Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

NetMaker: Connect Everything with a WireGuard VPN

netmaker.io

Post reply on HN
Print view View original

161–170 of 172 posts

Re: NetMaker: Connect Everything with a WireGuard VPN

#161

Post by GhostWhisperer »

OfferFun6595 wrote: post #144

Netmaker is legit and backed by Y Combinator. It's based on Wireguard (like Tailscale) and is focused primarily around Kubernetes use. In my opinion, it is a better solution than any other zero trust networking solution due to it offering built in ACLs and traditional Wireguard/VPN features as well as the P2P encrypted mesh overlay. You may find it easier to work with zerotier or tailscale, but NetMaker is something…

yea, tailscale is pretty cool

any idea how one would go about connecting two networks? a tailnet and a netmaker-net?

Re: NetMaker: Connect Everything with a WireGuard VPN

#162

Post by Bluecobra »

chinathrow wrote: post #156
Bluecobra wrote: post #83

Earlier quoted context omitted.

This should be a simple problem to solve without an additional VPN. On the Mac, you should be able to add a static route for the VPN destination and point it to the IP if the Windows box. This is assuming that Windows firewall isn’t blocking the incoming connection from your Mac.

I will try that, but I have not much hope - why would Windows act as a router directly?

Good point, you might need to enable IP forwarding in the registry :

https://www.wikihow.com/Enable-IP-Routing-on-Windows-10

Re: NetMaker: Connect Everything with a WireGuard VPN

#163

Post by SparkyMcUnicorn »

SOLAR_FIELDS wrote: post #106
ignoramous wrote: post #71

Earlier quoted context omitted.

> - speed: netmaker is faster because it uses kernel wg - this is not going to hold true for all system configurations, certainly doesn't for macos Unless something changed super recently, tailscale (per their own claims) are faster than (linux) kernel wg: https://tailscale.com/blog/throughput-improvements/ Surprisingly, we improved the performance of wireguard-go (running in userspace) enough to make it faster than…

Huh, would be interesting to see some non-tailscale benchmarks of this. Assuming the kernel impl is actually optimized it should be theoretically impossible to exceed the performance with userland wg?

I ran the same benchmarks they listed here[0], and did some practical tests. As of a week after the article being written, Tailscale was faster than kernel wireguard.

[0] https://tailscale.com/blog/more-throughput/

Re: NetMaker: Connect Everything with a WireGuard VPN

#164

Post by dang »

Dalewyn wrote: post #30
GhostWhisperer wrote: post #27

Earlier quoted context omitted.

your not the first to complain about it[0], the tone is uncalled for - you can just cmd + w that tab and move on + use it as a signal when picking your service provider [0] https://news.ycombinator.com/item?id=37143046

I can close the tab easily enough, yes. If I was a prospective customer though, he just lost a potential sale. Also, flagging? I'm not surprised, of course; this place is as left as it gets.

Your post was correctly flagged because it broke several of the site guidelines, which include:

"Please don't complain about tangential annoyances—e.g. article or website formats, name collisions, or back-button breakage. They're too common to be interesting."

and

"Please don't fulminate."

https://news.ycombinator.com/newsguidelines.html

Re: NetMaker: Connect Everything with a WireGuard VPN

#165

Post by irjustin »

SOLAR_FIELDS wrote: post #114
irjustin wrote: post #22

I've been using Netmaker for a few months now and it is incredible. Bastion VPN management for all our enviornments. The only thing we havne't gotten to work is full 0.0.0.0 forwarding. Docs say it's possible (tho not fully common use case), but we always get hangs when attempting. Usually we have to use sshuttle Other than that - incredible.

Curious what other people’s setups are with the server hosting. Do you expose Netmaker bastion to the public Internet for all your VPC, where the bastion lives outside the VPC? That’s what they recommended to me when I set mine up but I also explored putting my bastion inside my VPC and exposing it to the internet

Sorry about the late reply.

> Do you expose Netmaker bastion to the public Internet for all your VPC

Yes

> , where the bastion lives outside the VPC?

No, but I imagine you're talking about Subnets? which in that case Yes.

We run multiple Subnets. Only bastion machines live in public subnets while pretty much everything else is in private ones that routes via NATs.

Re: NetMaker: Connect Everything with a WireGuard VPN

#166

Post by irjustin »

afeiszli wrote: post #112
irjustin wrote: post #22

I've been using Netmaker for a few months now and it is incredible. Bastion VPN management for all our enviornments. The only thing we havne't gotten to work is full 0.0.0.0 forwarding. Docs say it's possible (tho not fully common use case), but we always get hangs when attempting. Usually we have to use sshuttle Other than that - incredible.

Thanks for the feedback. Just wondering, with 0.0.0.0, are you accessing using "external clients" or the regular netclient?

Love the product! Sorry for the late reply.

> are you accessing using "external clients" or the regular netclient?

"External Clients" on OSX Wireguard.

[More Info]

The use case that we have is when we need access an Akami Network through a whitelisted IP during development.

Our AWS networks have a Priv Subnet w/ a static IP NAT and a Public Subnet, both prod and staging.

Since wanted our all our local machine's traffic to go through the AWS NAT we hoped for: Local -> Bastion EC2 (Public Subnet) -> EC2 (Private Subnet) -> NAT -> Internet.

So to get setup, we tested: Local -> Bastion EC2 (Public Subnet) -> Internet. When we set the Bastion EC2 to have Egress of 0.0.0.0 the Wireguard's Handshake would never complete, just hang.

Let me know if there's anything else I can provide.

Re: NetMaker: Connect Everything with a WireGuard VPN

#167

Post by tzs »

papercrane wrote: post #131
rcme wrote: post #127

Earlier quoted context omitted.

Interesting. According to the article, it seems like the biggest complaint was that Mongo was a for-profit company and couldn’t be trusted? I agree that for-profit companies can’t be trusted, but I’m not sure I agree with the statement “that’s not open source because the license was written by a for-profit company”.

That article is obfuscating why the license was going to be rejected by the OSI. The OSI has as part of their definition of open-source that there can be no field of use discriminators. It had nothing to do with the fact that it was drafted by a commercial company. OSI has approved plenty of licenses drafted by for-profit companies (e.g. Intel, IBM, Microsoft.) https://blog.opensource.org/the-sspl-is-not-an-open-sour…

How come AGPL doesn't run afoul of #10 of the OSD definition, which is:

> 10. License Must Be Technology-Neutral

> No provision of the license may be predicated on any individual technology or style of interface.

Under AGPLv3 if I have AGPLv3 code on a computer and users can interact with it the requirements depend on the technology used by the users to interact with the program.

It had a provision that only applies to users who are "interacting with the remotely through a computer network".

So...if my users are at the same location as the server and interacting through a command line interface on serial terminals those provisions do not apply.

I want to add a few more terminals in a nearby room but don't want to actually run serial lines from all of them to the server. Instead I run ethernet to the room the new terminals will be in, and at each terminal place an RPi with the terminal connected to the RPi and the RPi connected to ethernet. The RPi runs software that connects to the server via ssh and then exposes that ssh session on the terminal so they can use the command line interface to that AGPL program.

Now the users are interacting with the server via a computer network and so those provisions of AGPL might now apply, depending on whether or not this counts as interacting "remotely".

Same thing but now I provide an app that users can run on their phones that that makes a hard coded connection to my server and runs a terminal emulator over that to a terminal session on the server, where the users can use the AGPL program. There doesn't seem any question that this is now definitely remote, and it is over a computer network, so those AGPL provisions now definitely apply.

And so we have essentially one thing, users using a terminal interface to interact with an AGPL command line program on my server, where what license provisions apply between me and any given user depends on just what technology is used to carry their typed text between their keyboard and my server, and to carry the program output text between my server and their display.

[1] https://en.wikipedia.org/wiki/ADM-3A

Re: NetMaker: Connect Everything with a WireGuard VPN

#168

Post by jbverschoor »

LeBit wrote: post #96
jbverschoor wrote: post #64

Earlier quoted context omitted.

The quality of information is very limited. It's as if the author hasn't used ZeroTier... ZeroTier operates on a different layer, and is therefore capable of much more than anything wireguard.

Like what?

Zerotier isn’t limited to IP, but will happily do other protocols as well. It’s more like a virtual private smart switch

Re: NetMaker: Connect Everything with a WireGuard VPN

#170

Post by farukhkhan21 »

I have used netmaker and their netclients inside my kubernetes cluster to have access to all k8s pods over a secure wireguard tunnel. No need to worry about ssl certificates on my admin dashboards for my longhorn, pihole, portainer, linkerd and other admin dashboards. Also, no need to k8s port forward everytime I wanna access a specific service inside the cluster network. Netmaker and kubernetes for secure and manageable cluster network access is unbeatable I think.
Post reply on HN