Tailscale Zero-Trust Access
Identity-based remote access over a WireGuard overlay. No open inbound ports, deny-by-default ACLs as policy-as-code, pfSense as subnet router.
The problem with the old model
A traditional VPN wants an open inbound port, shared credentials, and trusts anything that makes it past the perimeter. For a lab reachable from untrusted networks, that's attack surface bought for convenience. The goal was remote access with none of those tradeoffs.
Architecture
Every client and lab node runs Tailscale. Traffic from a remote client rides the WireGuard overlay, gets its identity verified and ACLs evaluated at connection time, then reaches internal services through a single subnet router on pfSense. The firewall advertises the internal /24, runs split DNS for remote clients, and serves Unbound to the LAN.
ACL tiers. policy as code
tag:adminFull subnet, all hosts, all ports.tag:dnsFirewall DNS port 53 only. Verified to deny SSH and Grafana.tag:monitorGrafana, Prometheus, and Alertmanager. and explicitly nothing else.No inbound ports
The edge firewall has nothing open. Every connection initiates outbound through Tailscale's coordination server. the internal network is never directly addressable from the internet.
Tags over firewall rules
Segmentation is identity-based and centralized. Adding a node or changing a tier is an ACL edit, not a sweep through per-host iptables.
pfSense as the single subnet router
Subnet advertisement, split DNS, and access policy live on the firewall. See the migration writeup for why Pi-hole used to do this job.
Roadmap
Stack