4$/month is cheap. It’s about a coffee!

This is a fallacy, because many apps and services require subscriptions. One subscription is "just a coffee", but you have a lot of them.

VIM is a basic tool. You need it, also to talk to coding agents in many circumstances.

I use AI to get vim commands!

Yes my router has open ports, but it does not do any port forwarding. So I can 'directly' connect any device behind my router without my router needing to know any specifics of which device that is. And I don't need to do any port forwarding of anything on my network and thus expose them to the whole internet; I just expose them to the users of my tailscale network (only me)

UPnP allows literally any random piece of software inside your network to open and forward arbitrary ports on your firewall. Bad idea!

Within my risk appetite on trusted network segments. I have bigger issues if malware is operational within the trust boundary, it can do what it needs using outbound connections just fine (recon, lateral movement, etc). Your risk appetite might differ.

Why are you running software that randomly opens firewall ports?

malware. Got any no-name IOT devices on your network? Got some Huawei built hardware anywhere? Playing some new indie game from developers in romania?

I had to install openwrt on my router so that I could restrict access to upnp by mac address just to my gaming pc (imo this should be standard on any router as an advanced setting, most are just upnp yes/no) so that I can still play online games.

Is peer relay essentially a custom relay which was previously available, except now it’s one command?

So it runs a STUN server or similar, for discovery and relaying.

Peer relays are a bit different from our previously available Custom DERP servers. While the custom DERPs do relay traffic, they also require a bunch of configuration and management for their other jobs and they open up availability concerns that are pretty tough for our average customer.

Conversely Peer Relays are built on top of the shoulders of DERP. For example, they don't need to do peer discovery set connections up end to end - instead connections are brokered via our DERP fleet and then in a sense "upgraded" to an available Peer Relay or Direct connection. Because of that they're super lightweight and much easier to deploy + manage. And, they scale horizontally so you can deploy many peer relays across your network, and they're resilient to downtime (we'll just fall back to DERP).

I’m so confused. What is the difference between a peer relay and a DERP server that is self hosted?

The issue I have is I’m trying to connect two devices where one is behind a CGNAT that always causes the connection to be relayed even though the other one is not behind a cgnat with proper port forwarding. Would a peer relay solve this but is it like a DERp where I have to host it on a VPS separate from my existing two networks or is this something different where I can host the peer relay on the network not behind a CGNAT and somehow it will link the two networks through it?

You should be able to stand up a peer relay on an existing tailscale device - so your proposal is correct! Try setting one of the devices up as a peer relay per the docs here: https://tailscale.com/docs/features/peer-relay

What is the issue with one Wireguard port open? You vpn to home LAN and everything is there.

The issue with these VPN companies is that they log data, you have to run an agent running as root, reliance on several other companies too like IdP, etc. Very large attack surface.

First of all, if you have a mesh you don't have to connect to home server to talk to other devices in the same network. They connect to each other.

Second it's super easy to add a new device. Managing wireguard keys is annoying.

Third I don't have to open the port, worry about ddns etc.

Finally, for me it allows me to manage my DNS easily and I can leave tailscale running at all times. Also good luck implementing ACL on your own.

I don't see an issue with them logging when I connect to my stuff. The convenience for me is worth it more than the risk.

If your devices are in one network like at home, you have all those things with Wireguard too.

Devices in home LAN all talk to each other, so you have a mesh network.

You need keys for your laptop, phone and remote devices only. Most nodes are in LAN and don’t need to even run VPN.

With plain Wireguard, you open a single port in a single device. With mesh VPNs you open tons of ports: several ports in coordination, STUN and relay servers, also every device runs a vpn server listening to a port.

You VPN to home and use your home DNS. Your enter ACL rules and DNS server in your router.

I use a mesh VPN but I’m thinking of switching back to Wireguard, my older setup.

Yes, the more government intervention the better. history has shown that government intervention always works out well.

Lumo is not end to end encrypted. The model is in some kind HSM? Are those trusted?

If they are, I see some people might be interested.

Tailscale has tailnet lock. Do you still need to trust the coordination server?

More than on a Nebula setup..

Linux desktop is amazing. Coming from Debian, I installed Windows and had to quickly purge it from my hardware! Super bloated, slow, constantly phoned some CC center, automatically connected to OneDrive, …

Debian is a breath of fresh air in comparison. Totally quiet and snappy.

Debian (stable) is great but I wouldn't use it for a gaming PC on modern hardware. The drivers included are just too old. Bazzite or Arch (DIY option) seem better options.

Debian Stable gamer here, with modern hardware, having a great time.

> The drivers included are just too old.

This can usually be fixed by enabling Debian Backports. In some cases, it doesn't even need fixing, because userland drivers like Mesa can be included in the runtimes provided by Steam, Flatpak, etc.

Once set up, Debian is a very low-maintenance system that respects my time, and I love it for that.

I don't game, but all my computers run Debian Stable, and my oldest child wastes considerable time gaming on Steam. I had to tweak one or two things for him early on, but it all seems to work fine.

People who don't use Debian misunderstand Stable. It's released every two years, and a subset of the software is kept up to date in Backports. For anything not included in Backports, its trivial to run Debian Testing or Unstable in a chroot on your Stable machine.

I moved to Debian Stable ~20 years ago because constant updates in other distros always screwed up CUPS printing (among other things). Curiously, I was using Ubuntu earlier this year and the same thing happened. Never going back.