That, plus fanatically good NAT Traversal: https://tailscale.com/blog/how-nat-traversal-works/
A bit offtopic, but how did they create the visualizations? Do they have a designer on their team for that or is there any good tool that creates charts like these?
But isn't that just part of Wireguard itself? In the end that's what's happening in my case when I exchange data through Wireguard between my flat and the one of my parents... .
No, wireguard is just the VPN itself. The NAT traversal stuff is all magic that happens before the socket is given to wireguard.
Very good to know! I did learn this and used 10 year certs/ca when my originals expired... as will presumably most of the other people who didn't fully grok the implications of the defaults :)
We need to do a better job of this and I'm really sorry you had a not-great experience with expiration. Totally agree with your take.
I hope I don't come across as too negative! Sure I'd love to see some improvements here, and they would help adoption amongst hobbyists / home users, but I totally understand focusing on the features needed to make the business work first.
The existing open source functionality for the overlay network itself is (for me) what's really exciting, and it's all there. The management limitations just keep me from evangelizing more broadly (outside of places like HN).
First - congratulations! I like the idea behind your product. Easily configured VPN tunnels are something I enjoy having. But, and I'm probably just shouting into the void at this point, relying upon your network being secured as a method of securing your office/product will only result in heartache. If you're a company SEO or similar trying to protect your company from threats, your first assumption must be "the net…
You may want to take a second look at Tailscale - it can be used as a classic VPN ("exit node"), but it really wants to broker host-to-host connectivity secured by ACLs and SSO.
First - congratulations! I like the idea behind your product. Easily configured VPN tunnels are something I enjoy having. But, and I'm probably just shouting into the void at this point, relying upon your network being secured as a method of securing your office/product will only result in heartache. If you're a company SEO or similar trying to protect your company from threats, your first assumption must be "the net…
You may want to take a second look at Tailscale - it can be used as a classic VPN ("exit node"), but it really wants to broker host-to-host connectivity secured by ACLs and SSO.
Respectfully, this doesn't change the advice. Always assume the network is compromised - that someone who shouldn't has access your hosts via the network. A user's device is taken, a new user is added via social engineering, a computer is left unlocked, a host is compromised...
Tailscale has a fantastic product, I’ve been extremely happy from day one. If you’re waiting for a weekend to have a few hours to try out Tailscale, don’t, it takes 15 minutes to get every device you own up and running and talking. This is the lowest friction personal VPN to ever exist, and once you see how easy it is for your own devices, you’ll wish you had it at work. The biggest risk that this company has is that…
Isn’t it only possible to host things on your phone if you can have a listener that binds to a socket/port? I don’t think mobile apis allow for this. Am I wrong?
I think so, it’s not something I’m too familiar with, but I found apps for both iOS and Android that let you host a web server that can be accessed from another computer on your LAN.
For anyone else who wonders wtf tailscale is: > Tailscale is a VPN service that makes the devices and applications you own accessible anywhere in the world, securely and effortlessly. It enables encrypted point-to-point connections using the open source WireGuard protocol, which means only devices on your private network can communicate with each other. It seems to take care of key distribution, nat-traversal, authen…
I thought that Tailscale was pretty interesting. Avery Pennarun, its CTO, is somebody whose judgment I am used to trusting. Then I learned that to use it, I would be dependent on authenticating using a login on one of the unaccountable internet behemoths who could take away my account for any random reason or no expressed reason at all. No, thank you.
If you're that concerned with 3rd party auth, I'm surprised you're not more concerned about trusting your virtual network to a SaaS platform (who could definitely decrypt the traffic). For those more privacy minded, they'd probably wanna go with one of the self-hosted alternatives, of which there are now a few.
> I’ve been dreaming lately of a tor-like network that’s based loosely on the idea of tailnets. Rather than blockchain bullshit, you’d have a direct ring of trust with friends, and then you could set up access policies to forward packets for people you don’t trust, but who know someone you do trust. Might want to check out Yggdrasil. It lets you can create a real mesh routed, E2E encrypted network. You can keep your…
Thanks, I thought I knew all the major mesh VPN options (tinc, nebula, tailscale, zero tier, hamachi) and yet I never heard of yggdrasil. This is the kind of comment I love HN for!
Hey! Netmaker author here. I think it’d be a cool option for this use case. We have some users already doing blockchain stuff. Benefits are it’s self hosted, so you don’t need to depend on a SaaS, no mandatory 3rd party auth, and a lot faster because of kernel WireGuard.
Thanks, I thought I knew all the major mesh VPN options (tinc, nebula, tailscale, zero tier, hamachi) and yet I never heard of yggdrasil. This is the kind of comment I love HN for!
Here is another (sort of), OpenZiti - https://openziti.github.io/ . OpenZiti provides a mesh overlay network built on zero trust priinciples with outbound only connections so that we do not need inbound ports or link listeners. Similar to TS, you can host anything anywhere and has options to deploy on any popular host OS or as a virtual appliance. What makes it realluy unique though is that it can actually be embedde…
All the solutions I mentioned are outbound only (for the clients), though they do all have a central point which is open for inbound connections so they can find each other. Or in some cases their own cloud serves this purpose. They call them lighthouses, Moons, etc but the principle is the same.
The embedding inside an app sounds like a really cool discerning feature though. I'll have a look!
Isn’t it only possible to host things on your phone if you can have a listener that binds to a socket/port? I don’t think mobile apis allow for this. Am I wrong?
I think so, it’s not something I’m too familiar with, but I found apps for both iOS and Android that let you host a web server that can be accessed from another computer on your LAN.
Do those apps need to be in the foreground? It kind of defeats the purpose if so