If it’s true that I do not need to expose a port on my router for Wireguard, I’d probably just do that - it’s simpler to set up and use. The only reason I switched was that I wanted to close 51820 on my router, and I thought I couldn’t use Wireguard without it. But the poster below suggests that might not be the case anyway. I will investigate.
Why is thing being downvoted? I’m curious to learn Tailscale doesn’t need any ports for it to work, not saying Wireguard is insecure, but want to understand the reasoning .
If you run the WG server on your Unraid server, then you definitely do need to port forward. If it works without port forwarding, then your Unraid server is exposed to the internet (which defeats the purpose of WG).
If upnp is enabled, then your router may have automatically done the port forward for you. But I was not aware that the Wireguard supported upnp.
Any application built on top of another application is less secure by definition just for the fact that it adds at least another potential point of failure. I’d go back to simple and plain wireguard.
I ended up setting up cloudflared - seems quite secure. I realize I’m relying on a third party, but overall, I feel like this is a reasonable solution.
Wireguard is selfhosted, tailscale isnt. You are relying on a third Party and that is another layer of problems. Tailscale will most likely not be insecure, but you never know. Wireguard has a small codebase and is well tested
Yes, wireguard will require port forwarding. you can open a non-standard port… however, if you want to make it more secure, use cloudflare’s “cloudflared tunnel”.
If all seems too complicated then go with the tailscale.