Connect self-hosted software
Last updated
Was this helpful?
Last updated
Was this helpful?
You can also easily connect with self-hosted tools in Violet by or by establishing a .
The server hosting your software will need to whitelist (ie. allow access) to Violet's IP address.
Use the NAT Gateway IP address for your Violet environment:
Violet:
VioletGov:
is a VPN solution that simplifies the setup of secure networks for accessing your on-premises applications. It uses WireGuard for its network traffic encryption and supports various devices like Linux, macOS, Windows, and even cloud servers.
Here’s how to set up Tailscale to connect on-premise applications to Violet securely.
A server or machine that can act as your Tailscale VPN gateway for your on-premises applications (AWS EC2, Azure VM, Google Compute Engine, etc.)
Administrator privileges on all devices that will be part of the VPN network
Internet access for installing Tailscale on the target machine
After signing up, you’ll be able to access the Tailscale admin console at https://login.tailscale.com/admin.
Choose a machine inside your network to act as a gateway (e.g. a server or dedicated VM).
Install Tailscale on your Linux gateway machine:
Authenticate the machine by running the following command:
This will open a browser for you to log in and authenticate the device to your Tailscale account.
Once authenticated, the machine will appear in your Tailscale admin console under Machines.
Subnet routing allows devices outside your on-premise network to access internal resources via the gateway machine.
Identify the subnet you want to route (e.g., <subnet-to-route>).
On the gateway machine, run the following command:
Replace <subnet-to-route> with the appropriate subnet of your network.
After enabling subnet routing, go to the Tailscale admin console and approve the route:
Navigate to the Machines page.
Find the gateway machine and click on the gear icon next to it.
Under Route settings, approve the advertised route.
Install Tailscale on any device that will connect to your VPN (e.g., laptops, remote servers).
Authenticate each client device to your Tailscale account using:
Once the client devices are authenticated, they’ll appear in your admin console as part of your Tailscale network.
Now that the Tailscale VPN is set up, any device on your Tailscale network can access the on-premises resources through the gateway machine.
Ping test: From a client device, you can try pinging an internal IP address within your on-premises network to ensure connectivity:
Access your applications: If you have a web application running on a server within your on-premise network, simply access it using the internal IP (e.g., http:/<internal-ip-addr>:8080).
Check device connectivity: Ensure that your devices are visible on the Tailscale admin console and are connected to the same network.
Firewall issues: Ensure that your on-premise server's firewall allows incoming connections from the Tailscale subnet.
Routes not appearing: Ensure the gateway machine advertises routes correctly using sudo tailscale up --advertise-routes=<your-subnet>.
DANGER: Reusable Tailscale auth keys are sensitive. Please do not share over insecure forms of communication (slack, email, etc.). ONLY use reliable password sharing methods (1Password, Microsoft Entra, LastPass, etc.).
If Violet receives a key over an insecure form of communication, we will ask you to invalidate the existing API key and send us a new one.
Please also share an IP address or domain on your private network that we should be able to ping while connected to the VPN for testing.
Sign up for a Tailscale account at using your preferred method (Google, Microsoft, or GitHub authentication).
Follow the for your specific platform (Linux, Windows, macOS).
Violet needs a to connect to your new VPN. Once your VPN is set up, please provide a reusable auth key to Violet at your earliest convenience.
If your security policy allows, you can to reduce maintenance overhead. If you choose to do this, consider adding for continuous monitoring and retroactive access logs.