Skip to content

Latest commit

 

History

History
161 lines (101 loc) · 6.64 KB

guide.pt-pt.md

File metadata and controls

161 lines (101 loc) · 6.64 KB
title excerpt updated
Local Zone VPN-as-a-Service (VPNaaS) with Tailscale integration (EN)
Learn how to integrate Tailscale into your OVHcloud Local Zone instances, providing a VPN-as-a-Service (VPNaaS) solution
2024-09-24

Objective

Suppose you have Public Cloud instances in different OVHcloud Local Zones, such as Prague and Madrid, and you need to securely connect them. Instead of setting up a complex VPN infrastructure, you can use Tailscale, which leverages WireGuard, to easily create an encrypted mesh network between your instances. This is particularly useful for developers, distributed systems, or secure cross-region communications.

This feature allows you to:

  • Set up a VPN mesh network for secure connections between Public Cloud instances in different OVHcloud Local Zones.
  • Easily connect and manage your instances via Tailscale.
  • Enable ephemeral nodes so that temporary instances are automatically removed from the Tailscale network when they are deleted.
  • Use Tailscale’s Access Control Lists (ACLs) to manage network permissions.

This tutorial will guide you through the steps to integrate Tailscale into your OVHcloud Local Zone Public Cloud instances, providing a VPN-as-a-Service (VPNaaS) solution. Tailscale allows you to create a secure, peer-to-peer mesh network between your servers in different geographical locations.

Requirements

Instructions

Step 1 - Create two instances in OVHcloud Local Zones

Create two instances in different OVHcloud Local Zones, such as Prague and Madrid.

Ensure that public networking is enabled for both instances.

Step 2 - Log into Tailscale

1. Log into your Tailscale account at Tailscale.
2. Go to the Devices{.action} tab and click Add Device{.action}.
3. Select Linux server as the device type.

Tailscale - Add device{.thumbnail}

4. Enable ephemeral nodes to ensure that nodes are automatically removed from the network when their corresponding server is deleted.

Tailscale - ephemeral nodes{.thumbnail width="600"}

5. Copy the provided install script for later use.

Step 3 - Install Tailscale on the Prague instance

SSH into the Prague instance:

ssh root@$PRAGUE_IP -i ~/.ssh/tailscale-test

1. Install Tailscale on the instance by running the following command:

curl -fsSL https://tailscale.com/install.sh | sh && sudo tailscale up --auth-key=$TAILSCALE-KEY

2. Log in to the Tailscale admin panel to approve the new node by visiting https://login.tailscale.com/admin.

3. Approve the node using the menu on the right (with the ...{.action} button).

Tailscale - node approval{.thumbnail width="600"}

4. Once approved, you will see a success message in the terminal:

Installation complete! Log in to start using Tailscale by running:
tailscale up

Step 4 - Install Tailscale on the Madrid instance

1. SSH into the Madrid instance:

ssh root@$MADRID_IP -i ~/.ssh/tailscale-test

2. Repeat the Tailscale installation process on the Madrid instance:

curl -fsSL https://tailscale.com/install.sh | sh && sudo tailscale up --auth-key=$TAILSCALE-KEY

3. Approve the Node in the Admin Panel:

Like with the Prague instance, a prompt will appear asking you to approve the Madrid node. The installation will remain pending until approval. Visit https://login.tailscale.com/admin and approve the new node.

4. After approval, the installation will finish, and you will see the following success message in the terminal:

Installation complete! Log in to start using Tailscale by running:
tailscale up

Step 5 - Verify the Tailscale network

To check the status of the Tailscale network, log in to one of your instances (e.g., the Prague instance) and run the following command:

tailscale status

The output should look like this, showing the connection between the two nodes:

100.X.X.X   tailscale-node-prague john.doe@ linux   -
100.X.X.X   tailscale-node-madrid john.doe@ linux   -

Step 6 - Test the Connection Between Nodes

Now, test the connection between the two nodes using Tailscale’s ping command.

On the Prague instance, run:

tailscale ping tailscale-node-madrid

On the Madrid instance, run:

tailscale ping tailscale-node-prague

You should see a pong response indicating successful communication between the two instances, similar to this:

pong from tailscale-node-madrid (100.X.X.X) via [X:X:X:X:X:X:X]:41641 in 34ms

Step 7 - Manage Key Expiry

Tailscale nodes are assigned keys, and these keys can expire. If your nodes are expected to remain in the network for a longer period, you may want to disable key expiry. You can do this in the Tailscale admin panel, depending on your security and access requirements.

Tailscale - Manage key expiry{.thumbnail width="600"}

Step 8 - Access Control

Tailscale creates a mesh network, meaning all nodes can communicate with each other by default. If you need more granular control, use Tailscale's Access Control Lists (ACLs) to specify which devices can communicate with others.

You can read more about ACLs here: Tailscale ACL Documentation.

Go further

Please send us your questions, feedback and suggestions to improve the service:

If you need training or technical assistance to implement our solutions, contact your sales representative or click on this link to get a quote and ask our Professional Services experts for assisting you on your specific use case of your project.

Join our community of users.