Self-host the NetBird VPN server on a VPS
Run the NetBird mesh VPN on one VPS: DNS and TLS setup, the pinned quickstart script, setup keys for unattended peers, and how it compares to Headscale.
#wireguard
Filtering by topic #wireguard · clear
Headscale: self-host your own Tailscale
Run your own Tailscale control server on a VPS. Install headscale from the official .deb, set server_url and restart it, then join your first node.
Run a Tailscale subnet router on a VPS
Advertise a private network to your tailnet from a VPS: route approval, IP forwarding that survives a reboot, and the --accept-routes flag Linux needs.
WireGuard vs Tailscale vs Headscale
Tailscale is WireGuard plus a control plane. What that coordination server buys you, what it costs you, and which of the three belongs on your VPS.
Tailscale: what it is and how its mesh VPN works
Tailscale is a WireGuard mesh VPN: a coordination server hands out keys and ACLs, NAT traversal links devices directly, and DERP relays step in when it fails.
Tailscale alternatives compared: 6 real options
NetBird, ZeroTier, Nebula, Netmaker, Headscale and Twingate, sorted by whether you can really self-host the control plane, and what breaks when you do.
Route Docker containers through a VPN
Put a container behind a Gluetun sidecar and its ports vanish. Here is why the shared network namespace does that, and the compose file that works.
TP-Link Router WireGuard to Your Own VPS
Use your TP-Link router's VPN Client with a WireGuard server on your own VPS. Spot CGNAT first, then build an IPv4 only config the router will import.
WireGuard vs OpenVPN: which to self-host
WireGuard wins for almost every self hoster on speed, config size and audit surface. Here is the evidence, and the four cases where OpenVPN still wins.
WireGuard: route to your home LAN
Your WireGuard handshake works but no host on the home LAN answers. Four settings decide whether a packet reaches 192.168.20.10 and finds its way back.
WireGuard slow speeds: find the real cause
Slow WireGuard is usually an MTU problem. Find your path MTU by bisection, clamp TCP MSS, check steal time, and measure the path before blaming the tunnel.
Tailscale ports: what to open on your firewall
Tailscale needs no inbound port in most setups. See the outbound ports it uses, why 41641 is not 51820, and the ufw and firewalld rules that help on a VPS.
Is WireGuard free? What actually costs money
WireGuard is free, open source software and your keys cost nothing. What you pay for is the server at the far end of the tunnel. Here is who runs it and why.
Tailscale instead of port forwarding
Reach a home NAS, Pi or Minecraft server without opening a router port. How Tailscale gets through NAT, when it falls back to a relay, and what it cannot do.
wg-easy: WireGuard with a web UI in Docker
Run WireGuard behind the wg-easy web UI with Docker Compose: the ports, NET_ADMIN, the sysctls that matter, and QR code onboarding for phones.
Is Tailscale safe & secure? What if it's hacked
Tailscale never holds the keys that encrypt your traffic. Its safety hinges on what a compromised coordination server or stolen identity account can do.
Use your VPS as a Tailscale exit node
Turn your VPS into a Tailscale exit node: install, advertise, enable IP forwarding, approve the route in the admin console, then fix DNS and IPv6.
How WireGuard works: cryptokey routing
AllowedIPs is the routing table and the access list at once. Learn cryptokey routing, the Noise handshake and rotation, and every wg0.conf reads clearly.
What Can You Do With Tailscale? 8 Real Uses
Eight jobs people run over a tailnet: reach home, borrow a VPS exit IP, share or publish one service, and SSH with no open ports. One command each.
Why Tailscale is slow: relay vs direct
Tailscale over a DERP relay is slow, direct is close to line rate. Two commands tell you which you have, plus the blocked UDP and hard NAT fixes for a VPS.
Is Tailscale a VPN? What it hides and doesn't
Tailscale is a WireGuard VPN between your own devices. Websites see your real IP until you add an exit node, and your ISP always does. What each setup hides.
Self-host a WireGuard VPN on your VPS
Set up WireGuard on your own Linux VPS: key generation, wg0.conf, IP forwarding, NAT, AllowedIPs semantics, DNS, and the handshake failures that bite.
Fix DNS over WireGuard: three failure modes
Your WireGuard tunnel is up but names do not resolve, or the queries leak to the local router. Find which of the three DNS failures you have, and fix it.
Connect two VPS on a private network
Two VPS, one private network: a provider VPC, a WireGuard tunnel you own, or a managed mesh. Subnet choice, service binding, firewall rules and MTU included.
NetBird vs Tailscale: which mesh VPN to run
Both run WireGuard, so the choice is elsewhere: who runs the control plane, how you write access rules, how relays work, and what self-hosting NetBird takes.
Add a WireGuard peer without restarting the VPN
Add a new WireGuard client with wg syncconf and wg-quick strip so connected peers stay up, plus wg set, wg-quick save, AllowedIPs collisions and PostUp rules.
Pair a storage VPS with your main VPS
Run the app on a fast small VPS and keep the terabytes on a cheap storage VPS. Join them with NFS, SSHFS or rclone over WireGuard, and survive a lost mount.