Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Show HN: Octelium – FOSS Alternative to Teleport, Cloudflare, Tailscale, Ngrok

github.com

Post reply on HN
Print view View original

151–157 of 157 posts

Re: Show HN: Octelium – FOSS Alternative to Teleport, Cloudflare, Tailscale, Ngrok

#151

Post by atyvr »

metmac wrote: post #110
wkat4242 wrote: post #106

Earlier quoted context omitted.

I work for an enterprise and they don't want this. They still rely on traditional centralised VPNs. How they deal with this is enforcing then everywhere, even in the office. Though there they usually are only on in name. I think the reason is that they want to inspect the traffic in central locations, if each endpoint is doing its own you need to log there which means you can't always access it immediately. I do use…

Depends on the industry. But many large enterprises in the Fortune 500 are actively trying to move away from your traditional VPN. (F5, Pulse, Cisco, etc). Even with VPNs the question should be, what are we gating behind that VPN anyway. Does it actually give us the granularity of controls we want or is this all security theater. (Also what about hybrid infra, between the datacenter and cloud) FWIW, my ideal architec…

Really thoughtful take. That exact gap: bridging identity-aware tunneling (like WireGuard) with protocol-aware proxy decisions is exactly what we set out to solve with Border0.

We pair WireGuard-style tunnels with real-time identity (sso, device, group context) and protocol aware proxies for SSH, RDP, HTTP, psql, Mysql, mssql, ES, and Kubernetes. Our policy engine lets you write rules like “only the DBA group can run DELETEs in Prod” or “Support can exec into this pod,” and we log every query, command, or request, all tied back to the user and device.

Think of it as combining the modern VPN experience of Tailscale with the deep authZ and observability of Teleport. I call it VPN plus PAM. Would love your thoughts if you give it a look.

Quick 2-minute overview: https://www.youtube.com/watch?v=hU7QixSqnSM&t=3s

https://www.border0.com/

Re: Show HN: Octelium – FOSS Alternative to Teleport, Cloudflare, Tailscale, Ngrok

#152

Post by wkat4242 »

metmac wrote: post #110
wkat4242 wrote: post #106

Earlier quoted context omitted.

I work for an enterprise and they don't want this. They still rely on traditional centralised VPNs. How they deal with this is enforcing then everywhere, even in the office. Though there they usually are only on in name. I think the reason is that they want to inspect the traffic in central locations, if each endpoint is doing its own you need to log there which means you can't always access it immediately. I do use…

Depends on the industry. But many large enterprises in the Fortune 500 are actively trying to move away from your traditional VPN. (F5, Pulse, Cisco, etc). Even with VPNs the question should be, what are we gating behind that VPN anyway. Does it actually give us the granularity of controls we want or is this all security theater. (Also what about hybrid infra, between the datacenter and cloud) FWIW, my ideal architec…

Oh yes I agree it's all theater. But we are a very big enterprise (though not big tech) but we're a very traditional company unfortunately.

We're also still working to go "on cloud" as our CIO wants. Because they want to be hip too.

Which in our case means lifting up an image of every server in our datacenter and moving it to a compute box on AWS that runs 24/7. This is not "cloud". It's just paying much more for someone else's server. There is no dynamic scaling or consumption-based billing. It's just setting money on fire so we can tick a box.

Of course we're also "on modern management" yet rely extremely heavily on SCCM policies. Always the same story here.

Re: Show HN: Octelium – FOSS Alternative to Teleport, Cloudflare, Tailscale, Ngrok

#154

Post by therealpygon »

geoctl wrote: post #129
illiac786 wrote: post #128

Earlier quoted context omitted.

Don’t let these comments get to you. If they don’t trust you, it’s their right, but then they should just not use the software, instead of writing this type of caustic comments. Poor form in my view. Keep up, it looks amazing!!

If anything I am actually thankful to HN for the opportunity letting me show my work here. Negative comments are not really that big of an issue for me. I just wish they were generally clearer and more specific so that I can easily fix whatever needs to be fixed. Most of the complaints were simply related to the README while I was expecting and honestly hoping for critique for the architecture and internals of Octeli…

That is sort of the point of what you are considering “negative” comments. For clarity, my comment was advice on how you can improve the public persona of your project.

You seem to have pointed out but equally not registered that you identified exactly the issue: if your readme is filled with red flags, no one is going to invest their time (which is what you are asking for) looking at your code or trying it.

I completely understand as a developer how the “marketing” (readme) of a project may not seem that important or that it should be super accurate, and that it can be easy to fall into the pattern (as can be seen) of looking at every comment that brings voice to criticisms as being “negative”. You’re simply too close to the problem and are therefore only seeing the trees for the forest, while everyone is trying to tell you that you should probably remove the giant fence in front of the trees.

Re: Show HN: Octelium – FOSS Alternative to Teleport, Cloudflare, Tailscale, Ngrok

#155

Post by geoctl »

therealpygon wrote: post #154
geoctl wrote: post #129

Earlier quoted context omitted.

If anything I am actually thankful to HN for the opportunity letting me show my work here. Negative comments are not really that big of an issue for me. I just wish they were generally clearer and more specific so that I can easily fix whatever needs to be fixed. Most of the complaints were simply related to the README while I was expecting and honestly hoping for critique for the architecture and internals of Octeli…

That is sort of the point of what you are considering “negative” comments. For clarity, my comment was advice on how you can improve the public persona of your project. You seem to have pointed out but equally not registered that you identified exactly the issue: if your readme is filled with red flags, no one is going to invest their time (which is what you are asking for) looking at your code or trying it. I comple…

Thank you again. I meant by "negative" that they are critical as opposed to insulting. As I mentioned before in this thread, I usually don't find negative/critical comments offensive at all. Believe me, the last thing that I would want for an open source project that I have been working on for years now is to show it to people, especially technical people, with poor wording or hard-to-understand terms. That was never intentional by me. In fact, the reason that README is too long is that I wanted to explain all the features and use cases in detail while add additional links to the docs for those who want to understand more which probably made it even more overwhelming for those unfamiliar with zero trust architectures. I will definitely do my best to improve the README and docs with time as I get more honest feedback like in this thread. Thank you.

Re: Show HN: Octelium – FOSS Alternative to Teleport, Cloudflare, Tailscale, Ngrok

#156

Post by pydry »

geoctl wrote: post #50
pydry wrote: post #45

Earlier quoted context omitted.

This is similar to the current set up I have with tailscale, but it's not ideal, hence why i asked.

Can I ask you what an ideal setup for your use case would look like? Octelium isn't really concerned with connecting complete remote subnets to each other directly. You can simply use a SOCKS5 proxy as an Octelium Service and do all the access control, dynamic routing and load balancing to that Service representing a specific "VPN".

Basically what tailscale offers with headscale but with more sophisticated control over exit traffic, like:

1) the ability to define an arbitrary wireguard configuration as an exit node (tailscale can do this in theory, but it only works with mullvad and it doesnt work with headscale).

2) the ability to write sophisticated exit traffic rules (e.g. intranet.myemployer.com requests get routed via one home server running my company's proprietary VPN, mybank.com gets routed via another home exit node, default traffic through mullvad, etc.)

Re: Show HN: Octelium – FOSS Alternative to Teleport, Cloudflare, Tailscale, Ngrok

#157

Post by geoctl »

pydry wrote: post #156
geoctl wrote: post #50

Earlier quoted context omitted.

Can I ask you what an ideal setup for your use case would look like? Octelium isn't really concerned with connecting complete remote subnets to each other directly. You can simply use a SOCKS5 proxy as an Octelium Service and do all the access control, dynamic routing and load balancing to that Service representing a specific "VPN".

Basically what tailscale offers with headscale but with more sophisticated control over exit traffic, like: 1) the ability to define an arbitrary wireguard configuration as an exit node (tailscale can do this in theory, but it only works with mullvad and it doesnt work with headscale). 2) the ability to write sophisticated exit traffic rules (e.g. intranet.myemployer.com requests get routed via one home server runnin…

As for (1) zero trust architectures don't really expose complete subnets to users, they only expose individual resources and enforce access control at each of these resources individually. As for (2) As I said above, this can actually be done with Octelium if your VPNs are able to run as SOCKS5 proxies. You can create as many Services, each representing a separate VPN/exit node SOCKS5 proxy, and then use Octelium's stable private DNS to connect to the different SOCKS5 proxies/Services depending on your domain-based rules.
Post reply on HN