Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Show HN: Netrinos – A keep it simple Mesh VPN for small teams

netrinos.com

Post reply on HN
Print view View original

51–60 of 75 posts

Re: Show HN: Netrinos – A keep it simple Mesh VPN for small teams

#51

Post by pcarroll »

drcongo wrote: post #48

I only use Tailscale for two features - one is having every machine on the network use a logical name of the pattern {projectname}-{environment} ie: `ssh me@hn-prd` and the other is exit nodes. I couldn't work out from your site if either of these two things is doable here.

Each device on your account gets a private static IP address in the network 100.x.x.x. The name is static as long as the device lives on your account.

Each also gets a friendly DNS name in the form device.account.2ho.ca (try finding a short domain these days).

So yes, you can...

$ ssh user@server.myaccount.2ho.ca

C:\ net use S: \\server.myaccount.2ho.ca\Home

etc.

Re: Show HN: Netrinos – A keep it simple Mesh VPN for small teams

#52

Post by anonzzzies »

Is there something like tailgate (or this) with only cli (I much dislike tailgate gui stuff on mac/win, on mobile its kind of needed) and you own small connection gateway on your own vps? I know tailgate has an open source implementation but I could not get that working while bored at the airport so that's not simple enough (the thing is enormous as well while it should just 'handshake' and that's it right?).

Re: Show HN: Netrinos – A keep it simple Mesh VPN for small teams

#53

Post by pcarroll »

drcongo wrote: post #49
windexh8er wrote: post #34

Well, I wish you the best with this - but I really don't understand the target market. The obvious competitor here is Tailscale. But let's say, reasons, and Tailscale isn't an option. Then you go down the path... TwinGate, Teleport, Netbird, Pomerium, Netmaker, ZeroTier, etc... Even the initial pricing and free tier are you're up against are going to mostly be a deal breaker compared to what's out there. Trusting a V…

I have been down that path and found Twingate, Netbird, Netmaker and Zerotier lacking in one way or another, not tried those other two yet though.

Could you please elaborate on what you found lacking? Always looking to improve.

Re: Show HN: Netrinos – A keep it simple Mesh VPN for small teams

#54

Post by subscribed »

felixg3 wrote: post #3

I really like your fair differentiation and feature comparison vs Tailscale, netbird etc. Love to see the ecosystem of wireguard based services growing into different business segments, i.e. you targeting SMBs/small teams. Not for me, but legitimate use case and product :)

Exactly, same sentiment here.

Re: Show HN: Netrinos – A keep it simple Mesh VPN for small teams

#55

Post by pcarroll »

anonzzzies wrote: post #52

Is there something like tailgate (or this) with only cli (I much dislike tailgate gui stuff on mac/win, on mobile its kind of needed) and you own small connection gateway on your own vps? I know tailgate has an open source implementation but I could not get that working while bored at the airport so that's not simple enough (the thing is enormous as well while it should just 'handshake' and that's it right?).

Netrinos can be entirely cli on all 3 platforms.

If you install the OpenSSH server on Windows, you can manage Netrinos in a terminal, just like on Linux or Mac. e.g.

https://netrinos.com/cdn/images/screens/windows-terminal.png

https://netrinos.com/cdn/images/screens/linux-terminal.png

On a trip to Europe last year, I tried it from the Air Canada in-flight WiFi somewhere over Iceland. I was able to RDP to my desktop at home, then RDP right back to my laptop on the plane. Performance wasn't great. And it's not a terribly useful use case. But it did work.

Wireguard deserves a lot of credit there. No ports were opened on my home end. And who knows what the plane has for NAT.

Re: Show HN: Netrinos – A keep it simple Mesh VPN for small teams

#56

Post by Grimblewald »

pcarroll wrote: post #51
drcongo wrote: post #48

I only use Tailscale for two features - one is having every machine on the network use a logical name of the pattern {projectname}-{environment} ie: `ssh me@hn-prd` and the other is exit nodes. I couldn't work out from your site if either of these two things is doable here.

Each device on your account gets a private static IP address in the network 100.x.x.x. The name is static as long as the device lives on your account. Each also gets a friendly DNS name in the form device.account.2ho.ca (try finding a short domain these days). So yes, you can... $ ssh user@server.myaccount.2ho.ca C:\ net use S: \\server.myaccount.2ho.ca\Home etc.

Well, given you can set your vpn server to also relay dns requests, and have that same server resolve any *.myspecialtld requests makes that a breeze. I run a whole invite only "internet" of sorts doing this with a plain wireguard server (video streaming, webmail, chatbot, personal websites, forums etc) finding a short domain is easy as pie.

Re: Show HN: Netrinos – A keep it simple Mesh VPN for small teams

#58

Post by wkat4242 »

hugo1789 wrote: post #38
panarky wrote: post #26

Earlier quoted context omitted.

And then a few of those users who you treated like adults who don't need surveillance make a private network among themselves and other nodes in Russia and China to exfiltrate the corporation's most sensitive intellectual property, serve as a bridge for state-sponsored bad actors to bypass your firewall, and tunnel command-and-control traffic through your "unrestricted" egress, and now your zero-trust philosophy has…

What’s the alternative—locking down all legitimate users and still losing the data anyway? Network controls alone don’t stop exfiltration. HDMI/DP can move data faster than most consumer NICs. Does the system account for that scenario?

It's a matter of layers. Banning VPNs isn't a perfect measure. But it makes it a lot easier than when you let everyone cowboy around.

Same with RBAC. It's not perfect because some people need legit access to stuff and it can be abused. But it makes it much harder for bad actors.

Re: Show HN: Netrinos – A keep it simple Mesh VPN for small teams

#59

Post by wkat4242 »

idiotsecant wrote: post #31
panarky wrote: post #26

Earlier quoted context omitted.

And then a few of those users who you treated like adults who don't need surveillance make a private network among themselves and other nodes in Russia and China to exfiltrate the corporation's most sensitive intellectual property, serve as a bridge for state-sponsored bad actors to bypass your firewall, and tunnel command-and-control traffic through your "unrestricted" egress, and now your zero-trust philosophy has…

If your threat is state sponsored bad actors you've already failed. OK, great you blocked VPNs. Now they tunneled their vpn through as HTTPS. You successfully annoyed all your legit users and completely failed to stop the real problem.

Https is also inspected in our place and has been for a decade.

Also there's different classes of state sponsored APT groups. You won't stand a chance against the NSA but there's a lot of state sponsored groups in Russia that are just looking for low hanging fruit to get some foreign money for their regime.

Re: Show HN: Netrinos – A keep it simple Mesh VPN for small teams

#60

Post by wkat4242 »

windexh8er wrote: post #34

Well, I wish you the best with this - but I really don't understand the target market. The obvious competitor here is Tailscale. But let's say, reasons, and Tailscale isn't an option. Then you go down the path... TwinGate, Teleport, Netbird, Pomerium, Netmaker, ZeroTier, etc... Even the initial pricing and free tier are you're up against are going to mostly be a deal breaker compared to what's out there. Trusting a V…

Yeah not owning the control plane is why I don't use tailscale. I might use headscale at some point but for now I'm covered anyway :) and I don't like my control plane exposed to the internet even if it's self hosted. So I went for something else.
Post reply on HN