Then sign me up! I have my own unbound instance.. but also been pretty happy just using custom /etc/hosts files, so not feeling a strong incentive to shave this yak right now.
You can't deny, at this point in its life, marketing is king for a newly-minted unicorn like Tailscale, as it eyes that Gartner Magic Quadrant leadership position for Zero Trust Networks ;)
No different than the interaction between MagicDNS & any other upstream DNS (Google, Cloudflare, your own, etc).
The built-in resolver at 100.100.100.100 handles the *.your-tailscale-suffix names in your tailnet and the rest that doesn't match goes upstream. Basically.
Configuring DNS in general was there before, but there are a couple of NextDNS-specific things that went live: automatically using DoH when using NextDNS, setting profiles on a per-device basis so you can vary what things are blocked or not, and optionally sending client info to NextDNS so that your NextDNS dashboard gives you a better picture of what devices are querying what.
And there's a little UI polish coming for the admin panel to show NextDNS configuration a bit more cleanly, but that's not live yet.
I've been using this setup for a few weeks now on the unstable client. Happy to see it stable now. The integration between the two services is really nice. Personally, have been a NextDNS user for a little over a year and now a fan of Tailscale. :)
>Difference being you can now set IPv6 DNS servers. It's been a while since I tried but this wasn't possible or I did something wrong prior.
Using ipv4 NextDNS servers returned 'youre using NextDNS but without configuration'.
What's new is that your NextDNS configuration profile is preserved even if your client can't do IPv6. We did DNS-over-HTTPs previously for the big public DNS providers, but now we also do DoH for NextDNS, using IPv4 or IPv6 for the underlying TCP connection as needed, but always passing through your NextDNS configuration.
The current UI just makes you paste in your NextDNS config-specific IPv6 address as a means of parsing out your config from the lower bits of the address. We have better UI coming.
(We don't do the NextDNS traditional port 53 DNS. They don't really support it with IPv4. There's a IP linking mechanism but it doesn't work with multiple devices)
Yes. The DNS bootstrap phase is annoying and complicated though. Currently we only do DoH for the big public DNS providers that have well known anycast IPs for their DoH endpoints. That means there's no bootstrap needed.
Sure, when you're right next to it, but I suppose if you're away from home and using your VPN to query your pihole, NextDNS might be faster. But yes I found the dig quite out of place, but for the reason that everyone I know who runs a pihole is not to run their own DNS resolver but (1) to block ads (2) not send more data than required to other services (a strike against NextDNS) (3) tinker, have more control (4) learn
> How could it possibly have lower latency than something that's literally on your local network?
I believe, what they mean is, NextDNS, given its global footprint, is lower latency than pi-hole in your local network connected via Tailscale over public Internet.
Sorry, author here. It got edited down a bit for brevity.
For one user never leaving your house, you're correct.
But once you have two or more users in different cities (or you're traveling), then your Pi at home will almost always lose compared to a geo-replicated service.
I think this is a nice feature. I travel a lot. Having a pi or vm hosting my adblocking resolver will force every request to traverse hetzner in Germany because that’s where I have my stuffs. By using Nextdns I will always have a resolver in the country where I am since they are distributed over the world. Cuts down on the latency and geolocation aware stuffs won’t go bananas and think I’m in Germany.
Ofc, as soon as I enable the use of exit nodes I will be back in Germany again. But I don’t always need exit nodes. Split can be sufficient and this solved one of the issues I had with my use case.
I literally just spent some time this weekend trying to get it working with a dnsresolver locally routing my home network there and then out to nextdns, all through tailscale. The issue really came down to something I didn't bother diagnosing, and very well could've been my router.
But. This just solved all those issues. Threw my nextdns address into tailscale and away i go. I swear every single time I run into some modern inconvenience of the web Tailscale (by mission statement) is there to solve it.
I had the same issue with NextDNS, and I also wanted to make Mullvad work with Tailscale. It does weird routing stuff on Linux so I had to write a custom script to make both VPNs work at the same time, and on iOS they're not compatible at all.
Then I wondered why I needed NextDNS at all, so I just replaced everything with pi-hole and zerotier (tailscale but plays better with custom networks. It's a simple interface with an IP address. )
Tailscale is cool and shiny, but it's one of those automagic software that don't leave much space for customisation and hacking. I guess I'm not the intended audience.
> zerotier (tailscale but plays better with custom networks. It's a simple interface with an IP address. )
That's like saying "it's like Cisco Anyconnect, except with less GUI applications"
They're both VPNs, that's basically all they've got in common.
Tailscale builds upon wireguard and creates a pretty polished interface for it. Zerotier has their own VPN technology and also provides hardware appliances for VPN termination
Hoping they eventually relent and provide authentication/authorisation themselves. Not keen on relying on Microsoft or Google for this low level control over my network.
They don’t want to, because it’s Hard and if (when?) some part of it fucks up you get blamed. They’ll let you use your own but only if you pay them enough.
Interesting quirk about NextDNS — I found their servers will make a http/https request to the homepage of any domain/subdomain that is resolved via their DNS.
If you already have a pi-hole and you want it to be your DNS, you can configure the tailscale ip address of the pi-hole server (100.x.y.z) as the global nameserver in the DNS settings in tailscale, and it will route all your DNS queries to the pi-hole.
You can also have the pi-hole configured to use NextDNS as its upstream nameserver, and that works very well. Also, you can set up the server as a subnet router, and have access to all your machines on the LAN, even if you can't install tailscale on all of them.
This somehow didn't really work reliably for me. The NextDNS web interface always showed "This device is using NextDNS with no configuration." and browsing felt slow, like there was a small delay with every interaction. Went back to the macOS CLI client for NextDNS and it's working well again.
Sounds like maybe you entered your NextDNS IPv4 address instead of just the IPv6? (UI improvements there coming soon.) We only ask for the v6 to get the config profile out of it but actually use either address family to DoH as needed.
I haven’t used Tailscale [1][2], but is this very easy (UI/UX) to turn off temporarily? Does NextDNS assign a unique IPv6 address for each account to know this is my account and to apply my chosen filter lists?
I use NextDNS on my devices and turn it off temporarily when something I need to access doesn’t work because of something getting blocked by the filter lists (I do manage the allow list on my NextDNS account for any permanent or long term changes).
Seems like this doesn’t support multiple NextDNS profiles (says it’s in alpha) and the UX looks a bit rough to me.
[1]: I don’t seem to have a need to use Tailscale so far since the devices in my home network are shutdown when I travel and I don’t need access to them at all.
[2]: Besides, I don’t wish to signup for something through a Google or Microsoft or GitHub account (or other third party account), which are the only options supported by Tailscale. I’ll consider Tailscale if/when it supports a simple email/password account registration.
Can't edit my previous comment, but I checked on this question of mine:
> Does NextDNS assign a unique IPv6 address for each account to know this is my account and to apply my chosen filter lists?
NextDNS does assign a unique IPv6 address for each profile in an account, and the IPv6 address actually ends with the exact profile name. For example, if my NextDNS profile is a7bae4, the IPv6 address would be like 2d17:a4c3::a7:bae4.
I used to use Tailscale to access my nextcloud instance remotely.
However I stopped because I started using protonVPN, and there is no way to run a normal VPN on top of Tailscale, without having some kind of exit-node which will add even more latency.
It would be cool if Tailscale would support some kind of wireguard import, so if the data is not sent to Tailscale recepients, it will send it through the normal Wireguard tunnel.
In my experience the app also had other issues, like excessive battery usage on Android.
Other than that, Tailscale + Head scale, the best mesh network implementation you can find IMO.
Hmm, it's interesting that they are saying it's now supported. I've been using my NextDNS ip6 addresses in Tailscale for one or two years now. I just had to add the ip6 addresses in the global nameservers and checkmark the "override local DNS". It's been working really well. I've been able to use Tailscale to access my Synology for music and blocks ads on my phone.
41 comments
[ 3.1 ms ] story [ 90.2 ms ] threadhttps://github.com/tailscale/tailscale/issues/2452 links to all the client commits.
There was also a lot of control plane stuff to let you specify config for different NextDNS profiles per tags/groups/users/etc.
And NextDNS improved some things on their side too, especially around passing device info to them.
And then, yes, we publicized it after working on it. And closed that bug.
The built-in resolver at 100.100.100.100 handles the *.your-tailscale-suffix names in your tailnet and the rest that doesn't match goes upstream. Basically.
Using ipv4 NextDNS servers returned 'youre using NextDNS but without configuration'.
And there's a little UI polish coming for the admin panel to show NextDNS configuration a bit more cleanly, but that's not live yet.
>Difference being you can now set IPv6 DNS servers. It's been a while since I tried but this wasn't possible or I did something wrong prior. Using ipv4 NextDNS servers returned 'youre using NextDNS but without configuration'.
What's new is that your NextDNS configuration profile is preserved even if your client can't do IPv6. We did DNS-over-HTTPs previously for the big public DNS providers, but now we also do DoH for NextDNS, using IPv4 or IPv6 for the underlying TCP connection as needed, but always passing through your NextDNS configuration.
The current UI just makes you paste in your NextDNS config-specific IPv6 address as a means of parsing out your config from the lower bits of the address. We have better UI coming.
(We don't do the NextDNS traditional port 53 DNS. They don't really support it with IPv4. There's a IP linking mechanism but it doesn't work with multiple devices)
How could it possibly have lower latency than something that's literally on your local network? Once it caches a request it's nearly instantaneous.
I believe, what they mean is, NextDNS, given its global footprint, is lower latency than pi-hole in your local network connected via Tailscale over public Internet.
For one user never leaving your house, you're correct.
But once you have two or more users in different cities (or you're traveling), then your Pi at home will almost always lose compared to a geo-replicated service.
Ofc, as soon as I enable the use of exit nodes I will be back in Germany again. But I don’t always need exit nodes. Split can be sufficient and this solved one of the issues I had with my use case.
But. This just solved all those issues. Threw my nextdns address into tailscale and away i go. I swear every single time I run into some modern inconvenience of the web Tailscale (by mission statement) is there to solve it.
Then I wondered why I needed NextDNS at all, so I just replaced everything with pi-hole and zerotier (tailscale but plays better with custom networks. It's a simple interface with an IP address. )
Tailscale is cool and shiny, but it's one of those automagic software that don't leave much space for customisation and hacking. I guess I'm not the intended audience.
That's like saying "it's like Cisco Anyconnect, except with less GUI applications"
They're both VPNs, that's basically all they've got in common.
Tailscale builds upon wireguard and creates a pretty polished interface for it. Zerotier has their own VPN technology and also provides hardware appliances for VPN termination
https://tailscale.com/blog/how-nat-traversal-works/
They don’t want to, because it’s Hard and if (when?) some part of it fucks up you get blamed. They’ll let you use your own but only if you pay them enough.
You can also have the pi-hole configured to use NextDNS as its upstream nameserver, and that works very well. Also, you can set up the server as a subnet router, and have access to all your machines on the LAN, even if you can't install tailscale on all of them.
Tailscale is truly incredible!
I use NextDNS on my devices and turn it off temporarily when something I need to access doesn’t work because of something getting blocked by the filter lists (I do manage the allow list on my NextDNS account for any permanent or long term changes).
Seems like this doesn’t support multiple NextDNS profiles (says it’s in alpha) and the UX looks a bit rough to me.
[1]: I don’t seem to have a need to use Tailscale so far since the devices in my home network are shutdown when I travel and I don’t need access to them at all.
[2]: Besides, I don’t wish to signup for something through a Google or Microsoft or GitHub account (or other third party account), which are the only options supported by Tailscale. I’ll consider Tailscale if/when it supports a simple email/password account registration.
> Does NextDNS assign a unique IPv6 address for each account to know this is my account and to apply my chosen filter lists?
NextDNS does assign a unique IPv6 address for each profile in an account, and the IPv6 address actually ends with the exact profile name. For example, if my NextDNS profile is a7bae4, the IPv6 address would be like 2d17:a4c3::a7:bae4.
However I stopped because I started using protonVPN, and there is no way to run a normal VPN on top of Tailscale, without having some kind of exit-node which will add even more latency.
It would be cool if Tailscale would support some kind of wireguard import, so if the data is not sent to Tailscale recepients, it will send it through the normal Wireguard tunnel.
In my experience the app also had other issues, like excessive battery usage on Android.
Other than that, Tailscale + Head scale, the best mesh network implementation you can find IMO.