is the Agent controlling itself?  Maybe check the configuration of the Agent for the repository being used on the VBR server and how it was added.

Chris Childerhose - VMCA2022 | VMCE2023 | Veeam Vanguard 7* | Veeam Legend 3* | vExpert 5* | VCAP-DCV/VCP-DCV | Object First Ace | Cisco Champion | Twitter: @cchilderhose | Blog Site – https://just-virtualization.tech
A
Userlevel 5
Badge +1

I figured it out.

Up above, I listed two steps required to switch VBR/VAgent from local ip to tailscale ip,
tho, should apply to changing network subnets, for example, from 192.168.1.0 to 192.168.2.0

So here are the updated steps. so far ;wink

From VBR:
1. Find the agent machine and ‘Remove from configuration’.
2. Re-add that agent machine using tailscale ip address.
3. For each backup, change the backup server to use the VBR tailscale ip.

 


 

Chris.Childerhose
Userlevel 7
Badge +20

I figured it out.

Up above, I listed two steps required to switch VBR/VAgent from local ip to tailscale ip,
tho, should apply to changing network subnets, for example, from 192.168.1.0 to 192.168.2.0

So here are the updated steps. so far ;wink

From VBR:
1. Find the agent machine and ‘Remove from configuration’.
2. Re-add that agent machine using tailscale ip address.
3. For each backup, change the backup server to use the VBR tailscale ip.

 


 

Great to hear you were able to fix this piece too.  It is also great to learn how to use Tailscale for backups.  😎

Chris Childerhose - VMCA2022 | VMCE2023 | Veeam Vanguard 7* | Veeam Legend 3* | vExpert 5* | VCAP-DCV/VCP-DCV | Object First Ace | Cisco Champion | Twitter: @cchilderhose | Blog Site – https://just-virtualization.tech
HunterLAFR
Userlevel 7
Badge +8

Hey, this is a great “troubleshooting”.

one thing, I’ve been using Tailscale, but with the magic DNS, so no IP addresses involved here,

just using the hostname, if is local, local DNS will take care of resolution, if is Tailscale routing will use the Magic DNS from Tailscale.

hope this little trick works for you as well.

cheers.

Luis F.- HunterLF - HunterLAFR - lfconsulting.org
A
Userlevel 5
Badge +1

hope this little trick works for you as well
Good point, I am aware of that, but I ran into a problem using magicdns on local.
Maybe you know a workaround.

Warning: Off topic

To fully use magicdns, I need to `net use` on local machine using tailscale dns
That works using tailscale ip, but not tailscale dns

Below, the first three command work, but not the fourth command.
I need the fourth command to work
and I just found out, that tailscale forum is read-only now ;woof

 

On my laptop,

:: works → mount using local ip
net use \\127.0.0.1\sharename /user:username "password"
The command completed successfully.

:: works → mount using local hostname
net use \\localhost\sharename /user:username "password"
The command completed successfully.

:: works → mount using tailscale ip
net use \\111.111.111.111\sharename /user:username "password"
The command completed successfully.

:: NOT work → mount using tailscale dns
net use \\ts-en10.tail00000.ts.net\sharename /user:username "password"
System error 86 has occurred.
The specified network password is not correct.

HunterLAFR
Userlevel 7
Badge +8

hope this little trick works for you as well
Good point, I am aware of that, but I ran into a problem using magicdns on local.
Maybe you know a workaround.

Warning: Off topic

To fully use magicdns, I need to `net use` on local machine using tailscale dns
That works using tailscale ip, but not tailscale dns

Below, the first three command work, but not the fourth command.
I need the fourth command to work
and I just found out, that tailscale forum is read-only now ;woof

 

On my laptop,

:: works → mount using local ip
net use \\127.0.0.1\sharename /user:username "password"
The command completed successfully.

:: works → mount using local hostname
net use \\localhost\sharename /user:username "password"
The command completed successfully.

:: works → mount using tailscale ip
net use \\111.111.111.111\sharename /user:username "password"
The command completed successfully.

:: NOT work → mount using tailscale dns
net use \\ts-en10.tail00000.ts.net\sharename /user:username "password"
System error 86 has occurred.
The specified network password is not correct.

 

Ok. I see the example, thanks for the info.
have you tried to use in the 4th command the magic DNS name WITHOUT the FQDN?
only the ts-en10 , Tailscale should complete the rest on the fly is the client is up and running.

The error message that says that the password is incorrect, I had an issue in the past and I solved it like this.

please test it and let us know.

cheers.

Luis F.- HunterLF - HunterLAFR - lfconsulting.org
A
Userlevel 5
Badge +1

I see the example, thanks for the info
Thank you for taking the time to understand the issue.

The error message that says that the password is incorrect
For sure, that is not the issue. I test using a script and the password is set as a variable used for all commands.

have you tried to use in the 4th command the magic DNS name WITHOUT the FQDN?
only the ts-en10 , Tailscale should complete the rest on the fly is the client is up and running.
Yes, initially, I did try that. I did not post as the four examples was enough to reproduce the issue. That fails the same exact way

net use \\ts-en10\sharename /user:username "password"
System error 86 has occurred.

 

The same issue on my home server, windowz server 2022 datacenter.

net use \\127.0.0.1\sharename /user:username "password"
The command completed successfully.

net use \\localhost\sharename /user:username "password"
The command completed successfully.

net use \\100.122.213.46\sharename /user:username "password"
The command completed successfully.

net use \\ts-vserver03.tail03374.ts.net\sharename /user:username "password"
System error 86 has occurred.
The specified network password is not correct.

net use \\ts-vserver03\sharename /user:username "password"
System error 86 has occurred.
The specified network password is not correct.

HunterLAFR
Userlevel 7
Badge +8

OK, I get it, what is the Windows Server Version you are using?

you should continue troubleshooting, it can be a character (special) that the connection does not like.

Also, checking around the internet, it should be the case that  the NTLM negotiation is not working properly, should be v2. you can give that a shot.

just easy question, have you tried the script without the variable, writing the password manually in that step? or written directly? just to ensure that is not other thing, like previous login attempts or so.

hope it helps.
cheers.

Luis F.- HunterLF - HunterLAFR - lfconsulting.org

Comment


Terms & Conditions