I would really really really like to have one device on my tailnet as the exitnode for all other devices on the tailnet. However, most VPNs make this really difficult. Is there any way to do this? I've read it's possible with split-tunnelling, but ProtonVPN (which I use) doesn't support that. I just installed Alpine Linux on my RPI 4b. And would like to use this as my exit node. Does anyone have any tips for how this could be done?
Ok… I think I didn't get what you're trying to say. Do you wanna run a VPN through a VPN?
I mean, you have your RPI 4b as a Tailscale exit node, but the RPI 4b itself connects to the ProtonVPN?
Right, so I've got Alpine on the RPI, and have installed/configured protonvpn with wireguard. However, if I then start Tailscale, the already running ProtonVPN connection goes down. Same happens if Tailscale is already running, and I try to start the ProtonVPN connection it will just refuse the connection.
I want it to connect to both services, as then this can act as the exitnode for all other devices on the tailnet. Whilst also giving the benefit of ""being in a different location"" with protonvpn.
So essentially, both services wants to use /dev/net/tun, but only one can.
Well, I found this article saying that theoretically is possible, however not so much. It says that depends on how the other VPN works. They even suggest some workarounds, so take a look
Anyway, have you tried to create another tun/tap service to run both VPN?
Yeah already scoured their documentation for this, but no luck with any of the workarounds sadly.
Have not tried to do the latter you mentioned though? Not sure how to do that, but I will look into it asap.
I never had to create a new TUN/TAP interface before, so I'm on the same boat as you. I'm brainstorming here with you and hoping for the best
But here is how to create a new tun interface:
https://www.baeldung.com/linux/create-check-network-interfaces
You'll have to manually set some parameters to make it work, I guess