31–40 of 70 posts
Another similar project to Tailscale, for those in the market: https://github.com/slackhq/nebula Crazy simple, fully open source, trivial to self-host. Maybe not as featureful as Tailscale, but imo that can be a feature unto itself.
so this whole zerocorp/zerotier/encrypted-mesh networking approach is pretty cool, but every time i see it i ask myself: how do you monitor for malicious nodes? in old setups, typically there would be some sort of passive monitoring system that would monitor the traffic between hosts and could be used for forensics/malicious traffic identification. but if you're encrypting traffic at each node for each other node, th…
Earlier quoted context omitted.
Yes, but that version works only with the tailscale.com server, not a custom one.
Actually the version that's in the App Store does support alternate control servers. It just needs to be configured via MDM configuration ( https://support.apple.com/guide/mdm/mdm-overview-mdmbf9e668/... ). That's how our larger on-prem customers use the iOS client when they run their own in-house control plane server.
so this whole zerocorp/zerotier/encrypted-mesh networking approach is pretty cool, but every time i see it i ask myself: how do you monitor for malicious nodes? in old setups, typically there would be some sort of passive monitoring system that would monitor the traffic between hosts and could be used for forensics/malicious traffic identification. but if you're encrypting traffic at each node for each other node, th…
Some discussion in the Tailscale docs here: https://tailscale.com/kb/1011/log-mesh-traffic/
cool. netflow for encrypted mesh networking. still vulnerable if both nodes are compromised via a sidechannel and collude on their logs, but that's also getting pretty radical in terms of an attack vector.
what about actually logging the contents? i've seen big commercial systems that look pretty much like distributed wireshark, with capture points, storage systems and pretty guis for inspection... not sure how prevalent and useful they are, but having a step deeper than netflow style logs can be useful, both for debugging and security purposes. i suppose you could do this double entry for that as well, but that seems a pretty high cost if the tunnels are high bandwidth?
Another similar project to Tailscale, for those in the market: https://github.com/slackhq/nebula Crazy simple, fully open source, trivial to self-host. Maybe not as featureful as Tailscale, but imo that can be a feature unto itself.
Certificate management is its one weakness at the moment. There are a growing number of projects floating around attempting to solve that though:
- https://github.com/unreality/nebula-mesh-admin
- https://github.com/b177y/starship
- https://github.com/symkat/MeshMage
Plus im sure defined networks has their own solution in the works as well.
Another similar project to Tailscale, for those in the market: https://github.com/slackhq/nebula Crazy simple, fully open source, trivial to self-host. Maybe not as featureful as Tailscale, but imo that can be a feature unto itself.
Earlier quoted context omitted.
Yes, but that version works only with the tailscale.com server, not a custom one.
Actually the version that's in the App Store does support alternate control servers. It just needs to be configured via MDM configuration ( https://support.apple.com/guide/mdm/mdm-overview-mdmbf9e668/... ). That's how our larger on-prem customers use the iOS client when they run their own in-house control plane server.
Another similar project to Tailscale, for those in the market: https://github.com/slackhq/nebula Crazy simple, fully open source, trivial to self-host. Maybe not as featureful as Tailscale, but imo that can be a feature unto itself.
Related, here's a surprisingly balanced comparison of Nebula and Tailscale, on tailscale.com: https://tailscale.com/kb/1148/tailscale-vs-nebula/ . > If you’re a system administrator or technical person looking for a completely open source, free peer-to-peer mesh VPN, and you’re willing to run a certificate authority and the control plane yourself, try out Nebula. > If you’re looking for a polished, user-friendly peer…
The threat model is someone adding peers to the control plane, including as a result of control plane takeover or the identity provider failing. These special nodes can’t then be made to talk to anybody they can’t authenticate, no matter what you do on the control plane. It assumes private keys are safe. Obviously this is a client side setting, which shouldn’t have any control plane API, just like the current Tailscale options to eg accept no incoming traffic. This comes from my experience with ZeroTier, which I wrote about here: https://news.ycombinator.com/item?id=28426664
Then you can run your own Wireguard key distribution if you like, but ideally you just distribute manually for a few nodes and leave it at that.
While this is great, of course, it's definitely not feature parity with Tailscale, which currently allows me to have nothing listening on the opening internet and still form a private network spanning hosts all over the world, share resources within that network with 3rd parties trivially and send files across my network, android/iOS apps, etc. I still posit the alternative to Tailscale is simply just wireguard. I do…
Earlier quoted context omitted.
Related, here's a surprisingly balanced comparison of Nebula and Tailscale, on tailscale.com: https://tailscale.com/kb/1148/tailscale-vs-nebula/ . > If you’re a system administrator or technical person looking for a completely open source, free peer-to-peer mesh VPN, and you’re willing to run a certificate authority and the control plane yourself, try out Nebula. > If you’re looking for a polished, user-friendly peer…
Hm — there’s a middle ground here that’s missing. I’d like to see a managed mesh allow for disabling its key distribution for certain nodes. They don’t create wireguard peers for any but a predefined shortlist of public keys, but still accept route updates from those peers. The threat model is someone adding peers to the control plane, including as a result of control plane takeover or the identity provider failing.…