Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

NetMaker: Connect Everything with a WireGuard VPN

netmaker.io

Post reply on HN
Print view View original

121–130 of 172 posts

Re: NetMaker: Connect Everything with a WireGuard VPN

#121

Post by icedchai »

LeBit wrote: post #93
barrotes wrote: post #68

Maybe a dumb question, but what are the advantages of such products compared to just configuring a "plain" wireguard server i.e. on OpenBSD? I'm not a network expert and still it was pretty simple. Do these products offer more features? What kind of features?

Try to build a mesh with wireguard. You will soon find you have a combinatorial problem. If you have 10 nodes and want to add an 11th node, you will have to update the 10 already existing nodes. These projects are automating the configuration of the nodes. You simply configure a new node and the other nodes are informed of the presence of the new guy.

I’ve built a 3 node wireguard mesh network, by hand, and it did get tedious!

Re: NetMaker: Connect Everything with a WireGuard VPN

#123

Post by afeiszli »

rcme wrote: post #86
ignoramous wrote: post #70

Earlier quoted context omitted.

> Docs are written for self-hosters. These are all good signs. Except at the time of writing, netmaker isn't FOSS: https://github.com/gravitl/netmaker/blob/16d5b5807/LICENSE.t...

Why isn’t SSPL considered FOSS but AGPL is?

SSPL is a bit more restrictive, but politics also have a lot to do with it. "Open Source" is just a term, technically anyone could call their license open source, but most people only consider a license open source if the OSI (a foundation) specifically approves it. Mongo tried and failed to get SSPL approved by OSI: https://blog.tidelift.com/what-i-learned-from-the-server-sid...

Re: NetMaker: Connect Everything with a WireGuard VPN

#124

Post by afeiszli »

aborsy wrote: post #62
minimalist wrote: post #7

Related, from earlier this year: https://news.ycombinator.com/item?id=35584533 Wherein the author compares Yggdrasil, tinc, Tailscale, Zerotier, Netmaker, Nebula, and ends up prefering Yggdrasil. Actually, it was this comparison that made me look into Netmaker and prefer it and I've been running it without issue for experimentation. I hope the author revisits NM. I agree that the project is moving quickly, which resu…

The use of relays is common when you connect to the VPN in the enterprise networks that often allow only outgoing 80/443. Also, you may not use the relays all the time, but you may use them sometimes throughout the day. If there is a vulnerability, one connection may be enough to compromise the security.

Netmaker also has a relay setup, when you don't want to do P2P: https://www.netmaker.io/features/relay

Re: NetMaker: Connect Everything with a WireGuard VPN

#125

Post by afeiszli »

jeroenhd wrote: post #2

The feature list reminded me of Tailscale so I went looking and found this on their website: https://www.netmaker.io/resources/tailscale-vs-zerotier Their comparison graph at the bottom seems to indicate that the differentiating features between their product and Tailscale is that you can't self-host (ignoring the existence of headscale) and that WireGuard support is limited. I believe the latter point refers to the…

I think it's worth doing your own investigation on how often traffic is getting relayed via Tailscale. We don't have numbers on it, but have had users who experienced very high latency with Tailscale, and after doing some traffic analysis, discovered it was getting relayed halfway across the country. Tailscale does a fantastic job at NAT traversal, but it's still a worthwhile consideration.

Re: NetMaker: Connect Everything with a WireGuard VPN

#126

Post by ignoramous »

afeiszli wrote: post #103
ignoramous wrote: post #70

Earlier quoted context omitted.

> Docs are written for self-hosters. These are all good signs. Except at the time of writing, netmaker isn't FOSS: https://github.com/gravitl/netmaker/blob/16d5b5807/LICENSE.t...

Hi! Netmaker here. At the time of this writing this is true, but we're making some licensing changes this sprint, which I think will make people very happy. We started with SSPL just because it's much easier to go from more restrictive to less restrictive, as opposed to the alternative. However, several months ago we moved all of the client-side code to Apache-2.0, and are about to make the server-side code FOSS-comp…

IANAL. I'm afraid you have it the other way around. It is easier to switch from permissive licenses (MIT / 3BSD) to compatible restrictive license (MPL / xGPL) than vice versa (xGPL to MPL / MIT) without a CLA.

Glad you're going Apache, though.

Re: NetMaker: Connect Everything with a WireGuard VPN

#127

Post by rcme »

afeiszli wrote: post #123
rcme wrote: post #86

Earlier quoted context omitted.

Why isn’t SSPL considered FOSS but AGPL is?

SSPL is a bit more restrictive, but politics also have a lot to do with it. "Open Source" is just a term, technically anyone could call their license open source, but most people only consider a license open source if the OSI (a foundation) specifically approves it. Mongo tried and failed to get SSPL approved by OSI: https://blog.tidelift.com/what-i-learned-from-the-server-sid...

Interesting. According to the article, it seems like the biggest complaint was that Mongo was a for-profit company and couldn’t be trusted? I agree that for-profit companies can’t be trusted, but I’m not sure I agree with the statement “that’s not open source because the license was written by a for-profit company”.

Re: NetMaker: Connect Everything with a WireGuard VPN

#128

Post by lost_tourist »

xena wrote: post #88
barrotes wrote: post #68

Maybe a dumb question, but what are the advantages of such products compared to just configuring a "plain" wireguard server i.e. on OpenBSD? I'm not a network expert and still it was pretty simple. Do these products offer more features? What kind of features?

tl;dr: you don't have to configure wireguard yourself and it can help you meet acronym compliance

this would be the big one for me. I'd be more likely to trust their configuration (security wise) than my own.

Re: NetMaker: Connect Everything with a WireGuard VPN

#129

Post by gsliepen »

yardstick wrote: post #25
jasonjayr wrote: post #16

Earlier quoted context omitted.

Dormant, or stable? I've been running a tinc mesh network for eons w/ my systems and it's never given me any trouble. I use git to check in the 'hosts/' folder and add/remove hosts as needed, pull down to all the nodes, and they can all connect. I do wish the encryption + transport could be as performant as wireguard, but for my needs, I haven't been pushing it hard enough that it's a concern for me.

I somewhat agree with you. I went with Dormant as 1.1 has been in development for years and no official stable release. Changes to 1.1 are the odd PR here and there, nothing really from the main author anymore. Yeah things like improving the encryption I would expect even with a stable but active product like this. Especially given ChaCha20’s widespread adoption and optimisation these days. Likewise I would have like…

It's not so much the other VPN products out there, rather no time and no other core developers. There have been lots of people contributing, some much more than others, but usually it was just to scratch their itch, after which they move on (which is perfectly fine).

I'm not sure how to revitalize development if there is not a large interest from developers, and I don't want to turn this into something commercial like OpenVPN did.

Re: NetMaker: Connect Everything with a WireGuard VPN

#130

Post by afeiszli »

ignoramous wrote: post #126
afeiszli wrote: post #103

Earlier quoted context omitted.

Hi! Netmaker here. At the time of this writing this is true, but we're making some licensing changes this sprint, which I think will make people very happy. We started with SSPL just because it's much easier to go from more restrictive to less restrictive, as opposed to the alternative. However, several months ago we moved all of the client-side code to Apache-2.0, and are about to make the server-side code FOSS-comp…

IANAL. I'm afraid you have it the other way around. It is easier to switch from permissive licenses (MIT / 3BSD) to compatible restrictive license (MPL / xGPL) than vice versa (xGPL to MPL / MIT) without a CLA. Glad you're going Apache, though.

We do have a CLA, and put it in place for this very reason. It is more complex legally, but I meant more in terms of the community. Better to make people happy by going less restrictive over time then to start out with Apache and switch to something more restrictive and upset a bunch of people.
Post reply on HN