Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Tailscale Peer Relays

tailscale.com

Post reply on HN
Print view View original

61–70 of 118 posts

Re: Tailscale Peer Relays

#61

Post by vidarh »

int0x29 wrote: post #16
0x696C6961 wrote: post #11

Earlier quoted context omitted.

Wireguard can do what you're describing.

Wireguard can't punch through NATs or firewalls without third party software like Tailscale. Also I'm pretty sure each peer to peer connection needs to be individually set up in a config file ahead of time

It punches through my NAT just fine without third party software.

It's not as simple to make it reliable as it is with Tailscale, but it works

It doesn't universally work without a helper script and a STUN server, though - you need a suitably "friendly" NAT that has reasonably predictable behaviour with respect to port mapping and/or just one side of each pair behind a NAT.

Re: Tailscale Peer Relays

#62

Post by ssl-3 »

bigstrat2003 wrote: post #59
ssl-3 wrote: post #46

Earlier quoted context omitted.

Tailscale is a few things. It might be fair to say that it is mostly a software platform with a web frontend that allows orgs (and individual users alike) to easily create secure VPNs, so their various systems can have a secure, unfiltered virtual private network on which to communicate with eachother even if they're individually scattered across the four corners of the Internet. The usual (traditional) way to do VPN…

Yeah, Tailscale is really cool. The only thing I wish is that they didn't tie auth to either a big tech monopoly (Google, github etc) or running your own IDP service. I would love to use Tailscale for some self hosted stuff I have, but hesitate to start exposing something like an identity management tool because that's a high value target. And of course, I don't really want to let Google et al be in control of my VPN…

That's a valid concern.

I've also used ZeroTier with good success.

They're a competitor that offers VPN with similar idealized P2P topology. Unlike Tailscale, ZT is not based on wireguard (ZT predates wireguard), but they do offer the option to use their own local auth without reliance/potential issues with yet-another party.

ZT also allows a person to create and use their own relay (called a "moon"), if that's something useful: https://rayriffy.com/garden/zerotier-moon

(For my own little purposes I don't really have a preference between either Zerotier or Tailscale.)

Re: Tailscale Peer Relays

#63

Post by LunaSea »

xeonmc wrote: post #13

I wonder if the next step could be to have all tailscale clients automatically able to accept forwarding requests between any two machines within the tailnet, so that the mesh seamlessly auto-routes around any breaks within the mesh?

Since the latency would be higher due to the additional hops or distance, I wonder if it's not better to make the request crash so that the issue is clearly detected rather than to continue in a degraded but "invisible" state.

Re: Tailscale Peer Relays

#64

Post by raggi »

apitman wrote: post #58

Main downside I see compared to DERP is there's no way for this to work in the browser since it's native UDP. I wonder if it'd be possible to make it work over WebTransport in the future.

(Tailscalar) I'm very bullish on WebTransport in the future, but, it doesn't solve for NAT traversal. I'm watching keenly as well how Iroh gets on with QAD, relatedly.

If it all comes together this may well become more magic :D

Re: Tailscale Peer Relays

#65

Post by ssl-3 »

fukka42 wrote: post #27

> All customers can use two peer relays, for free, forever. As your needs scale, so will the number of available peer relays. To add even more peer relays to your tailnet, come have a chat with us. I have to pay to be able to donate my own infra to make tailscale's service better?

Your peer relays don't make Tailscale's infrastructure better.

They instead make your own infrastructure better.

Running a peer relay donates nothing to anyone.

Re: Tailscale Peer Relays

#66

Post by depr »

You can use Tailscale to connect services together (not just someone's laptop to a service, replacing OpenVPN), but what if Tailscale has an outage? Will my services not be able to find each other anymore?

Re: Tailscale Peer Relays

#67

Post by snailmailman »

depr wrote: post #66

You can use Tailscale to connect services together (not just someone's laptop to a service, replacing OpenVPN), but what if Tailscale has an outage? Will my services not be able to find each other anymore?

The tailscale login servers had an issue last week. My local network had an issue at the same time and all connections dropped. Then none of my stuff could reconnect because I couldnt connect to tailscale :(

Looking into setting up my own headscale instance now. This is the first issue I’ve had with tailscale but seems dumb that my local lan devices couldn’t even talk to each other.

Re: Tailscale Peer Relays

#68

Post by Dylan16807 »

akerl_ wrote: post #57
yardstick wrote: post #54

Earlier quoted context omitted.

Last I checked, tinc supported NAT port punching natively.

As far as I’m aware, that works the same as things like tailscale is doing, where you need at least one node that is publicly reachable to facilitate.

Which is a much smaller requirement than needing extra software on every NATed node.

So yes it is a differentiated thing between wireguard and tinc, as you phrased it in your other comment.

Re: Tailscale Peer Relays

#69

Post by yardstick »

akerl_ wrote: post #57
yardstick wrote: post #54

Earlier quoted context omitted.

Last I checked, tinc supported NAT port punching natively.

As far as I’m aware, that works the same as things like tailscale is doing, where you need at least one node that is publicly reachable to facilitate.

Correct. This is not something Wireguard does, which was the original comparison.

tinc: One public node, thousands of private nodes, with NAT punching. That's fine and typical in my experience.

Re: Tailscale Peer Relays

#70

Post by apitman »

raggi wrote: post #64
apitman wrote: post #58

Main downside I see compared to DERP is there's no way for this to work in the browser since it's native UDP. I wonder if it'd be possible to make it work over WebTransport in the future.

(Tailscalar) I'm very bullish on WebTransport in the future, but, it doesn't solve for NAT traversal. I'm watching keenly as well how Iroh gets on with QAD, relatedly. If it all comes together this may well become more magic :D

But this is specifically for relays, so you shouldn't need NAT traversal right? ie in the browser you already know p2p isn't going to work (unless Tailscale implements WebRTC support) so you just go straight to relays for everything.

I hadn't heard about iroh using QAD. Thanks for that.

Post reply on HN