Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Tailscale Peer Relays

tailscale.com

Post reply on HN
Print view View original

81–90 of 118 posts

Re: Tailscale Peer Relays

#81

Post by fukka42 »

ssl-3 wrote: post #65
fukka42 wrote: post #27

> All customers can use two peer relays, for free, forever. As your needs scale, so will the number of available peer relays. To add even more peer relays to your tailnet, come have a chat with us. I have to pay to be able to donate my own infra to make tailscale's service better?

Your peer relays don't make Tailscale's infrastructure better. They instead make your own infrastructure better. Running a peer relay donates nothing to anyone.

It makes their service better. It fixes slow transfer speeds between my nodes because their derp servers are rate limited.

Re: Tailscale Peer Relays

#82

Post by justahuman74 »

halJordan wrote: post #47
HowardStark wrote: post #28

Earlier quoted context omitted.

Nebula[0] addresses this and is IMO an improvement over WireGuard. Came out of Slack originally, and it supports peer discovery, NAT hole punching, and some other cool features. Also still uses the Noise Protocol. In practice, the extra networking features + better first class peer config management baked in is very nice (Nebula’s “lighthouses” are configured with a tool similar to DSNet for Wireguard[1]) [0] https:/…

So now we're back "tailscale but with different steps"

tailscale appears to be a paid product with a free tier, nebula (while DIY) is free

Re: Tailscale Peer Relays

#85

Post by mercutio2 »

Wow! I just spent a good chunk of time last week setting up headscale and split horizon SSL behind my network, and I expected I was going to just expose a Wireguard UDP port, but discovered no, it’s DERP or nothing. DERP has been OK, but I think just exposing a UDP port on my local network is better.

If we’re really confident in the security of that UDP client, that is. I feel very comfortable exposing a Wireguard bastion, time will tell how secure whatever protocol tailscale is serving, here, will be.

Re: Tailscale Peer Relays

#86

Post by einichi »

fariszr wrote: post #56

Is there a way to force clients to use a relay? It seems like this is only meant as a fallback, but what if a relayed connection is actually faster (like when direct peering between tailnet members is slow, not rare in consumer connections)

Just set the relay up as an exit node too

Re: Tailscale Peer Relays

#87

Post by bilinguliar »

bigstrat2003 wrote: post #59
ssl-3 wrote: post #46

Earlier quoted context omitted.

Tailscale is a few things. It might be fair to say that it is mostly a software platform with a web frontend that allows orgs (and individual users alike) to easily create secure VPNs, so their various systems can have a secure, unfiltered virtual private network on which to communicate with eachother even if they're individually scattered across the four corners of the Internet. The usual (traditional) way to do VPN…

Yeah, Tailscale is really cool. The only thing I wish is that they didn't tie auth to either a big tech monopoly (Google, github etc) or running your own IDP service. I would love to use Tailscale for some self hosted stuff I have, but hesitate to start exposing something like an identity management tool because that's a high value target. And of course, I don't really want to let Google et al be in control of my VPN…

They support Passkeys. This is exactly how I continue using them after moving away from Google Workspaces.

Re: Tailscale Peer Relays

#89

Post by MezzoDelCammin »

mercutio2 wrote: post #85

Wow! I just spent a good chunk of time last week setting up headscale and split horizon SSL behind my network, and I expected I was going to just expose a Wireguard UDP port, but discovered no, it’s DERP or nothing. DERP has been OK, but I think just exposing a UDP port on my local network is better. If we’re really confident in the security of that UDP client, that is. I feel very comfortable exposing a Wireguard ba…

mind developping on the "it's DERP or nothing"? Have you been trying to expose a direct wireguard port of your own, or the Tailscale?

Re: Tailscale Peer Relays

#90

Post by dvtkrlbs »

justahuman74 wrote: post #82
halJordan wrote: post #47

Earlier quoted context omitted.

So now we're back "tailscale but with different steps"

tailscale appears to be a paid product with a free tier, nebula (while DIY) is free

there is an open source control plane called headscale which covers almost all of the features for free (while DIY)
Post reply on HN