The Zero-Trust Home Lab | SumGuy's Ramblings

Let’s be real: setting up a traditional VPN like OpenVPN in 2024 feels like trying to tune a carburetor in a Tesla world. You spend three hours generating certificates, another two fighting with your ISP’s CGNAT (Carrier-Grade NAT), and eventually, you just give up and open Port 1194, praying the script kiddies don’t notice.

We’re done with that. If you want to access your Home Assistant dashboard or your “totally legal” Linux ISO collection from a coffee shop, you need a Mesh VPN. We’re pitting the WireGuard-powered Tailscale against the virtual-ethernet magic of ZeroTier and the aging king, OpenVPN.

Key Takeaways

Zero-Config: Both Tailscale and ZeroTier use NAT traversal to bypass manual port forwarding.
Layer 2 vs. Layer 3: ZeroTier treats your network like one big virtual switch; Tailscale treats it like a set of point-to-point tunnels.
Open Source Freedom: Use Headscale to de-cloud Tailscale, or self-host your own ZeroTier controller.
Exit Nodes: Route public traffic through your home fiber to dodge sketchy public Wi-Fi tracking.

The Comparison: Choose Your Fighter

FeatureOpenVPN (The Classic)Tailscale (The Darling)ZeroTier (The Swiss Army Knife)Setup Time45 mins (if lucky)2 minutes3 minutesFirewallRequires open portsWorks behind NATWorks behind NATProtocolTLS/SSL (Heavy)WireGuard (Fast)Custom (Layer 2 Ethernet)Best ForHardcore LegacyEase of Use / SSOLAN Games / MulticastScalabilityManual & PainfulAutomaticNetwork ID based

Method 1: The “I Just Want It to Work” (Tailscale Docker)

Tailscale is a “SaaS” wrapper around WireGuard. It’s slick, it handles SSO (Google/GitHub/Microsoft), and it just works. Here is how you spin up a node on your server using Docker Compose.

# docker-compose.yml
services:
  tailscale:
    image: tailscale/tailscale:latest
    container_name: tailscale
    hostname: homeserver-primary
    network_mode: "host" 
    volumes:
      - ./state:/var/lib/tailscale # Persists keys so you don't re-auth every reboot
      - /dev/net/tun:/dev/net/tun   # Required for tunnel creation
    cap_add:
      - NET_ADMIN
      - NET_RAW
    environment:
      - TS_STATEFUL_FILTERING=true
    restart: unless-stopped

Method 2: The “Virtual Ethernet” Approach (ZeroTier)

While Tailscale is like a smart router, ZeroTier is like an invisible Ethernet cable. Because it operates at Layer 2, it supports things Tailscale struggles with—like mDNS, broadcast, and multicast. If you’re trying to play StarCraft over a VPN or discovery-based protocols, this is your winner.

Joining a Network via CLI

If you already have a ZeroTier Network ID, joining from a Linux server is a one-liner:

# Install and join in one go (standard Debian/Ubuntu)
curl -s [https://install.zerotier.com](https://install.zerotier.com) | sudo bash
sudo zerotier-cli join <your_network_id> # Replace with your 16-digit ID

# Check your status
sudo zerotier-cli listnetworks

Dockerized ZeroTier Node

Want to keep your host OS clean? Run ZeroTier in a container:

# zerotier-compose.yml
services:
  zerotier:
    image: zerotier/zerotier:latest
    container_name: zerotier
    devices:
      - /dev/net/tun:/dev/net/tun
    network_mode: host
    cap_add:
      - NET_ADMIN
      - SYS_ADMIN
    volumes:
      - ./zt-data:/var/lib/zerotier-one
    restart: unless-stopped

Method 3: The “De-Clouded” Path (Headscale)

If the proprietary “Control Plane” of Tailscale gives you the creeps, Headscale is your savior. It’s an open-source implementation of the coordination server. You host it on a $5 VPS, and suddenly, you own the entire map. No Big Tech required.

# Quick Headscale config initialization
mkdir -p ./headscale/config
curl [https://raw.githubusercontent.com/juanfont/headscale/main/config-example.yaml](https://raw.githubusercontent.com/juanfont/headscale/main/config-example.yaml) -o ./headscale/config/config.yaml

# Point it to your actual domain
sed -i 's|[http://127.0.0.1:8080](http://127.0.0.1:8080)|[https://vpn.sumguy.com](https://vpn.sumguy.com)|g' ./headscale/config/config.yaml

Why “Zero-Trust” is the Real Flex

In the old days of OpenVPN, once a user was “in,” they could see everything. It was a security nightmare. Modern mesh VPNs use Identity-Based Networking.

In Tailscale or ZeroTier, a device doesn’t just “connect”—it must be Authorized. You can write ACLs (Access Control Lists) that say “My phone can see the Plex server, but the Plex server can’t see my phone.” That is the essence of Zero-Trust: verify everything, trust nothing.

Final Thought

OpenVPN served us well for a decade, but we’ve moved past the era of static IPs and manual port forwarding. Tailscale is the king of UX, ZeroTier is the king of “it feels like a local wire,” and both are miles ahead of punching holes in your firewall. Choose your tool, stop opening ports, and start building.