Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Netbird – Open Source Zero Trust Networking

netbird.io

Post reply on HN
Print view View original

161–170 of 299 posts

Re: Netbird – Open Source Zero Trust Networking

#161

Post by j1elo »

Ingon wrote: post #131

I've been working for a while on https://github.com/connet-dev/connet . It gives a different twist at the same problem - instead of an overlay network at L4 (wireguard, etc) or publicly accessible endpoint at L7 (like ngrok) it "projects" a remote endpoint locally (e.g. as if you are running the service on your computer). Of course "locally" can always be a VPS that has caddy in front to give you ngrok-like experienc…

This is meant just for computers, right? A quick check of the readme showed that devices must run this or that commands, which seems difficult to do on an smartphone. I guess the ngrok-like setup would be the way to go for that case, given the increasing prevalence of phones and tablets as the single form of computing for lots of people

Re: Netbird – Open Source Zero Trust Networking

#162

Post by smashed »

PLG88 wrote: post #145
binnacle wrote: post #113

I tried migrating our organization from Twingate to self-hosted Netbird for cost savings but couldn't get it working reliably for 10-15% of users. The client failed intermittently with no clear pattern to troubleshoot. It became very frustrating for our end users. My advice: if you're considering self-hosted Netbird, set clear expectations that it's best-effort QoS, not enterprise-grade reliability. There's no such t…

Check out OpenZiti. Its open source, runs at prodution scale, and recently someone who used to work at Twingate said OpenZiti is many times more powerful than TG.

OpenZiti is promising but their desktop and mobile clients are very incomplete.

The feature set varies greatly between platforms.

If you are supporting a single platform (example desktop windows) it could work. Even better if you have the resources to write your own clients using the SDK, like it's meant to be.

Re: Netbird – Open Source Zero Trust Networking

#163

Post by xanthor »

markonen wrote: post #132
jscd wrote: post #123

Earlier quoted context omitted.

Tailscale itself only uses sqlite[1], so I’m not sure if that really holds in this case. [1]: https://tailscale.com/blog/database-for-2022

TIL! My problem with them requiring sqlite was that I assumed it would make a high availability setup either hard or impossible. Maybe that's not true, but definitely off the beaten path for headscale.

Headscale only supports a single control node.

Re: Netbird – Open Source Zero Trust Networking

#164

Post by mittermayr »

ErneX wrote: post #141
FazJaxton wrote: post #134

Earlier quoted context omitted.

Could you give a brief description of your use case? I'm looking at all the tailscale buzzwords on their site, but am not really understanding what I would use this for in my home setup

I have some servers sending their telegraf data to a server in my home using the tailnet instead of opening a port on my firewall for that, to name one use case. It has a pretty good ACL functionality, you can configure which hosts with certain tag can access certain routes.

yeah the amount of nodes I had on the public internet, when all I really needed was some internal connectivity (exactly like you have here, a machine sending logs to an internal-only loki instance, and then a grafana node that is also only internally relevant and never needs to see the public internet), etc.

Re: Netbird – Open Source Zero Trust Networking

#166

Post by PLG88 »

smashed wrote: post #162
PLG88 wrote: post #145

Earlier quoted context omitted.

Check out OpenZiti. Its open source, runs at prodution scale, and recently someone who used to work at Twingate said OpenZiti is many times more powerful than TG.

OpenZiti is promising but their desktop and mobile clients are very incomplete. The feature set varies greatly between platforms. If you are supporting a single platform (example desktop windows) it could work. Even better if you have the resources to write your own clients using the SDK, like it's meant to be.

How are the mobile and desktop clients incomplete?? Tunnelers exist for Windows, Android, iOS, Linux, MacOS, and more - https://netfoundry.io/docs/openziti/reference/tunnelers/....

Re: Netbird – Open Source Zero Trust Networking

#168

Post by Ingon »

j1elo wrote: post #161
Ingon wrote: post #131

I've been working for a while on https://github.com/connet-dev/connet . It gives a different twist at the same problem - instead of an overlay network at L4 (wireguard, etc) or publicly accessible endpoint at L7 (like ngrok) it "projects" a remote endpoint locally (e.g. as if you are running the service on your computer). Of course "locally" can always be a VPS that has caddy in front to give you ngrok-like experienc…

This is meant just for computers, right? A quick check of the readme showed that devices must run this or that commands, which seems difficult to do on an smartphone. I guess the ngrok-like setup would be the way to go for that case, given the increasing prevalence of phones and tablets as the single form of computing for lots of people

I've been thinking a lot about this case specifically. And you are right, phones are largely not supported right now - I've been researching how to make that happen. One case I've found that works for me currently is running connet via Termux - and I've made the necessary changes to support that.

Native iOS/Android clients, if possible, will probably be the next things I'll work on. At minimum they should enable you to run a "source" (e.g. a consumer of an exposed service), but ideally it will be the whole deal.

Re: Netbird – Open Source Zero Trust Networking

#169

Post by aborsy »

What is the issue with one Wireguard port open? You vpn to home LAN and everything is there.

The issue with these VPN companies is that they log data, you have to run an agent running as root, reliance on several other companies too like IdP, etc. Very large attack surface.

Re: Netbird – Open Source Zero Trust Networking

#170

Post by colordrops »

mittermayr wrote: post #47

I can only recommend giving headscale a try. It's free, works extremely well, and can be used with the official Tailscale clients. Was super easy to set up. https://headscale.net/stable/

Headscale mostly works pretty well but its pretty finicky to get set up in a way where the tailscale clients on linux and android aren't always complaining with warnings or having route or DNS issues. I'm considering investigating one of these non commericial solutions where the entire stack was built to work together.
Post reply on HN