Wireguard should be the default here. The rest is just networking configuration implemented in both routing and firewall. I never understood why people use Tailscale, like why would you intentionally pay someone to be man in the middle of your virtual private network? Twingate I am not familiar with.
this post was submitted on 02 Feb 2026
18 points (100.0% liked)
Linux
62172 readers
1664 users here now
From Wikipedia, the free encyclopedia
Linux is a family of open source Unix-like operating systems based on the Linux kernel, an operating system kernel first released on September 17, 1991 by Linus Torvalds. Linux is typically packaged in a Linux distribution (or distro for short).
Distributions include the Linux kernel and supporting system software and libraries, many of which are provided by the GNU Project. Many Linux distributions use the word "Linux" in their name, but the Free Software Foundation uses the name GNU/Linux to emphasize the importance of GNU software, causing some controversy.
Rules
- Posts must be relevant to operating systems running the Linux kernel. GNU/Linux or otherwise.
- No misinformation
- No NSFW content
- No hate speech, bigotry, etc
Related Communities
Community icon by Alpár-Etele Méder, licensed under CC BY 3.0
founded 6 years ago
MODERATORS
I never understood why people use Tailscale
I use it for the NAT busting and direct connections. This means that my devices can talk directly to each other, even when there's NAT and dynamic IPs sitting between the devices with no port forwarding. This is not possible with Wireguard alone; usually you end up with a hub and spoke network model.
As for them man-in-the-middling, the client is open source (for Android and Linux at least) and traffic is end-to-end encrypted. If you don't want to trust them with distributing the keys (completely valid concern) then it's possible to configure things such that you must sign the keys of clients yourself for your devices to trust them (see Tailnet Lock).
In my case, because I like self-hosting, I self-host an open-source coordination server called Headscale. So in at least my circumstance I really am only using my infrastructure and open-source code.
You can self-host Tailscale. Tailscale is just a bunch of Wireguard tunnels with NAT hole punching and management
Personally, I would do this in docker. That way you can have clearer separation between services and networks. But it's not a hard requirement.
I would just do it, as you wrote. For example, on the account of jellyfin server, configure the tailscaleA client, then wireguard client, etc. Set those up as separate user services/processes/system services if root permissions needed and that's it. Then on other services set the needed connections separately.
It might be handy to set up traefik, so things served via vpns can go through the same routes as local traffic, so you use the same path as your users do
When you have a service that serves something on a port, you are not limited to only one connection. It can be accessed through different clients, the only needed part is that those clients connect to their respective vpn networks and pass the traffic correctly
I don't see a need for a separate device for that routing
Are you sharing your Linux PC with a bunch of different users? Or are you sharing your Linux server with a bunch of different users?
It is a bunch of friends attempting to share with me. They are all implementing VPN access in various ways.
If it's a bunch of users sharing a bunch of resources from behind a bunch of different VPNs, I guess the most simple way is to tell them to expose it to the internet
Are you running your services directly on the host or via docker? All the VPN services listed provide docker images which I think should allow you to run multiple instances without them interfering with each other, although I've only played around with Tailscale myself. The setup would be slightly different depending on if your services are containers or not
Example setup:
- Jellyfin user access from TailscaleA
- Nextcloud user access from TailscaleB
- Jellyfin user access from Wireguard
- Jellyfin user access from Twingate
- Jellyfin user access from local services
How would you manage this in a somewhat seamless manner?
What do you mean? Is it working now? To my understanding this stuff either works or it doesn’t, what is going wrong for you? What are some things you’d like to make more seamless?
This is just basic network routing and subnetting.
Okay, although it certainly doesn't seem basic.
You didn't really include any details about your current VPN setups, your subnets, your routing rules, etc for anyone to give you a useful answer.
I'm not sure what you'd like here. You didn't give much info.
Did you want someone to literally work out a full config for you in here? We don't know what you're even running.