Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Tailscale Peer Relays

tailscale.com

Post reply on HN
Print view View original

71–80 of 118 posts

Re: Tailscale Peer Relays

#71

Post by sneak »

HowardStark wrote: post #28
int0x29 wrote: post #16

Earlier quoted context omitted.

Wireguard can't punch through NATs or firewalls without third party software like Tailscale. Also I'm pretty sure each peer to peer connection needs to be individually set up in a config file ahead of time

Nebula[0] addresses this and is IMO an improvement over WireGuard. Came out of Slack originally, and it supports peer discovery, NAT hole punching, and some other cool features. Also still uses the Noise Protocol. In practice, the extra networking features + better first class peer config management baked in is very nice (Nebula’s “lighthouses” are configured with a tool similar to DSNet for Wireguard[1]) [0] https:/…

I use Nebula but the relay config is somewhat clunky and the macOS port is pretty buggy.

Re: Tailscale Peer Relays

#72

Post by sneak »

qwertox wrote: post #37
int0x29 wrote: post #16

Earlier quoted context omitted.

Wireguard can't punch through NATs or firewalls without third party software like Tailscale. Also I'm pretty sure each peer to peer connection needs to be individually set up in a config file ahead of time

A $2.5/month vps solves this issue.

It does not. I push hundreds of TB across my private mesh.

Re: Tailscale Peer Relays

#73

Post by bigstrat2003 »

ssl-3 wrote: post #62
bigstrat2003 wrote: post #59

Earlier quoted context omitted.

Yeah, Tailscale is really cool. The only thing I wish is that they didn't tie auth to either a big tech monopoly (Google, github etc) or running your own IDP service. I would love to use Tailscale for some self hosted stuff I have, but hesitate to start exposing something like an identity management tool because that's a high value target. And of course, I don't really want to let Google et al be in control of my VPN…

That's a valid concern. I've also used ZeroTier with good success. They're a competitor that offers VPN with similar idealized P2P topology. Unlike Tailscale, ZT is not based on wireguard (ZT predates wireguard), but they do offer the option to use their own local auth without reliance/potential issues with yet-another party. ZT also allows a person to create and use their own relay (called a "moon"), if that's somet…

Thanks for the tip! I'll check that out and see if it would work for my VPN needs, but it certainly sounds promising.

Re: Tailscale Peer Relays

#74

Post by mintflow »

moontear wrote: post #52
MarleTangible wrote: post #42

Earlier quoted context omitted.

> It allows customers to make just one firewall exception for connections only coming from their tailnet. You'll need to open a single UDP port on your firewall, so it's your public facing IP address. You don't need an entire VM somewhere, just a single port. Regarding the speed question. You'd use the derp when it's not possible to make a peer to peer connection, which limits your speed to derp server's speed and lo…

> for connections coming from their tailnet So instead of whitelisting all ports from IP range 100.64.0.0/10 I would just whitelist e.g. UDP port 12345 coming from IP range 100.64.0.0/10 to my public IP? Or just open up UDP 12345 completely?

I think you need open UDP 12345 to public internet, where the Tailscale Disco protocol runs on that, which is the underlay port.

Re: Tailscale Peer Relays

#75

Post by bschwindHN »

conradev wrote: post #50
int0x29 wrote: post #16

Earlier quoted context omitted.

Wireguard can't punch through NATs or firewalls without third party software like Tailscale. Also I'm pretty sure each peer to peer connection needs to be individually set up in a config file ahead of time

Folks have solved these problems and open sourced solutions: https://github.com/tonarino/innernet But all that I've seen are still centralized/federated

(I help maintain innernet)

We have _some_ NAT traversal logic in place, but it's very basic. Tailscale does a much more thorough job on it. It would be cool to add peer relays to innernet but I imagine it's a fair amount of work.

From what I recall, tailscale has their own Wireguard implementation so they have more control over the socket and how things are routed. innernet is just a wrapper around managing wireguard peer lists, and yeah there's a central coordination server which is unfortunate. If the server goes down, you can still connect to peers so thankfully it doesn't bring down your whole network, but you won't be able to learn about new peers or peer endpoints over time until you re-establish connectivity with the coordination server.

Re: Tailscale Peer Relays

#76

Post by vachina »

jsmeaton wrote: post #60
smashed wrote: post #29

Earlier quoted context omitted.

They are an alternative to the tailscale operated DERP servers, which are cloud relays. Even with the much touted NAT punching capabilities of tailscale, there are numerous instances where tailscale cannot establish a true p2p connection. The last fallback is the quite slow DERP relay and from experience it gets used very often. If you have a peer in your tailscale network that has a good connection and that maybe yo…

Is there a way to determine if a particular connection is falling back to DERP today? I have a pretty basic setup with tailscale setup on an Apple TV behind a bunch of UniFi devices and occasionally tunnelled traffic is incredibly slow. Wondering if it’s worth setting this up on my Plex server which is behind fewer devices and has a lot of unused network and cpu.

tailscale ping

It will tell you how each ping has been answered until a direct connection is established.

Re: Tailscale Peer Relays

#77

Post by 1vuio0pswjnm7 »

qwertox wrote: post #37
int0x29 wrote: post #16

Earlier quoted context omitted.

Wireguard can't punch through NATs or firewalls without third party software like Tailscale. Also I'm pretty sure each peer to peer connection needs to be individually set up in a config file ahead of time

A $2.5/month vps solves this issue.

Yes. Only use it as rendezvous server for publishing port numbers and establishing direct connections. Do not use for passing traffic

Re: Tailscale Peer Relays

#78

Post by elcritch »

> We believe our new Tailscale Peer Relays connectivity option—unique to Tailscale—gives customers the best performance and flexibility.

Seems pretty similar to some of the stuff ZeroTier was doing years ago. Hard to claim it's unique to Tailscale. Charging for it above and beyond the per user costs seems overboard as well.

Re: Tailscale Peer Relays

#79

Post by esseph »

ilmblover2 wrote: post #30
cpressland wrote: post #3

I was literally looking for a solution for this over the weekend and ended up with a very quirky setup for my Kubernetes Operator. Now I can rip all that out and use this! Bravo!

Man K8s is my nightmare haha. 100% agree

K8s is a hell of a platform but it is a ... hell of a platform.

Re: Tailscale Peer Relays

#80

Post by greenavocado »

HowardStark wrote: post #28
int0x29 wrote: post #16

Earlier quoted context omitted.

Wireguard can't punch through NATs or firewalls without third party software like Tailscale. Also I'm pretty sure each peer to peer connection needs to be individually set up in a config file ahead of time

Nebula[0] addresses this and is IMO an improvement over WireGuard. Came out of Slack originally, and it supports peer discovery, NAT hole punching, and some other cool features. Also still uses the Noise Protocol. In practice, the extra networking features + better first class peer config management baked in is very nice (Nebula’s “lighthouses” are configured with a tool similar to DSNet for Wireguard[1]) [0] https:/…

What's the story with removing uncooperative endpoints from Nebula?
Post reply on HN