I currently use Borg for all my backups. To have a remote backup I placed my old Synology NAS at a family member and connected it to tailscale (via a tailscale docker container). That way I could also can do Borg backups to that remote NAS.
Though I have problems with the stability of the tailscale connection from the NAS. And honestly, I’m a bit tired to fix these problems.
I would like to have a self hosted backup solution, that can reach the synology NAS. I would like to avoid port forwarding at my family members network (for obvious reasons). I have a VPS in the internet that I can use for a common self hosted contact point (like I setup headscale there instead of using official Tailscale servers).
What would be your way for handling these remote backups?
Yes it is uncommon, as people have mentioned it is a Wireguard wrapper. Try just using Wireguard and troubleshoot from there. I would want to know what that ‘simple’ solution is failing. Your workaround could have similar issues.
Troubleshooting wireguard is a pain in the ass, it using UDP and all that.
Why would UDP be any more difficult than TCP (or anything else) for troubleshooting? If nothing else, it should be easier because there are no stateful connections and every packet is “fire and forget”. Now, as a tunneling technology, WG might be more difficult than a simple client/server socket-driven application, but that just means some routing tables need to be inspected and you have to understand IP subnets. In any case, you’d still want to obtain packet traces from both ends of the WG tunnel.
With TCP there are built in listeners on OSs which you can use to test. Also TCP will work before UDP. For whatever reason firewalls and such do weird things with UDP traffic. I always use a cli tool that I can’t remember the name of for testing.
What are these “built in listeners” that you speak of, and which OS’s can I find this on?
This doesn’t really explain why troubleshooting is more difficult, but rather that firewalls often cause trouble for UDP. My question was “why would diagnosing a UDP problem be harder than anything else?”, not “why is UDP more problematic?”. I’m fully aware that some firewalls are configured with absurd parameters, like blocking ICMP, QUIC, or even TLS in some bizarre situations. But my tools for debugging network troubles have always been the same: tcpdump for passive tracing, nc to coerce an active response, and icmp/icmp6 ping for basic connectivity and MTU verification.
Whether it’s UDP or anything other protocol, those tools have proven sufficient for me. Do you use something else?