Category: Technology & Networking

Posted on

Tailscale on Firewalla using Docker

In this article, you will learn how to set up Tailscale on a Firewalla device using Docker. We’ll guide you through creating necessary directories, setting up a Docker Compose file, starting the Tailscale container, and configuring it to auto-start on reboot. This setup will ensure a secure and stable connection using Tailscale’s VPN capabilities on your Firewalla device.

Step 1: Prepare Directories

Create the necessary directories for Docker and Tailscale:

mkdir -p /home/pi/.firewalla/run/docker/tailscale
cd /home/pi/.firewalla/run/docker/tailscale

Step 2: Create Docker Compose File

Create and populate the docker-compose.yml file:

cat > docker-compose.yml << EOF
version: "3"
services:
  tailscale:
    image: tailscale/tailscale:stable
    container_name: firewalla-tailscale
    deploy:
      restart_policy:
        condition: on-failure
        max_attempts: 3
    network_mode: "host"
    volumes:
      - "/home/pi/.firewalla/run/docker/tailscale:/var/lib"
      - "/dev/net/tun:/dev/net/tun"
    privileged: true
    cap_add:
      - net_admin
      - sys_module
    command: tailscaled
EOF

In this configuration, the image tag stable ensures a stable version of Tailscale is used.

Step 3: Start the Container

Start Docker and the Tailscale container:

sudo systemctl start docker
sudo docker-compose up -d
sudo docker exec firewalla-tailscale tailscale up --advertise-routes=192.168.1.0/24 --advertise-exit-node
sudo docker exec firewalla-tailscale tailscale status

Follow the printed instructions to authorize the node and routes.

Step 4: Auto-Start on Reboot

Ensure Docker and Tailscale start on reboot by creating the following script:

mkdir -p /home/pi/.firewalla/config/post_main.d/
cd /home/pi/.firewalla/config/post_main.d/
cat > start_tailscale.sh <<EOF
#!/bin/bash

echo "\$0 - \$(date "+%Y-%m-%d - %H:%M:%S") - starting docker"
sudo systemctl start docker
sleep 60
cd /home/pi/.firewalla/run/docker/tailscale

echo "\$0 - \$(date "+%Y-%m-%d - %H:%M:%S") - pulling latest images"
sudo docker-compose pull

echo "\$0 - \$(date "+%Y-%m-%d - %H:%M:%S") - bringing containers up"
sudo docker-compose up -d
sleep 60

echo "\$0 - \$(date "+%Y-%m-%d - %H:%M:%S") - starting tailscale"
sudo docker exec firewalla-tailscale tailscale up --advertise-routes=192.168.1.0/24 --advertise-exit-node
sleep 15

echo "\$0 - \$(date "+%Y-%m-%d - %H:%M:%S") - checking status"
sudo docker exec firewalla-tailscale tailscale status

echo "\$0 - \$(date "+%Y-%m-%d - %H:%M:%S") - pruning images"
sudo docker system prune -f
EOF

Make the script executable:

chmod +x start_tailscale.sh

With these steps, you should have Tailscale running on Firewalla using Docker. Adjust the advertise-routes command as needed for your network configuration.

For additional details and troubleshooting, refer to the original Firewalla community post.

Posted on

Implementing a Secure Network at Home: Safeguarding Your Digital Environment using Firewalla

Part-1

Introduction: After careful consideration and extensive research, it has become evident that securing our home networks is of utmost importance, particularly in today’s digital age. With the pervasive use of social media, the potential for malware and unwanted sites, and the challenge of managing multiple devices, it is essential to establish a secure network environment. In this two-part blog series, we will explore the hazards of the internet, the benefits of network segmentation, and different security options available to fortify your home network.

Hazards of the Internet:

A. Risks to Children and Teenagers:
  • Unrestricted access to social media platforms.
  • Cyberbullying, online harassment, and exposure to inappropriate content.
  • Potential risks associated with interacting with strangers online.
B. Malware and Unwanted Sites:
  • Prevalence of malware and its potential consequences, such as data theft and financial loss.
  • Risks associated with visiting compromised or malicious websites.
  • Inadvertent downloads of malicious files or software.
C. Online Scams and Phishing Attacks:
  • Phishing emails, fraudulent websites, and scams targeting personal and financial information.
  • Identity theft, financial fraud, and unauthorized access to sensitive accounts.
D. Privacy and Data Security:
  • Collection and misuse of personal information by online services and data brokers.
  • Inadequate protection of sensitive data, leading to potential breaches and privacy violations.

Solution – Establishing a Safe and Secure Home Network:

So the solution to the problem is to establish a safe and secure home network. Here are some key features you need to consider:

  • Strong Firewall: A robust firewall acts as a gatekeeper, blocking unauthorized access and potential threats from entering your network.
  • Intrusion Detection and Prevention: This feature keeps an eye on your network traffic, quickly spotting any suspicious activity and stopping potential attacks.
  • Secure Wi-Fi: Use strong encryption (like WPA2 or WPA3) to secure your wireless network, preventing unauthorized users from accessing your network.
  • Content Filtering and Parental Controls: Control what websites can be accessed on your network, especially for children, to block inappropriate or harmful content.
  • Network Segmentation: Divide your network into separate parts to isolate sensitive devices or areas, preventing potential breaches from spreading.
  • VPN (Virtual Private Network): If you need remote access to your home network, use a VPN to create a secure connection and protect your data.
  • Real-time Monitoring: Continuous monitoring of your network allows you to keep an eye on the traffic, devices, and activities taking place. You can quickly identify any unusual behavior or potential security threats as they happen.
  • Instant Alerts: By setting up alerts, you can receive immediate notifications whenever there is a security event or suspicious activity on your network

My search for a solution covering above features ended with Firewalla , Firewalla | Firewalla: Cybersecurity Firewall For Your Family and Business. Firewalla is a very good network security solution, and if you have more than 10 to 20 devices accessing the internet including the smart devices and IOT devices its worth considering investing on one of the many models they offer. In the next part of the blog i will explain the steps I followed to implement a secure home network

Posted on

A Comparison of Traditional VPNs and Mesh VPNs: Pros, Cons, Protocols, and Solutions

Introduction: Virtual Private Networks (VPNs) play a crucial role in securing network communications and enabling remote access. While traditional VPNs have been widely adopted, mesh VPNs offer a decentralized approach to connectivity. In this blog post, we will compare traditional VPNs and mesh VPNs, exploring their respective pros and cons, the protocols and technologies used, as well as well-known solutions in each category.

Traditional VPNs: Traditional VPNs operate on a client-server model, where all network traffic is routed through a central server or a set of servers. Here are the key aspects of traditional VPNs:

Pros:

  1. Centralized Management: Traditional VPNs offer centralized control and management, allowing administrators to easily monitor and enforce security policies.
  2. Well-Established Protocols: Popular protocols like IPsec and SSL/TLS are commonly used in traditional VPNs, providing a high level of security for data transmission.
  3. Remote Access: Traditional VPNs excel at providing secure remote access for individual users or devices, enabling them to connect to a private network from anywhere.

Cons:

  1. Scalability Challenges: As traditional VPNs rely on central servers, scaling the infrastructure to accommodate a large number of users or sites can be complex and costly.
  2. Single Point of Failure: The central server(s) represents a single point of failure. If it goes down, the entire VPN connection may be disrupted.
  3. Performance Bottlenecks: Since all traffic is routed through the central server, increased usage or bandwidth-intensive activities can lead to performance bottlenecks.

Protocols and Technologies:

  • IPsec: A widely-used protocol suite that provides encryption and authentication for secure communication over IP networks.
  • SSL/TLS: Primarily used for securing web traffic, SSL/TLS is often employed in VPNs for remote access and site-to-site connections.

Well-Known Traditional VPN Solutions:

  • Cisco AnyConnect: A popular commercial VPN solution that offers secure remote access and site-to-site connectivity.
  • OpenVPN: An open-source VPN solution known for its flexibility, strong security, and cross-platform compatibility.
  • WireGuard: A lightweight and efficient open-source VPN protocol known for its simplicity, speed, and strong security.

Mesh VPNs: Mesh VPNs take a decentralized approach, allowing nodes to communicate directly with each other without relying on a central server. Let’s explore the key characteristics of mesh VPNs:

Pros:

  1. Scalability and Flexibility: Mesh VPNs can easily scale to accommodate a large number of nodes and adapt to changes in network topology.
  2. Enhanced Resilience: The decentralized nature of mesh VPNs enables dynamic routing and fault tolerance, minimizing the impact of node failures on the entire network.
  3. Improved Performance: By enabling direct communication between nodes, mesh VPNs can reduce latency and optimize traffic routing, resulting in better performance.

Cons:

  1. Complexity: Setting up and configuring a mesh VPN can be more complex than traditional VPNs, especially in large-scale deployments.
  2. Security Considerations: As mesh VPNs rely on direct communication between nodes, ensuring proper encryption and authentication is crucial to maintain security.
  3. Limited Standardization: Compared to traditional VPNs, mesh VPNs are still evolving, and there is currently no standardized protocol widely adopted across all solutions.

Protocols and Technologies:

  • WireGuard: A lightweight and efficient open-source VPN protocol known for its simplicity, speed, and strong security.
  • Tinc: Another open-source VPN solution that supports mesh networking, offering flexibility and robust encryption.

Well-Known Mesh VPN Solutions:

  • WireGuard: As a protocol, WireGuard is utilized by various mesh VPN solutions like Algo VPN, Streisand, and Nebula.
  • ZeroTier: A commercial VPN solution that offers a virtual Ethernet network with mesh capabilities, providing secure and easy
  • Tailscale is a mesh VPN solution that simplifies secure network connectivity across devices, enabling seamless and encrypted communication.