More actions
Headscale Settup and Usage
Summary
Tailscale is a free to use VPN service which is build upon Wireguard, is a fast HTTPS based VPN service which removes the server role in a traditional Wireguard setup, and replaces it with a Peer 2 Peer protocol, and a Authentication server. This allows you to connect multiple devices directly, providing device to device connection, via IP and dynamic/magic DNS. Headscale is a open source port of the service, which allows you to host your own authentication server removing limits on speeds, and improving reliability.
In this setup I will be outlining the configuration of the Client and server for Headscale, as well as configuring a client as a "Exit Node" allowing it to forward traffic to local Subnets to other nodes connected to it, for remote network access without the need of a static public address, allowing the traversal of Carrier grade NAT, and port forwarding.
Headscale server Installation
First we are going to set up our server and install Headscale. The server is recommend by Headscale to be a Apt based Distro, in this example I used Debian 12 Latest. After initial setup I installed firewalld as a firewall appliance which I recommend especially if you are using a VPS that has a public address assigned. Once that is done make sure the following ports are open on the server:
80/tcp required for initial request 443/tcp used for traffic 8080/tcp used by the authentication server
41641/udp used for the relay functionality 3478/udp used for the relay functionality
If using Firewalld like i was these can be opened with:
sudo firewall-cmd --permanent --allow-port=80/tcp \ sudo firewall-cmd --permanent --allow-port=443/tcp \ sudo firewall-cmd --permanent --allow-port=8080/tcp \ sudo firewall-cmd --permanent --allow-port=41641/udp \ sudo firewall-cmd --permanent --allow-port=3478/udp
Once those ports are open the following link to get the latest release of headscale's .deb file for amd64.
Copy the URL of the .deb file and use wget to download it to the server:
wget https://github.com/juanfont/headscale/releases/download/v0.24.1/headscale_0.24.1_linux_amd64.deb
Once this is downloaded install it with dpkg:
sudo dpkg -i headscale_0.24.1_linux_amd64.deb
Now we need to update the IP address of the server in the config before we start it.
Edit the config with the following:
sudo nano /etc/headscale/config.yaml
In the section Highlighted change the blacked out part to the your public address, also change the "Listen Addr" Section to be 0.0.0.0:8080 to allow authentication requests from any IP.
After this save and close the config file, and then enable and start the headscale service.
sudo systemctl enable headscale.service sudo systemctl start headscale.service
Then check that is is running with
sudo systemctl status headscale.service
You should see a active and started service, without errors or warnings in the dmesg output:
Finally we need to create a user to tie out devices together:
headscale users create <USER>
Now we have configured and started our Headscale server, which is ready for authentication requests. Keep a session open with the server, as we will need access to accept and import the keys for out clients, and have created a use for our devices.
Client Configuration
Now we will outline the configuration of the clients, as they are going to be using the standard Railscale client to access our own server, giving us the advantaged of cross compatibility.
In my example i will be connecting two Linux devices one as the client and one as the "Exit Node". Additonal documentation for other platforms and OS's can be found here:
First we are going to download and run the installser script on our two clients