Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Show HN: Netrinos – A keep it simple Mesh VPN for small teams

netrinos.com

Post reply on HN
Print view View original

41–50 of 75 posts

Re: Show HN: Netrinos – A keep it simple Mesh VPN for small teams

#41

Post by 1vuio0pswjnm7 »

windexh8er wrote: post #34

Well, I wish you the best with this - but I really don't understand the target market. The obvious competitor here is Tailscale. But let's say, reasons, and Tailscale isn't an option. Then you go down the path... TwinGate, Teleport, Netbird, Pomerium, Netmaker, ZeroTier, etc... Even the initial pricing and free tier are you're up against are going to mostly be a deal breaker compared to what's out there. Trusting a V…

"Well, I wish you the best with this - but I really don't understand the target market."

"After years of SSH tunnels, IPsec headaches, and the ssh log horror movie, I wanted something simpler: install, sign in, get work done."

"Target market" could be the author

There's no good reason to discourage people from writing overlays, unless one is doing so for commercial (i.e., anti-competitive) reasons

A more interesting question might be, "In your opinion, what is unsatisfactory about XYZ that does essentially the same thing"

For example, one might be a Layer 2 overlay whilst the other is Layer 3

Maybe we'll never have web browser diversity (or meaningful competition) as the web browser has become an instrument of surveillance and advertising controlled by "Big Tech", but overlay diversity (and competition) is still a possibility

If everyone thought IPsec and OpenVPN was "good enough" then Wireguard and Tailscale would not exist

I still use an unpopular non-commercial L2 overlay from before Wireguard existed that is smaller and faster than anything else I have ever seen

IMHO, the more overlays that exist, the better

Re: Show HN: Netrinos – A keep it simple Mesh VPN for small teams

#42

Post by pcarroll »

mrbluecoat wrote: post #36

Any plans for Exit Node capability (traditional egress VPN)?

Pro has that. We call it a Gateway. See:

https://netrinos.com/help/gateways-routing

You can also have multiple gateways and send traffic through different locations. e.g. You can access a NAS on one site and a website through another.

Re: Show HN: Netrinos – A keep it simple Mesh VPN for small teams

#43

Post by pcarroll »

ImPleadThe5th wrote: post #17

Can anyone explain to me (someone not so network security savvy) if there are any privacy or security concerns using a wire guard provider like this? As I understand it, with traditional VPNs, you basically have to trust third-party audits to verify the VPN isn't logging all traffic and selling it. Does the WireGuard protocol address theses issues? Or is there still the same risk as a more traditional VPN provider?

To clarify, one of the big advantages of a Mesh VPN is that the traffic does not flow through the VPN provider at all. WireGuard encrypts the traffic from device interface to device interface. The connections are point-to-point and not hub-and-spoke. This is both faster and more secure.

If a direct connection cannot be established due to a very restrictive firewall or a messed-up ISP modem, it will fall back to a relay server. But in that case, the relay relays the traffic, but it does not have the keys to read it.

You can learn more here: https://www.wireguard.com/

TL;DR WireGuard itself is a relatively small project at roughly 4,000 lines of code. It has been thoroughly audited and is even built into the Linux kernel.

Re: Show HN: Netrinos – A keep it simple Mesh VPN for small teams

#46

Post by pcarroll »

nodesocket wrote: post #21

I use Twingate both for personal use (my home) and to access AWS EC2 servers (no public ips) and really love it. Very polished, easy setup. How does Netrinos compare?

We do have some comparisons on our site...

https://netrinos.com/compare

Thanks

Re: Show HN: Netrinos – A keep it simple Mesh VPN for small teams

#48

Post by drcongo »

I only use Tailscale for two features - one is having every machine on the network use a logical name of the pattern {projectname}-{environment} ie: `ssh me@hn-prd` and the other is exit nodes. I couldn't work out from your site if either of these two things is doable here.

Re: Show HN: Netrinos – A keep it simple Mesh VPN for small teams

#49

Post by drcongo »

windexh8er wrote: post #34

Well, I wish you the best with this - but I really don't understand the target market. The obvious competitor here is Tailscale. But let's say, reasons, and Tailscale isn't an option. Then you go down the path... TwinGate, Teleport, Netbird, Pomerium, Netmaker, ZeroTier, etc... Even the initial pricing and free tier are you're up against are going to mostly be a deal breaker compared to what's out there. Trusting a V…

I have been down that path and found Twingate, Netbird, Netmaker and Zerotier lacking in one way or another, not tried those other two yet though.

Re: Show HN: Netrinos – A keep it simple Mesh VPN for small teams

#50

Post by observationist »

panarky wrote: post #26
observationist wrote: post #15

Earlier quoted context omitted.

Someone is making your IT team do extra work without a good understanding of their systems if they're banning tailscale or granting special network level access thinking that ip or mac address based profiling is secure. Your network should be zero trust. That means you want to treat every host that connects as if it's on the public internet; the corollary to that is you should give your hosts access to the public int…

And then a few of those users who you treated like adults who don't need surveillance make a private network among themselves and other nodes in Russia and China to exfiltrate the corporation's most sensitive intellectual property, serve as a bridge for state-sponsored bad actors to bypass your firewall, and tunnel command-and-control traffic through your "unrestricted" egress, and now your zero-trust philosophy has…

Then you've failed in security infrastructure, policy, and enforcement, and you've infantilized your users and wasted a bunch of IT time on checking boxes. The real power move in that case would be ensuring some third party vendor checked the boxes for you, so that your ass gets sufficiently covered and you have a narrative that goes something like "well, we did everything you're supposed to, those pesky superhackers are just soooo devious and skilled that they can get anywhere!"

The actual fix for things like that is to ensure that your sensitive data is properly protected, and things that you don't want exfiltrated aren't put into scenarios where exfiltration is possible. If you need to compromise on security for practicality, then make those exceptions highly monitored with multiple people involved in custody and verification. Zero trust means you don't give any of your users or host devices any trust at all, and modern security software can require multiple party approvals and MFA.

You can use a phone to scan documents as you scroll through them, or mitm hardware devices that appear to be part of a cable, or all sorts of sneaky shenanigans, and it's a never-ending arms race, so you have to decide what level of convenience is worth what level of risk and make policies enforceable and auditable. In some cases that might mean SCIF level security with metal detectors and armed guards, in other cases it might mean ensuring a good password policy for zip files shared via email.

Inconveniencing users by limiting web access and doing the TSA style performative security thing is counterproductive. This doesn't mean you give them install rights, or you don't log web activity, or run endpoint malware scanning, or have advanced unusual activity monitoring on the network and so forth. It just means if Sally from accounting wants to go shopping for ugly christmas sweaters for staff on Etsy, she doesn't have to fill out forms in triplicate and wait 3 months while the IT department gets approvals and management has meetings and the third party security vendor does a policy review and assessment before signing off on it, or telling her no.

Post reply on HN