Remote access rarely starts as a complicated problem.You have a server somewhere, you need to reach it, and a VPN seems like the obvious answer.Then the number of machines grows, networks change, and suddenly the simple solution has accumulated enough configuration to deserve its own documentation.
I eventually became more interested in how these tools handled that complexity than in the tunnels themselves.The differences became particularly noticeable once I started comparing how much of the network I had to manage, how much was handled for me, and where the control plane actually lived.Cloudflare Tunnel is great for exposing services It solves a different problem from a traditional VPN Close Cloudflare Tunnel was one of the easiest solutions I tried when I wanted to make an internal service accessible from outside my network.
The basic setup is straightforward.A cloudflared instance running on your network establishes an outbound connection to Cloudflare.You can then associate a hostname with an internal service without forwarding a port from your router.
For example, you can have a service listening internally at: 192.168.1.20:3000 And make it available through: app.example.com The traffic path looks roughly like this: That is excellent for web applications and is particularly convenient when you want to give someone access to a specific service without giving them access to your entire network.The problem arises when you want to do more than access individual applications.Things like SSH into servers, administering Proxmox, reaching your NAS, and connecting to machines that were never intended to be public-facing.
Related Stop port forwarding your NAS: The safer way to access files remotely This is the one NAS security feature most people still ignore Posts 6 By Monica J.White Cloudflare Tunnel can be used as part of Cloudflare’s broader private-network access architecture, but that is a different model from simply joining your devices to a private mesh network.For publishing applications, Cloudflare Tunnel is excellent, but it is simply not the model you can rely on for your entire homelab.
WireGuard gives you complete control The tradeoff is that you have to manage the network yourself WireGuard is a VPN protocol rather than a complete network management platform.It gives you the building blocks for creating encrypted tunnels between machines, but you are responsible for deciding how those machines are configured and connected.A simple configuration might look like: You control the keys, addresses, peers, routes, allowed IPs, firewall configuration, and endpoints.
That is precisely why WireGuard is so appealing.There is very little unnecessary machinery between the network interface and the encrypted tunnel.If you are building a site-to-site VPN between two networks that you control, WireGuard would be an obvious choice.
The problem is that the configuration becomes more involved as the number of machines increases.Adding another server means another peer configuration.Moving between networks can introduce NAT and connectivity considerations.
You also have to deal with key distribution, routing, endpoint configuration, and the rest of the infrastructure surrounding the VPN.WireGuard gives you the responsibility that other tools try to abstract away.For a carefully designed VPN, I like that, and I have done that a lot as part of my work, but for everyday access to a growing homelab, I wanted something higher level.
Tailscale makes WireGuard much easier to use It adds the management layer you are missing Tailscale changes the experience considerably because it uses WireGuard while providing the control plane required to coordinate a collection of devices.Instead of manually maintaining every WireGuard peer, you can install Tailscale on a machine, authenticate it, and have it join your network.The architecture becomes: The control plane handles coordination, while Tailscale attempts to establish direct connections between devices whenever possible.
If a direct connection cannot be established, Tailscale can use its DERP relay infrastructure.This removes a lot of the manual work involved in operating WireGuard directly.It also makes the network much more practical when devices are scattered across different networks.
Your laptop can move between networks without you having to redesign the VPN every time its network environment changes.Related I ditched Google's DNS for a $20 Raspberry Pi, and I stopped handing my web history to third parties You don't need Google's 8.8.8.8: how to build a private DNS server for $20 Posts 12 By Nick Lewis Tailscale also provides features such as subnet routers and exit nodes.A subnet router can advertise an entire private network to other tailnet devices, which is particularly useful for homelabs containing machines that cannot run Tailscale themselves.
For many people, that would be the end of the comparison.Install Tailscale, authenticate your devices, and you are done.For me, there was one more question.
Do I really want someone else operating the control plane for my private network? Headscale gives you the part of Tailscale you actually need You could keep the mesh without giving up control This is where Headscale entered my setup.Headscale is an open-source implementation of the Tailscale control server.It is designed to provide a self-hosted coordination server for Tailscale compatible clients.
That means the architecture changes to: The important part is that Headscale does not replace WireGuard.It also does not require me to abandon the Tailscale client experience.Instead, it gives you control over the coordination layer.
I personally use Headscale for my own remote-access setup because it gives me the convenience of a Tailscale-style mesh while keeping the control plane under my control.Related I ditched Google's DNS for a $20 Raspberry Pi, and I stopped handing my web history to third parties You don't need Google's 8.8.8.8: how to build a private DNS server for $20 Posts 12 By Nick Lewis I can run the Headscale server on the infrastructure that I manage, decide how devices are enrolled, manage the network configuration myself, and avoid making my homelab’s coordination infrastructure dependent on a third-party SaaS service.That matters to me more than it might matter to someone who simply wants the easiest possible setup.
The best remote-access tool depends on where you want control For me, the deciding factor was never whether one protocol was faster or one service had more features.I wanted remote access to remain part of the infrastructure I operate rather than another dependency sitting outside it.That is why I ended up keeping Headscale.
It gives me a network I can shape around my own machines and requirements, while leaving the underlying connections to WireGuard.That choice also fits how I approach the rest of my homelab.I am comfortable taking responsibility for a service when doing so gives me more control over how the system works.
Headscale adds a little operational overhead, but in my setup that overhead is reasonable.I would rather spend that effort maintaining my own control plane than give up that control simply for a slightly easier deployment.
Read More
