Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Tailscale is pretty useful

blog.6nok.org

Post reply on HN
Print view View original

131–140 of 419 posts

Re: Tailscale is pretty useful

#131

Post by codethief »

Hikikomori wrote: post #44
baq wrote: post #31

Earlier quoted context omitted.

It just works, literally. I haven’t tried nord, but I’ve got clients on Mac, Linux, windows, rpis, it all just works. I used to run pivpn, but the key exchange magic Tailscale employs is so much simpler and it somehow works on networks blocking unknown packets like the pivpn I had set up on some random udp port.

How is it on Android? Tried different vpns to access my pihole but its really slow at resolving sometimes.

I've used it on Android to stream the occasional video or song from my Jellyfin server while using mobile data. Not bad at all, plus they finally seem to have gotten their battery drain issues under control.

Recently, as I have been traveling through the Middle East and East Africa, I have also used Tailscale on my phone to protect myself on public wifis and to work around MitM attempts, see my other comment further up.

Re: Tailscale is pretty useful

#133

Post by stego-tech »

haswell wrote: post #125
stego-tech wrote: post #101

Earlier quoted context omitted.

I feel like a lot of hype around Tailscale is because it vastly simplifies VPNs and their associated networking, especially for businesses, startups, or homelabs where the focus might be elsewhere or specific talent is unavailable. The problem arises when folks don't quite understand why specific decisions are being made, or use the product in nonstandard (or even negative) ways. I've seen stories of folks deploying…

Yeah, I mentally sum this up as the "Just Works" factor. As a happy Tailscale user, it's easy to see why it's so popular. I do think this simplicity is exactly what contributes to those weird and non-standard configurations.

> I do think this simplicity is exactly what contributes to those weird and non-standard configurations.

This is why I am confident I will always have employment in IT. As I make things simpler for others to use, they in turn will find new and innovative ways of making my eyes bleed from cursed workflows that once again require professional intervention for simplicity, efficiency, and security.

Re: Tailscale is pretty useful

#134

Post by xmichael909 »

stego-tech wrote: post #49
iamdamian wrote: post #38

I'm curious to hear well-informed reasons from this crowd for why we can trust Tailscale given the non-self-hosted part of the architecture? Does it come down to Tailnet locks [1], not worrying that Tailscale will be compromised, not worrying that your home network is worth compromising, or something else? [1]: https://tailscale.com/kb/1226/tailnet-lock

Call me Cappy Paranoid, but I fall into the camp of "You should never trust a service provider, ever ," and build infrastructure accordingly; I believe this falls into an extreme interpretation of "zero trust". So while also implementing Tailnet locks and other security measures to constrict traffic flow, I'd also consider going a step further by only permitting server or resource access based on client certificate v…

Why wouldn't you just not use Tailscale? What you are describing here is, ....

Re: Tailscale is pretty useful

#135

Post by knowaveragejoe »

MasterYoda wrote: post #108

Is there any simple FOSS alternative to tailscale that you can self-host? The only thing I need is to simply connect to the home network and I dont want to need to open and forward ports etc in routers and firewalls for it to work, just something simple plug and play and is secure.

> The only thing I need is to simply connect to the home network and I dont want to need to open and forward ports etc in routers and firewalls for it to work, just something simple plug and play and is secure

That's tailscale, basically. Install on devices and they can magically talk to each other across the internet with no other configuration.

If you really want to, you can run headscale and manage the coordination plane yourself as well.

https://github.com/juanfont/headscale

Re: Tailscale is pretty useful

#136

Post by knowaveragejoe »

mfro wrote: post #114
MasterYoda wrote: post #108

Is there any simple FOSS alternative to tailscale that you can self-host? The only thing I need is to simply connect to the home network and I dont want to need to open and forward ports etc in routers and firewalls for it to work, just something simple plug and play and is secure.

It's functionally just a VPN. Selfhosting wireguard or openvpn is not particularly difficult.

It uses Wireguard, sure, but it's using a coordination service to give you a effectively a flat network mesh instead of hub and spoke.

Re: Tailscale is pretty useful

#137

Post by bcye »

9dev wrote: post #106

We’re using Tailscale for our internal network, and it’s amazing. We’re a team distributed across multiple countries, and with Tailscale, it’s like we’re sitting in a single office, connected to the same router. And on top of that, we get centrally managed ACLs for everyone, TLS certificates, and SSO with Microsoft accounts. Amazing stuff! My main gripe, though, is DNS. It’s great to be able to reach prod-db-1, prod-…

I noticed that limitation quickly too. My solution was to just point A records on my domain to the tailscale internal ip and use the let's encrypt wildcard certificate my registrar (porkbun) provides out of the box.

Re: Tailscale is pretty useful

#138

Post by apitman »

Tailscale is one of my favorite companies. They're clearly on to something. Here's a great post by their CTO explaining a lot of the motivation and vision behind it: https://crawshaw.io/blog/remembering-the-lan

IMO the main outstanding questions/concerns are:

* Is the VPN model really the way to go? If someone gets their hands on one of your Tailscale nodes, they can access every service on your tailnet, which are likely running with reduced security since that's a huge part of the appeal. This is exactly the situation BeyondCorps/Zero Trust was created to avoid. Tunneling services[0] are more of a Zero Trust approach, but they can't match the seamlessness of Tailscale once a node is connected to the tailnet.

* Can it expand into the layman market? I wonder if the average person will ever be willing to install a VPN app on all their devices. On the flipside, I could see TS partnering with someone like Google to integrate TS tightly with Android and set up a private network between all your Google-signed-in devices.

* The relay system - DERP is nice, but it's primarily intended for signaling/fallback. It feels like CGNAT adoption is growing faster than IPv6 is, and I wouldn't be surprised if fewer and fewer p2p connections succeed over time[1]. DERP forces everything over a single TCP connection (HOL blocking), and I'm not sure it even has any flow control.

* Use in web browsers - They got a demo of this working, but it's pretty involved. You have to compile the entire Tailscale Golang library to WebAssembly which is a large artifact, and it's DERP-exclusive.

* Portability in general - Depending on WireGuard, as awesome as it is, is fairly limiting. You either need admin privileges to create the TUN device, or you need to run an entire TCP stack in userspace alongside your own WireGuard implementation. I'd be interested to see something like Tailscale implemented on top of WebTransport.

[0]: https://github.com/anderspitman/awesome-tunneling

[1]: https://tailscale.com/blog/how-nat-traversal-works

Re: Tailscale is pretty useful

#139

Post by stego-tech »

codetrotter wrote: post #104
stego-tech wrote: post #49

Earlier quoted context omitted.

Call me Cappy Paranoid, but I fall into the camp of "You should never trust a service provider, ever ," and build infrastructure accordingly; I believe this falls into an extreme interpretation of "zero trust". So while also implementing Tailnet locks and other security measures to constrict traffic flow, I'd also consider going a step further by only permitting server or resource access based on client certificate v…

> Is that a gigantic PITA to implement? Oh heck, you betcha it is I use my own self-hosted Wireguard VPN server. I agree with a lot of what you were saying about client certificates etc. And I plan to eventually do that sort of thing on some of my services in my own Wireguard VPN too. But in terms of Tailscale, if you are going to set up all kinds of client certificate things that will take a lot of time and effort,…

> But in terms of Tailscale, if you are going to set up all kinds of client certificate things that will take a lot of time and effort, why not self-host Wireguard also?

Already do! I tried Tailscale initially, but ultimately decided to put in the effort of a proper Wireguard setup. It's how my personal devices always get back to my home LAN, and then exit to the internet; it's also how I make sure every DNS lookup hits the Pi-Hole, for domain blocking wherever I am.

I emphatically recommend learning WireGuard (and to a lesser degree, VPN Concentration) when practical and possible. Until then, Tailscale is an excellent product.

Re: Tailscale is pretty useful

#140

Post by stego-tech »

HPsquared wrote: post #95
stego-tech wrote: post #49

Earlier quoted context omitted.

Call me Cappy Paranoid, but I fall into the camp of "You should never trust a service provider, ever ," and build infrastructure accordingly; I believe this falls into an extreme interpretation of "zero trust". So while also implementing Tailnet locks and other security measures to constrict traffic flow, I'd also consider going a step further by only permitting server or resource access based on client certificate v…

If you can't trust service providers, you probably also can't trust software suppliers.

I mean, yes? It's why Zero Trust is growing as an operations model. Supply chain attacks, vendor hostility, zero days being hoarded by nations and bad actors for exploit, the list goes on.

You emphatically cannot trust vendors, suppliers, users, software, systems, or governments. Ergo, your infrastructure should be built with an appropriate risk assessment in mind, and have proper safeguards in place where feasible. That's just good OpSec.

Post reply on HN