26
How do you use VPN?
(lemmy.curiana.net)
you are viewing a single comment's thread
view the rest of the comments
view the rest of the comments
this post was submitted on 09 Apr 2026
26 points (86.1% liked)
Selfhosted
61708 readers
444 users here now
A place to share alternatives to popular online services that can be self-hosted without giving up privacy or locking you into a service you don't control.
Rules:
-
Be civil.
-
No spam.
-
Posts are to be related to self-hosting.
-
Don't duplicate the full text of your blog or readme if you're providing a link.
-
Submission headline should match the article title.
-
No trolling.
-
Promotion posts require active participation, with an account that is at least 30 days old. F/LOSS without a paywall has exceptions, with requirements. See the rules link for details. Tags [CBH] or [AIP] are required, see the links in Rule 8 for details.
-
AI-related discussions and AI-involved promotional posts have additional requirements for tagging, as noted in Rule 7 and the AI & Promotional Post Expanded Rules post, and find example disclosures here.
Resources:
- selfh.st Newsletter and index of selfhosted software and apps
- awesome-selfhosted software
- awesome-sysadmin resources
- Self-Hosted Podcast from Jupiter Broadcasting
Any issues on the community? Report it using the report flag.
Questions? DM the mods!
founded 3 years ago
MODERATORS
I use Tailscale with an exit node container that forwards all traffic to the commercial VPN via a wireguard config. This "hopping" solution serves me well enough, and works for Android too.
If you want to simultaneously have two VPN interfaces, you may wanna consult this and this guide. The principle should apply with non-Tailscale wireguards too I think
So you're using tailscale android app as the only VPN and all traffic from your phone goes through your local network, yes?
Your tailscale exit node is deployed on some server in your network, right? (I've set up my WG server on my router) Does your router just port forward all tailscale traffic to it?
Yes, the app is the only "Android VPN". The exit node is deployed on another network, but there should be no problem deploying it locally.
My phone would be attempting to make direct WireGuard connections to my other Tailscale nodes (be it the server, the exit node, or any other device), so it'll prefer local connections. When it can't (e.g. in a different and restrictive network), it will relay these traffic through DERP servers. Tailscale automate these processes very well, so no port forwarding is needed.
Note that to establish these encrypted direct tunnels, Tailscale clients have to talk to a control server to fetch required metadata. I selfhost this piece via Headscale along with the DERP servers. The stack would be quite complicated for those who already had a wireguard tunnel, but I found myself liking it because Tailscale has other cool features too.
Alternatively, I guess you could also do "split-route" by defining different peers in your Android WireGuard app, and use different
AllowedIPsfor them.That's exactly what I've been trying but it doesn't work. Only one peer is able to do a handshake. It looks like it should work but I actually haven't seen anyone recommending this or saying they manged to set it up. Everyone just ends up routing everything through private VPN. I will read some more about tailscale but I think it's an overkill for me. I will probably just use different VPNs in separate android profiles.
If you're using Mullvad as your VPN Tailscale supports it right out of the box. You could use Tailscale only and use Mullvad's VPN as an exit node. This is probably the easiest and most out-of-the-box ready solution.