Andrew Cunningham
Just about every home office, small business, or just-getting-on-its-feet startup is going to have at least one Wi-Fi router, and many will use some kind of network-attached storage (NAS) device for shared files. The latter is particularly useful if you’ve got data you don’t want to store with Google, Microsoft, Apple, Dropbox, or some other cloud storage provider that will charge you monthly for the privilege.
Many of these networked devices offer additional features beyond the basic routing of network traffic or storage of bits and bytes. One of those is the ability to function as a VPN server. This allows devices outside of your network to access resources inside, and provides an additional layer of security on untrusted, unencrypted airport and coffee shop Wi-Fi networks.
These VPN services can be okay, for limited use. They don’t require additional hardware purchases. And many recent models even support the same encrypted WireGuard® tunnels on which Tailscale is built. There was a time in my life where my Netgear router was providing VPN service for my home network; similar services are provided by routers from TP-Link and Asus, as well as NAS devices from Synology and QNAP. And it worked fine!
Except for the times when it didn’t.
There are many individual reasons why I don’t recommend a built-in router or NAS offering as a VPN server, but most of them fall under four headings: reliability, performance, security, and ease of use. Let’s look at these things one at a time, and talk about when and how Tailscale provides a better solution.
Reliability
Your router or NAS devices generally streamline most of the steps that make setting up your own VPN server a pain—downloading the right software packages and generating keys and so on. But they aren’t doing anything to facilitate connections between devices. Even with everything configured properly on your VPN server’s end, these OpenVPN or WireGuard-based solutions don’t offer ways around a restrictive NAT.
My self-hosted VPN would frequently fail to connect on airplane Wi-Fi networks, or when I was using my phone’s hotspot feature. Or it would appear to connect, but then struggle to load webpages until I turned it off.
And when my VPN client wouldn’t connect, there wasn’t a whole lot I could do about it. Assuming you and your users need to use the internet for something, they’ll likely just use the network without the VPN enabled, which defeats the purpose.
Hosting your VPN service on your router or NAS device also introduces what IT types call a “single point of failure”—one thing that can knock out multiple services if something goes wrong. Did an automatic firmware update restart your router while you were in the middle of a file transfer? Is your NAS down for maintenance because a drive went bad? Well, now your VPN is down too.
Performance
Dedicated router and NAS boxes have CPUs and memory, just like your computer or phone. But these components are usually exactly as fast as they need to be for the device to perform its core routing or drive-handling functions—they don’t have much power to spare.
A single VPN connection isn’t hugely resource-intensive. But once you have multiple users and devices attempting to connect to your VPN server at the same time, the weak processor in your router or dedicated NAS box will struggle to keep up. Your users will notice more latency and slower speeds—web pages that take longer to load, file transfers that take longer to complete, and frustrating inconsistency.
Another limitation is your actual internet connection. For home and business connections via cable providers like Comcast, the advertised connection speeds you’re paying for often only apply to your download speeds. Your upload speeds are typically a fraction of that—a 2 Gbps Comcast Business plan in my area, for example, only offers 300 Mbps upload speeds.
That’s a problem if you’re trying to provide a VPN service, because all traffic is routed through the internet connection that router or NAS is using. In a best-case scenario, your bandwidth will be limited to that connection’s upload speed. 300 Mbps isn’t bad for a device or three, but if you’re splitting that bandwidth between more users or devices, you’re looking at another bottleneck. (Fiber internet plans like Verizon FIOS usually offer symmetrical download and upload speeds, something to consider if fiber is available in your area.)
The last thing to consider: what kind of VPN server can your router or NAS device host? Is it OpenVPN? Because OpenVPN, for technical reasons we won’t get into, is generally slower than the WireGuard protocol that Tailscale uses.
Security
If your router or NAS device offers WireGuard compatibility, you can usually be confident that your VPN connections are securely encrypted. But the reality is that any internet-connected device is going to have security flaws. Addressing those flaws will require fixes, and being able to install those fixes will require your router or NAS manufacturer to release software and firmware updates that include them.
There are networking companies that are pretty good about releasing security updates and communicating when you can expect security updates to stop. Synology, QNAP, and Amazon’s Eero maintain detailed support documentation that spells out exactly when users can expect security patches to dry up.
But most router makers are less diligent. Ubiquiti maintains a list of “vintage” products that are no longer being sold but are still getting updates, and “legacy” products that generally aren’t being maintained. Asus also has an “end-of-life product list” for routers that are no longer being updated. But neither makes any promises about how long devices have before they end up on those lists.
Both TP-Link and Netgear stop supporting routers three years after their “last sale” or “end-of-sale” date. But Netgear in particular is noncommittal about this, saying only that these devices “may” receive “critical bug fixes and security patches as determined by Netgear.” And TP-Link has a habit of selling multiple revisions of a router with the same model number, making it especially hard to tell whether you’re getting something that’s actively supported or not.
All of this is to say that, for consumer routers in particular, you’re buying hardware that may receive critical security patches rarely and sporadically, and you won’t always know whether or when your support window has closed. For mission-critical infrastructure, this is what people in IT call “less than ideal.”
Ease of use
Security isn’t just about patches; it’s also about administration. If you aren’t on top of changing or deleting profiles on the VPN server when people no longer need access, or limiting access to critical resources that not everyone needs to be able to use, you’re also opening yourself up to security breaches.
Not every standalone VPN server works the same way, but here’s what administration looks like if you have a WireGuard-based VPN server on your router or NAS. For every user or device you want to connect to your VPN, you have to create a profile. This profile tells the client system how to find the VPN server, and helps the VPN server identify which client it’s talking to. Users or administrators have to install these profiles on their devices, either manually or by scanning a QR code. If you want to restrict access to certain servers, apps, or other network resources, this is usually done by maintaining a list of allowed IP addresses for each profile you’re creating. You may also need to open ports on your router to allow VPN traffic through its firewall, depending on how it’s set up.
Once you’ve done all of that, you’ve now got a new system to maintain, totally separate from whatever other applications and accounts you’re using for communication or managing your devices or anything else. And as your business changes and grows, the work of adding and removing and distributing profiles, changing access permissions, and general troubleshooting is going to add up.
It’s this kind of overhead and complexity that can lead to bad decisions, things like “not removing profiles or revoking permissions when people don’t need them anymore” or “just giving out a couple of profiles for multiple people so you don’t have to fiddle with things so much.”
How Tailscale fixes it
At this point I’ve either convinced you that it’s time to switch away from the VPN built into your router or NAS, or I’ve scared you away from trying it in the first place. Now what?
Tailscale VPN was designed to address the problems with these kinds of centralized, legacy VPN servers. For starters, there’s no need to run a “server” in the first place. You install the Tailscale client on any two devices, sign in with your existing single-sign-on (SSO) identity provider (this can be Google, Microsoft, Apple, or many other kinds of accounts you’re already using), and you’ve created your first “tailnet.”
Tailscale’s infrastructure handles the control plane that allows these devices to find each other, and this establishes a direct peer-to-peer connection between devices for data transfers. There’s no underpowered CPU to overload, no software or firmware to patch, and no single internet connection to oversaturate with simultaneous requests. Our control plane’s NAT traversal mechanisms help get you a fast, reliable connection on many networks where traditional VPNs (especially basic self-hosted VPNs) don’t work.
Those peer-to-peer connections also help performance in a couple ways. For one, direct connections are generally faster all-around than connections with a VPN server in the middle—you’re limited only by the speed of both devices’ internet connections and the physical distance between them. For the other, Tailscale creates a “split tunnel” by default, which means that only data traveling between nodes on the tailnet actually uses those encrypted tunnels. The rest of your internet traffic flows as it normally would, so even a poor or slow connection on one side isn’t going to slow normal downloads or webpage navigation to a crawl.
Because you and your users are signing in through your existing identity provider, it also means no more profiles to create, edit, distribute, or delete. Access to your tailnet is granted and disappears along with their user account. And permissions are managed in one central console, where you can assign privileges to individuals or groups of people, or restrict access to servers or other resources, using Tailscale’s powerful and flexible grants and tags. Groups you’ve already configured in your identity provider can be used as a starting point, if you have them.
That kind of flexibility extends to other areas of Tailscale. Need to offer your users a way to encrypt all their traffic on public Wi-Fi networks in airports or coffee shops, not just their Tailscale connection? Use Tailscale’s Mullvad VPN integration or configure an exit node, which can turn almost any node in your tailnet into a traditional VPN server, even the Apple TV box in the conference room. Need to connect to a printer, or some other simple networked appliance? Use a subnet router to get those devices in your tailnet without sacrificing security. Use MagicDNS to make resources available via human-readable URLs rather than hard-to-remember IP addresses.
The bottom line
It might be tempting to just use the VPN functionality that came with a thing you already paid for, but the theoretical convenience is easily outweighed by the real-world headaches. The feature will be a pain to administer, especially for quickly growing teams; you may leave yourself open to security vulnerabilities; you’ll deal with hit-or-miss performance and you may be unable to connect on any networks that block VPNs (intentionally or otherwise).
Tailscale simplifies or eliminates all of the most frustrating problems. Granting and restricting access is centrally managed, and your users can use the same accounts they already use for email or other services. There are fewer potential performance bottlenecks, and Tailscale’s NAT traversal will help you get a connection on virtually any network. And setting up and rolling out Tailscale is easy—even if you rely on an external contractor for IT support, or don’t have any IT support at all.
Tailscale’s Personal plan supports up to six user accounts and unlimited devices, making it great for small teams or internal testing. And we offer a full range of paid plans with different features and usage limits so that your Tailscale setup can… scale, right alongside your business.
