Hi, so been working on this for a week but not really happy with the solutions I find as they seem to be done by induviduals who rely heavily on ai. I got wireguard easy going and can remotly connect which is great but id love to be able to route any internet traffic to and from the wireguard clients to go though another server while filtering my local onsite services. Felt that if i can crack this i dont need to rely on tailscale. The end goal is to have no reliance on tailscale as i am preparing for the eventual enshitification.
I run head scale on a Vps and it has been 100% reliable and provides an exit node for me via that VPS. But you are going to have the exact same issue, I think with your VPN.
You want your default route from the exit node to go over mullivard's interface, but you need wireguard or tailscale to talk to the other clients directly, via their clearnet IP. You can tell the exit nodes tailscale/wireguard client to bind the clearnet interface, but that may or may not help. Mullivard probably takes the default gateway, which will likely cut off the clients. You could set dedicated routes to the IP addresses of the clients, but they can change if those clients are mobile. You will need to maintain a routing table somehow or keep the pre-existing connection active (fragile).
I am sure its well trodden ground, just be aware that head scale probably won't solve your problem automatically. Its a routing and or firewall config issue.
Thankyou for the insight. I have started looking at headscale and there seems to be chatter about implementing a mullvad exit node which seems promising. Ill spin up a vps tomorrow and explore options. I also want to run it on my own hardware (its a use what i have on hand situation).
Serving headscale is basically a webserver plus a couple of ports. Super minimal hardware requirement but the typical difficulty of needing those ports on a publicly addressable static IP or dynamic DNS.