121–130 of 419 posts
Earlier quoted context omitted.
I'm mainly looking for a solution that punches through NAT the way Tailscale does.
Nebula has NAT punching as well[1]. Or does Tailscale do even more magic on it? [1] https://nebula.defined.net/docs/config/punchy/
We’re using Tailscale for our internal network, and it’s amazing. We’re a team distributed across multiple countries, and with Tailscale, it’s like we’re sitting in a single office, connected to the same router. And on top of that, we get centrally managed ACLs for everyone, TLS certificates, and SSO with Microsoft accounts. Amazing stuff! My main gripe, though, is DNS. It’s great to be able to reach prod-db-1, prod-…
Similar to how you would use keepalived to get a virtual IP and broker between addresses under it?
CGNAT _can_ make it easier to access your server. If your Internet provider and your mobile provider is the same company, they could put all your connected devices in the same IP block within the CGNAT IP range. Now, not only you can access your device at home while away using your cellphone, you can also connect to your partner's phone with the same IP address at (or away from) home. Some Internet providers in China…
Is there any simple FOSS alternative to tailscale that you can self-host? The only thing I need is to simply connect to the home network and I dont want to need to open and forward ports etc in routers and firewalls for it to work, just something simple plug and play and is secure.
Fully compatible with Tailscale client binaries; it just replaces the control server.
Earlier quoted context omitted.
Then why go with tailscale in the first place? There is slacks nebula and other options that are completely self-hosted from the start. Feels like such a weird hype around tailscale.
I feel like a lot of hype around Tailscale is because it vastly simplifies VPNs and their associated networking, especially for businesses, startups, or homelabs where the focus might be elsewhere or specific talent is unavailable. The problem arises when folks don't quite understand why specific decisions are being made, or use the product in nonstandard (or even negative) ways. I've seen stories of folks deploying…
I do think this simplicity is exactly what contributes to those weird and non-standard configurations.
I was once in South Africa and needed to look up my prescriptions in the CVS app. I had lost my pills and needed to show a local pharmacist what I needed. CVS geoblocked me. Luckily I had a TailScale exit node running at home, which solved the problem.
When I was in Germany - Capital One blocked access to my account unless I confirmed via SMS or tapping my card. Both of which I didn’t have with me. Tunnelling into my home machine I was able to access the account and transfer money I needed. Sure a VPN might be able to do this too but it’s nice being able to exit via a connection you control. I can also watch Plex movies without exposing ports.
I'm curious to hear well-informed reasons from this crowd for why we can trust Tailscale given the non-self-hosted part of the architecture? Does it come down to Tailnet locks [1], not worrying that Tailscale will be compromised, not worrying that your home network is worth compromising, or something else? [1]: https://tailscale.com/kb/1226/tailnet-lock
I basically just see Tailscale as an auth paradigm for managing wireguard keys.
Earlier quoted context omitted.
Call me Cappy Paranoid, but I fall into the camp of "You should never trust a service provider, ever ," and build infrastructure accordingly; I believe this falls into an extreme interpretation of "zero trust". So while also implementing Tailnet locks and other security measures to constrict traffic flow, I'd also consider going a step further by only permitting server or resource access based on client certificate v…
Then why go with tailscale in the first place? There is slacks nebula and other options that are completely self-hosted from the start. Feels like such a weird hype around tailscale.
Imo they don't charge all that much relative to their value, depending on who you're asking.
Earlier quoted context omitted.
Then why go with tailscale in the first place? There is slacks nebula and other options that are completely self-hosted from the start. Feels like such a weird hype around tailscale.
I feel like a lot of hype around Tailscale is because it vastly simplifies VPNs and their associated networking, especially for businesses, startups, or homelabs where the focus might be elsewhere or specific talent is unavailable. The problem arises when folks don't quite understand why specific decisions are being made, or use the product in nonstandard (or even negative) ways. I've seen stories of folks deploying…
Tailscale is based on Wire Guard, isn’t it? Now there’s a piece of software that truly made VPNs simple. I have a tunnel back into my LAN by way of an EC2 instance and all it took was two super simple config files on each machine.
Earlier quoted context omitted.
Use headscale: https://headscale.net/stable/
What are the primary downsides of self-hosting this? The top issues that come to mind: 1. Maintaining high availability 2. Dealing with patches/upgrades But I'm also really curious how likely a self-hosted instance is to be an attack vector potentially more dangerous than using something like Tailscale.
In my experience as a poor sysadmin (as in, bad), you don't /need/ HA for Headscale because the clients are pretty resilient. I've had my instance go down for a little bit and it's fine. Stale and new connections aren't, obviously, but it will work well enough that you won't realize Headscale itself has gone down until a while after it did.