Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Netbird – Open Source Zero Trust Networking

netbird.io

Post reply on HN
Print view View original

121–130 of 299 posts

Re: Netbird – Open Source Zero Trust Networking

#121

Post by zakki »

geoctl wrote: post #91
nszceta wrote: post #86

Earlier quoted context omitted.

It took me too long to understand the difference between the two so I'll leave it here for others. Octelium operates on OSI Layer 7 and Tailscale operates on OSI Layer 3 and 4.

Well, yes, Octelium is technically a VPN from a layer-3 perspective since it uses WireGuard/QUIC tunneling, but the tunnel doesn't directly terminate to the destination like in VPNs but instead to an identity-aware proxy that does authentication and L7-aware authorization on a per-request basis with policy-as-code via CEL/OPA. From an architecture perspective, I assume it's closer to ZTNAs such as Cloudflare Access a…

doest it have identity-aware proxy built-in?

Re: Netbird – Open Source Zero Trust Networking

#122

Post by mstaoru »

mittermayr wrote: post #47

I can only recommend giving headscale a try. It's free, works extremely well, and can be used with the official Tailscale clients. Was super easy to set up. https://headscale.net/stable/

Headscale is good. We're using to manage a two isolated networks of about 400 devices each. It just works. It's in China so official Tailscale DERPs do not work, but enabling built-in DERP was very easy.

Re: Netbird – Open Source Zero Trust Networking

#123

Post by jscd »

markonen wrote: post #90
mittermayr wrote: post #47

I can only recommend giving headscale a try. It's free, works extremely well, and can be used with the official Tailscale clients. Was super easy to set up. https://headscale.net/stable/

Apparently they've deprecated Postgres support and now only recommend sqlite as the storage backend. I have nothing against sqlite but to me this looks like Tailscale actively signaling what they think the expected use of headscale is.

Tailscale itself only uses sqlite[1], so I’m not sure if that really holds in this case.

[1]: https://tailscale.com/blog/database-for-2022

Re: Netbird – Open Source Zero Trust Networking

#124

Post by geoctl »

zakki wrote: post #121
geoctl wrote: post #91

Earlier quoted context omitted.

Well, yes, Octelium is technically a VPN from a layer-3 perspective since it uses WireGuard/QUIC tunneling, but the tunnel doesn't directly terminate to the destination like in VPNs but instead to an identity-aware proxy that does authentication and L7-aware authorization on a per-request basis with policy-as-code via CEL/OPA. From an architecture perspective, I assume it's closer to ZTNAs such as Cloudflare Access a…

doest it have identity-aware proxy built-in?

Yes, every resource that needs to be protected is represented by a "Service" that's implemented as a L7-aware identity-aware proxy in the Octelium Cluster, which is a distributed system that's running on top of a k8s cluster. Users simply access the protected resource/upstream through the Cluster, namely the Service, from a data-plane perspective, and the Service/identity-aware proxy does authentication/authorization/routing/visibility on a per-request basis. This upstream could be an internal resource directly accessible by the Cluster, or remotely behind NAT, or simply publicly protected SaaS resource (e.g. API protected by an access token, SaaS database protected by a password, etc.). You can read more about how Octelium works here https://octelium.com/docs/octelium/latest/overview/how-octel...

Re: Netbird – Open Source Zero Trust Networking

#125

Post by ZoomZoomZoom »

nixosbestos wrote: post #118
ZoomZoomZoom wrote: post #75

Earlier quoted context omitted.

I don't care why. They do nothing to circumvent this so they are not a reliable solution for those who have network participants using the restricted platforms. There could be a million reasons, but not a technical one — "headscale client", for example, could exist in current hostile app stores, but there isn't one.

Your arbitrary, loosely-detailed complaints would apply to literally everyone, every app. It's on f-droid, it's open source, you're being ridiculous. I'm not even sure you understand what you're asking for. The official, open source Tailscale client explicitly supports headscale servers.

It's the only app from the ones I use that my friends and relatives who already use iOS can't even install due to geoblocking.

If you don't see it as a problem means you're not affected and perhaps lack some empathy.

Yes, I understand the Apple ecosystem is a problem. But it's not an insurmountable one. Builds of Free Software exist on Apple Appstore and none of them exhibit this problem, unless they are tied to a commercial entity in the corresponding jurisdiction. The issue with Tailscale is that they use their open-source clients and headscale as means to gain user trust, but their solution is deficient due to everything mentioned above.

> I'm not even sure you understand what you're asking for.

I'm asking for a free software client to go with the headscale server that can be installed everywhere technically viable, without idiotic additional restrictions.

It's clear that it's you who don't really understand the crux of the issue (which you partially admitted by you "not even sure", but still), but it's somehow I who's ridiculous.

Re: Netbird – Open Source Zero Trust Networking

#126

Post by jorams »

nebezb wrote: post #114
cedws wrote: post #112

Has anybody looked at whether Tailscale is subject to the US CLOUD Act? If so I can imagine we might be moving towards an open source solution like this in future.

Tailscales founders are Canadian, principled, and are very sensitive to Canadian needs. I very much trust Avery and team to do what’s necessary to keep US hands off the data. edit: someone pointed out they’ve signed new users on to a US co. 15 months ago. I made the statement without knowing this. they aren’t as capable as I originally claimed.

According to their ToS all customer accounts registered on or after September 3, 2024 are signed on to a US company, so no they're not doing what's necessary to keep US hands off the data.

Re: Netbird – Open Source Zero Trust Networking

#127

Post by nebezb »

jorams wrote: post #126
nebezb wrote: post #114

Earlier quoted context omitted.

Tailscales founders are Canadian, principled, and are very sensitive to Canadian needs. I very much trust Avery and team to do what’s necessary to keep US hands off the data. edit: someone pointed out they’ve signed new users on to a US co. 15 months ago. I made the statement without knowing this. they aren’t as capable as I originally claimed.

According to their ToS all customer accounts registered on or after September 3, 2024 are signed on to a US company, so no they're not doing what's necessary to keep US hands off the data.

Very good discovery. My prior perspectives need updating.

Re: Netbird – Open Source Zero Trust Networking

#129

Post by protimewaster »

tucnak wrote: post #110
db04 wrote: post #76

Earlier quoted context omitted.

Is Headscale suitable for production use?

No, it's only viable if your whole network is, like, five devices.

I assume this is an exaggeration? Another poster says they have good luck with headscale on two networks of 400 devices.

Re: Netbird – Open Source Zero Trust Networking

#130

Post by [deleted] »

nszceta wrote: post #86
geoctl wrote: post #70

(Shamless plug) I am also working on a similar FOSS, self-hosted project called Octelium https://github.com/octelium/octelium that you might find interesting if you are interested in this space. Octelium is, however, more of a generic/unified zero trust secure access platform that can operate as a remote access VPN, a ZTNA platform, API/AI/MCP gateway, a PaaS, an ngrok-alternative and a homelab infrastructure. It pro…

It took me too long to understand the difference between the two so I'll leave it here for others. Octelium operates on OSI Layer 7 and Tailscale operates on OSI Layer 3 and 4.

[deleted]
Post reply on HN