Today a small win, the kind worth double: the Scar under the corporate VPN, and from there connected to the GX10 with VS Code Remote as if I were on the sofa. For months those two things couldn’t coexist.
GlobalProtect eats the house
When I work, the laptop lives under GlobalProtect. The VPN takes the default route, takes the DNS, and in the config I was handed it also gets the pleasure of muting the home LAN: the GX10’s local IP stops existing the instant the shield goes up. From a corporate security point of view that’s coherent. From the point of view of someone who wants to open VS Code and work on the mini server in the living room, it’s a problem.
The old patch: the reverse SSH tunnel
For months I’d been surviving on a reverse SSH tunnel. The GX10 opens an outbound channel to an internet-reachable machine, and when I need it, it brings port 22 back to me.
It works, I won’t deny it. But it means a daemon to keep alive, a public port exposed, anxiety whenever the IP changes, and the mathematical certainty that the tunnel will have dropped exactly when you need it now. Resurrection rituals every time. I had come to hate that tunnel.
Tailscale: the 100.x IP never dies
The fix I’d been putting off for ages was Tailscale.
GX10 and Scar in the same tailnet, the mini server takes its 100.x.y.z
address and that address stays put forever. Not an IP that changes, not a
port to forward, no daemon to pray to: it’s the machine’s address.
In VS Code it takes one entry in the Remote-SSH settings:
Host gx10
HostName 100.x.y.z
User ale
And the Remote attaches as if the GX10 were sitting next to the laptop.
The best part: it works under the VPN, thanks to DERP
The real question was another one: under GlobalProtect, which just turned the
LAN off, does the 100.x hold up? It holds. And this is the part worth a
post.
Tailscale always tries the direct WireGuard path first (UDP 41641), the fastest one. Nasty corporate VPNs choke outbound UDP, don’t even get me started. Tailscale’s fallback is DERP: a relay that encapsulates WireGuard packets inside HTTPS over TCP 443. And even the most paranoid VPN has to let HTTPS on 443 through, because otherwise it stops letting you work at all.
Translated: I raise GlobalProtect, the home LAN dies, the GX10’s 100.x
still answers. Packets take the detour (laptop, relay, GX10) and in the clear
there’s only end-to-end WireGuard ciphertext. The relay reads nothing, it
just delivers mail.
Verifying it takes two commands:
tailscale status # under VPN you'll see "relay <region>" instead of "direct ..."
tailscale ping gx10 # pong ... via DERP(fra) in ...
If instead you want to force Tailscale to stop hoping for a direct route and jump straight to the relay (useful when UDP dies on an open connection and the fallback stalls), pull the UDP out from under its feet:
sudo iptables -A OUTPUT -p udp --dport 41641 -j DROP
No UDP, no direct: the client goes straight to DERP over 443. When you drop the VPN you remove the rule and you’re back on the direct path without noticing.
The cost of relaying is honest: more latency, not exactly stellar bandwidth, it’s a third-party relay not a dedicated line. For a remote terminal, editing files and launching jobs on the GX10 it’s plenty. Heavy transfers I wait until I’m home, on my own network.
Three philosophies compared
The reverse tunnel, which you pray to. The corporate VPN, which blocks everything and then wonders about you. And a relay that takes the most controlled traffic on the internet, HTTPS, and uses it as a private fast lane. The mailman won.