11 mo. ago • 100%

VPN tunnel that has... Approval? I don't know what to call it.

I doubt this is a thing, but is there a VPN tunnel like headscale//tailscale that allows a person to approve a client connection from the app or elsewhere for another device without it? I'm asking because I want to use devices like tvs with jellyfin but behind tailscale as well. Is this a thing? I don't know exactly how the app works, so don't crucify me lol.

20 comments

Tailscale?

1
ZeroTier does this, and it’s self hosted. Yay

1
keep eyeing it, I'm also interested!

1
- I'll let you know when I look into it more, but it seems like firezone is pretty close to what I wanted
  
  1
Twingate

1
I use zerotier myself, works the same as tailscale but any device that’s added has to be given permission trough their web ui

1
If I am understanding your question correctly, tailscale has that built in. Look into "tailnet lock".

1
Maybe with wireguard and some scripting? But I haven't heard of anything like this.

1
I'm a smidge confused on what you are trying to achieve and how you think it will work.

As I understand you, you want to connect "embedded" devices where you do not control the software to a VPN network?

VPNs do need some kind of client (otherwise how does the network stack know to use the VPN protocol?) so how do you envisage this working without an app?

What is your desired topology like? Do you just want your smart TV/etc to connect to a remote media library over a VPN? If that's the case, then you are overthinking it with approvals etc.

You can achieve most of what you want with router configuration. Just define routes saying "Traffic from IP address 10.20.30.40 (TV) should go to 10.20.30.30 (gateway)" and then have the "gateway" handle the tunnel.

You can also look at tailscale's subnet routing (should work with headscale backend too).

Good luck.

1
Not exactly clear what you mean.

But to use Jellyfin on a SmartTV through Tailscale you can simply use a device that runs as Tailscale subnet router and correctly set up the routes.

1
In NetMaker and WG-easy the admin has to create and send the connection link, and can kick them at any point

1
Firezone can be helpful for this

1
- Thank you, thats exactly what I was looking for!
  
  1
don't know if it's exactly what you're looking for:

zerotier needs you (as the admin) to approve a new client that tries to join a network.

1
Setup otp auth, and do people connecting ask you the code.

1
Firezone should do what you want.

1
- Thank you, this is exactly what I was looking for!
  
  1
Zerotier has WebUI where you can allow/disallow clients

1
Access Control is what you’re talking about.

1
I think tailscale has this feature, Look at the admin panel

1

You've viewed 20 comments.