This should just be called "why VPNs are useful", i think?
Tailscale is pretty useful
171–180 of 419 posts
Re: Tailscale is pretty useful
#172Networking SmartFriends: Is port forwarding intrinsically a bad idea (as compared to using Tailscale Funnel) from a security perspective if I want to expose, say, a Plex server running on my NAS to the outside world?
The Funnel won't add secure activity to what happens inside the connection itself.
Re: Tailscale is pretty useful
#173Tailscale is becoming less useful as network providers become hostile to it. Last week I noticed McDonalds guest wifi is blocking new connections over the tailscale control ports. It will pass wireguard mesh traffic for established sessions, but their firewall rules prevent you from establishing new ones.
It was for that reason OpenVPN set up in SSL mode over TCP 443 was king, a few years ago most firewalls could not distinguish it from regular TLS encrypted web traffic. These days with application layer "next gen" firewalls though, a zealous network administrator can distinguish between the two and block just the VPN connection if they so choose.
Chinese V2Ray derivatives are indistinguishable from regular traffic and still penetrate the GFW but get detected when used for domestic services, which is not advised. Work best for short lived sessions in restrictive environments.
Re: Tailscale is pretty useful
#174In other words (they do get to this point right away), port forwarding is pretty useful, and most of us don't have it anymore. I'm sick and tired of the way ISPs treat us. It's literally written into my lease what company I will pay for internet, and how much I will pay them. It is not , however, written in my lease how fast the connection will be . Not only am I unable to forward ports, I can't even change my own Wi…
The number of users who even understand why they might want to do that aren't a consideration when they build such a service/agreement. It's only considering what the average tenant is looking for, which is more akin to "water comes out of the pipes when I move in" than "do I get to mess with the plumbing?".
Re: Tailscale is pretty useful
#175I'm curious to hear well-informed reasons from this crowd for why we can trust Tailscale given the non-self-hosted part of the architecture? Does it come down to Tailnet locks [1], not worrying that Tailscale will be compromised, not worrying that your home network is worth compromising, or something else? [1]: https://tailscale.com/kb/1226/tailnet-lock
I still find SSH adequate for connecting to a home server remotely. I don't have the CGNAT terrible problem but I also don't do any port forwarding on my home router.
Instead, I have a VM running on a cloud provider that I SSH to from an OpenBSD box inside my home network. The SSH connection establishes a reverse SSH tunnel. This opens a port on the cloud VM to tunnel to my OpenBSD sshd port.
With the reverse proxy to my home OpenBSD box established, I can use the SSH jump box option, -J. I connect to the cloud VM and "jump" through the tunnel to the OpenBSD box at home. You can even specify multiple jumps if I need to connect to another machine in my home.
I can also set up a local tunnel through that jump for things like connecting to my Home Assistant server from my remote laptop or phone.
I only have to trust my cloud provider.
Re: Tailscale is pretty useful
#176I tried using tailscale to share my hdhomerun prime tuners over the internet, but sadly, it doesn't seem to work due to Tailscale's lack of support for mDNS lookups[0][1]. You can't just forward the port b/c the hdhr device packets have a ttl of 1 hop (and, while you could change the ttl through iptables, that seems like a lot of trouble).
I can open a stream manually through http://192.168.1.189:5004/auto/v600 while connected to tailscale (w/ my apple tv in-home as an exit node) on my laptop outside of the house, but when I open the HDHR/Channels apps, they can't detect the HDHR tuner itself.
Apparently this "just works" with openvpn, so I've been thinking about just switching back to that.
[0]: https://github.com/tailscale/tailscale/issues/1013
[1]: https://old.reddit.com/r/HDHR/comments/z8byns/watching_remot...
Re: Tailscale is pretty useful
#177Earlier quoted context omitted.
Call me Cappy Paranoid, but I fall into the camp of "You should never trust a service provider, ever ," and build infrastructure accordingly; I believe this falls into an extreme interpretation of "zero trust". So while also implementing Tailnet locks and other security measures to constrict traffic flow, I'd also consider going a step further by only permitting server or resource access based on client certificate v…
If you can't trust service providers, you probably also can't trust software suppliers.
Not the same. In particular you don’t need to accept software updates from software suppliers and you can also require source code or use open source.
This stuff was obvious and standard in the 80s-2000s. It’s only in the last 15-20 years that it became acceptable to get updates shoved down your throat.
Service providers can cut off your access any day.
Software providers cannot unless you’ve given them a live update channel direct to your env.
Re: Tailscale is pretty useful
#178Earlier quoted context omitted.
Yeah, I don't understand how it is so prevalent in the self-hosted community. I would never install this on my server, just use wireguard/openvpn ... edit: okay, CGNAT
> Yeah, I don't understand how it is so prevalent in the self-hosted community. Not just CGNAT but not having _any_ external ports open can be a beautiful thing. I used to have an ssh port (not on the standard 22) and the amount of auth attempts back then was insane. I now have a full firewall zero open ports but, thanks to tailscale, I can still safely access my machines while not being at home with zero unauthorize…
If you're a security person, can you explain why a centralized key exchange server is needed at all? If you care about security you have to verify every nodes key anyway...
Also, it seems their infrastructure runs on AWS, not exactly confidence inspiring from a censorship/privacy risk standpoint.
I think tailscale also doesn't provide transient quantum resistance. Wireguard traffic can be made quantum resistant with a PSK. I fail to see why one would use Tailscale over just wireguard other than for "convenience" reasons which are almost never good reasons if security and privacy also matter. Please correct me if I'm wrong with anything, I'm happy to learn.
Re: Tailscale is pretty useful
#179Earlier quoted context omitted.
Agree that they are on to something. I gave a tech talk about them a while ago at work and said that I think they are on the cusp of providing a consumer VPN product that appeals to mainstream consumers. The Apple of VPNs, everything "just works" and is easy to understand.
Do mainstream consumers really need a VPN?
Tailscale isn’t really a VPN, it’s an OSI layer 5 for the TCP/IP world. It makes connectivity as easy as 90s LAN parties were.
I use Tailscale - so I can do remote tech support on my 81 year old mother’s computer
- So I can remote in to my desktop from anywhere with my mobile phone or iPad or Vision Pro or Steam Deck if I need a file or need to print something
- watching streaming media from my home network when I’m travelling (and avoiding VPN blocks because my home computer isn’t on a known VPN network)
And the best part is none of this required almost any configuration beyond (a) installing the software, (b) checking the “allow exit node” box on my home computer, (c) sharing my mom’s computer onto my tailnet.
It really is just useful with minimal fuss.
Re: Tailscale is pretty useful
#180We’re using Tailscale for our internal network, and it’s amazing. We’re a team distributed across multiple countries, and with Tailscale, it’s like we’re sitting in a single office, connected to the same router. And on top of that, we get centrally managed ACLs for everyone, TLS certificates, and SSO with Microsoft accounts. Amazing stuff! My main gripe, though, is DNS. It’s great to be able to reach prod-db-1, prod-…
I don't get it. `db` should resolve to all host ips? Wouldnt a load balancer make more sense in that scenario?