How Tailscale Works • Hacker News Board

Re: How Tailscale Works

#11

Post by j88439h84 » Sat, Mar 21, 2020, 6:31 AM UTC

crawshaw wrote: post #6

slenk wrote: post #5

Earlier quoted context omitted.

That is only the linux client?

Tailscale co-founder here: that's the guts of all the clients. (It almost works on macOS too as is, just a little more work to do.) We are still open sourcing our code, there's more to come but we haven't found the time to clean it up and get it ready to release. Soon hopefully!

Is the client the important part of the software, or is there a server side?

Re: How Tailscale Works

#12

Post by crawshaw » Sat, Mar 21, 2020, 6:37 AM UTC

j88439h84 wrote: post #11

crawshaw wrote: post #6

Earlier quoted context omitted.

Tailscale co-founder here: that's the guts of all the clients. (It almost works on macOS too as is, just a little more work to do.) We are still open sourcing our code, there's more to come but we haven't found the time to clean it up and get it ready to release. Soon hopefully!

Is the client the important part of the software, or is there a server side?

The client contains our most sophisticated code. It's also the most important from a trust perspective, it is responsible for securing your data, our servers cannot see anything of yours because of the client. So it's vital the important parts of it are open source.

That said, I'd like to open source a server. We need a reference implementation of our control protocol so it can be properly analyzed by security experts. Not sure what form that should take yet, but I'd like it to be usable.

Re: How Tailscale Works

#13

Post by AlphaSite » Sat, Mar 21, 2020, 6:39 AM UTC

Is Tailscale SDWAN for edge VPNs?

Re: How Tailscale Works

#14

Post by notlukesky » Sat, Mar 21, 2020, 6:47 AM UTC

crawshaw wrote: post #6

slenk wrote: post #5

Earlier quoted context omitted.

That is only the linux client?

Tailscale co-founder here: that's the guts of all the clients. (It almost works on macOS too as is, just a little more work to do.) We are still open sourcing our code, there's more to come but we haven't found the time to clean it up and get it ready to release. Soon hopefully!

What license schemes etc? Also how do you integrate with IdPs? Are you a SAML service provider? If so where is the documentation for it?

Re: How Tailscale Works

#15

Post by pciexpgpu » Sat, Mar 21, 2020, 6:49 AM UTC

crawshaw wrote: post #7

mindfulplay wrote: post #2

Is there any page that describes how to actually get VPN work end to end with tailscale? I am a newbie and would like to understand.

Install the client on two devices and log in with a Gmail account. That's it. They'll be assigned IPs and can reach each other. (I'm a co-founder of Tailscale.)

That's really cool. Thank you.

Re: How Tailscale Works

#16

Post by dochtman » Sat, Mar 21, 2020, 6:49 AM UTC

I was wondering, does this work with any domains that advertise (for example) OpenID Connect, or does it require one of the well-known providers?

Re: How Tailscale Works

#17

Post by InvaderFizz » Sat, Mar 21, 2020, 6:55 AM UTC

It's not clear from the docs. Can a two node Tailscale setup connect to each other when both sides are behind a IPv4 only CGNAT(Verizon/AT&T LTE)?

There is mention of STUN, but CGNAT is a whole new level of ugly and there is often NAT behind the CGNAT.

If not, do nodes that can get incoming connections become relay "super nodes?"

Re: How Tailscale Works

#18

Post by apenwarr » Sat, Mar 21, 2020, 7:03 AM UTC

InvaderFizz wrote: post #17

It's not clear from the docs. Can a two node Tailscale setup connect to each other when both sides are behind a IPv4 only CGNAT(Verizon/AT&T LTE)? There is mention of STUN, but CGNAT is a whole new level of ugly and there is often NAT behind the CGNAT. If not, do nodes that can get incoming connections become relay "super nodes?"

(Article author here.) Yes, this is what DERP is for. Nowadays automatically designating nodes as supernodes doesn’t work as well as it used to, since many devices are battery constrained and cloud devices tend to have metered bandwidth. We might someday have a way to add your own DERP relays for your domain (since the DERP code is open source anyway). The tricky part is guaranteeing reliable delivery in that case.

Re: How Tailscale Works

#19

Post by wideasleep1 » Sat, Mar 21, 2020, 7:07 AM UTC

InvaderFizz wrote: post #17

It's not clear from the docs. Can a two node Tailscale setup connect to each other when both sides are behind a IPv4 only CGNAT(Verizon/AT&T LTE)? There is mention of STUN, but CGNAT is a whole new level of ugly and there is often NAT behind the CGNAT. If not, do nodes that can get incoming connections become relay "super nodes?"

Also VERY interested in this, and the impending Android client status. Some of us are fully on mobile LTE data.

Re: How Tailscale Works

#20

Post by benreesman » Sat, Mar 21, 2020, 7:10 AM UTC

It sounds like these guys have done their homework (from a distributed systems PoV, I don’t know much about the security side).

IIUC it’s an application of one of my favorite design patterns: “this part needs CP, the rest is more flexible”.

It’s remarkable how far this gadget can take you.