I use Twingate both for personal use (my home) and to access AWS EC2 servers (no public ips) and really love it. Very polished, easy setup. How does Netrinos compare?
Show HN: Netrinos – A keep it simple Mesh VPN for small teams
21–30 of 75 posts
Re: Show HN: Netrinos – A keep it simple Mesh VPN for small teams
#22[dead]
Re: Show HN: Netrinos – A keep it simple Mesh VPN for small teams
#23Can anyone explain to me (someone not so network security savvy) if there are any privacy or security concerns using a wire guard provider like this? As I understand it, with traditional VPNs, you basically have to trust third-party audits to verify the VPN isn't logging all traffic and selling it. Does the WireGuard protocol address theses issues? Or is there still the same risk as a more traditional VPN provider?
This is not providing the same functionality as a "traditional VPN," in the sense that it does not do anything to your traffic going to the wider internet. With popular VPN services, they are an encrypted tunnel for all your internet traffic (some use the same protocol, WireGuard), but at the end of the tunnel they decrypt the message and send it to whatever website you requested, which is exactly what can cause those privacy issues you describe.
In this case, though, it creates an encrypted tunnel _only between your own devices_. This allows you to connect to all your devices, home desktop, phone, laptop, as if they were on the same network, allowing you to do fairly sensitive things like remote desktop without having to expose your machine to the public internet or deal with firewall rules in the same way.
Assuming this project is legitimate, then the only traffic this service would even touch would be those between your own devices, nothing related to public internet requests. And, on top of that, the requests should be encrypted the entire way, inaccessible to any devices other than the ones sending and receiving the requests.
There are many caveats and asterisks I could add, but I think that's a fairly straightforward summary.
Re: Show HN: Netrinos – A keep it simple Mesh VPN for small teams
#24>We use STUN-style discovery and relay fallback
How does your relay compare to Tailscale's (DERP)?
Re: Show HN: Netrinos – A keep it simple Mesh VPN for small teams
#25Naive question here: with WireGuard VPN, does all traffic route through the VPN or only those packets bound for the other devices in the mesh?
WireGuard itself can be configured to work either way.
Our target market is smaller teams and people with limited IT skills. So, we chose not to send all traffic through the vpn. The only traffic going through the VPN is traffic to and from your other devices (in your account). Internet access is still through your default network.
In the Pro version, you can route specific destinations through other peers, also belonging to you. An example use case here would be accessing your web banking while on vacation in a distant country. You would route your bank website through your home connection.
Similarly, our access control is only restricting traffic that comes from your devices on the wireguard network. We do not interfere with the settings of your own personal firewall.
Re: Show HN: Netrinos – A keep it simple Mesh VPN for small teams
#26Earlier quoted context omitted.
Not allowing random VPN connections on a LAN is pretty standard. I've been surprised at how many people here are able to use tailscale and the like. Guessing it's just because there are likely smaller teams here that don't have any kind of managed network.
Someone is making your IT team do extra work without a good understanding of their systems if they're banning tailscale or granting special network level access thinking that ip or mac address based profiling is secure. Your network should be zero trust. That means you want to treat every host that connects as if it's on the public internet; the corollary to that is you should give your hosts access to the public int…
And then a few of those users who you treated like adults who don't need surveillance make a private network among themselves and other nodes in Russia and China to exfiltrate the corporation's most sensitive intellectual property, serve as a bridge for state-sponsored bad actors to bypass your firewall, and tunnel command-and-control traffic through your "unrestricted" egress, and now your zero-trust philosophy has created a zero-accountability blind spot that your IR team discovers eighteen months later during a breach investigation.
Re: Show HN: Netrinos – A keep it simple Mesh VPN for small teams
#27Naive question here: with WireGuard VPN, does all traffic route through the VPN or only those packets bound for the other devices in the mesh?
For WireGuard in general, you provide it an AllowedIPs config which is a list of CIDR ranges that should be routed across the link. That could be `0.0.0.0/0` (aka everything), a single subnet, a union of several, or even individual IPs. This config is technically symmetric between the endpoints, though a prototypical implementation of "individual clients enable the VPN to access the internal network" may limit the "client" AllowedIPs to an individual address.
Re: Show HN: Netrinos – A keep it simple Mesh VPN for small teams
#28[dead]
Re: Show HN: Netrinos – A keep it simple Mesh VPN for small teams
#29Earlier quoted context omitted.
One's banned in my hostel because of a stupid sysadmin. One isn't.
Not allowing random VPN connections on a LAN is pretty standard. I've been surprised at how many people here are able to use tailscale and the like. Guessing it's just because there are likely smaller teams here that don't have any kind of managed network.
About that, we actually tried (with support from the network team) to open a small VPN Fron our office for some mobile devices as part of an event installation. Just plain wireguard on a public IP.
After two weeks of back and forth the wireguard packets were still being discarded somewhere by a firewall/router thanks to "deny VPNs by default". Tailscale got through those immediately though by using their relays + one of the workarounds for standard wireguard ports being blocked. Point being, the service provided by a mature solution like Tailscale for punching through networks is surprisingly effective even for corporate-level networks.
Re: Show HN: Netrinos – A keep it simple Mesh VPN for small teams
#30[dead]