Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Netbird – Open Source Zero Trust Networking

netbird.io

Post reply on HN
Print view View original

181–190 of 299 posts

Re: Netbird – Open Source Zero Trust Networking

#181

Post by smashed »

PLG88 wrote: post #179
smashed wrote: post #175

Earlier quoted context omitted.

We evaluated it last August/Sept. From memory: oAuth login flow (browser based) was only supported on the windows client. For a Zero trust solution, having the only auth truly supported be a permanent JWT/Cert on the machine is doing device authentication, not user authentication, thus completely failing your primary objective. UX was overall atrocious. Our users could not comprehend it at all. It was deemed that a c…

Ahh, I see, thanks for clarifying. That was correct, now any OIDC-compatible identity provider (Auth0, Okta, Azure/Microsoft Entra, Google, Keycloak, etc.) is supported on all the tunnelers to my knowledge. Lots of work continues to go into the UX, but I would note that we focus most of the UI/UX work into NetFoundry, our commercial product.

That is good news!

The problems we had is users could not reliably tell when they were connected/disconnected, how to initiate the login flow, get network status (why is that service not working, but this other one is?), tell to which router they were connected, etc etc. I know these are big asks, and I suspect a lot of these troubleshooting and status info are probably available in the commercial offering.

That being said I think OpenZiti/NetFoundry is in a different class entirely and any lurkers here should consider it for their use. It's not really the same thing as NetBird or Tailscale.

Re: Netbird – Open Source Zero Trust Networking

#182

Post by braginini »

usagisushi wrote: post #100
m_santos wrote: post #71

Earlier quoted context omitted.

Thanks for your feedback. I have a question: What do you think about the number of containers in our quick start deployment? Was that a concern?

You’re from the dev team, right? Thanks for the amazing OSS! Regarding the containers, AFAIK it's 5 for the core setup (dashboard/signal/management/relay/coturn) plus Traefik in my case. It feels like a bit much, but the services are almost stateless and not resource intensive even on my little VPS. The setup script (bash + envsubst) is so straightforward and thanks to good documentation, I’ve never found the setup c…

Your usage is the best form of sponsorship haha

Re: Netbird – Open Source Zero Trust Networking

#183

Post by braginini »

usagisushi wrote: post #100
m_santos wrote: post #71

Earlier quoted context omitted.

Thanks for your feedback. I have a question: What do you think about the number of containers in our quick start deployment? Was that a concern?

You’re from the dev team, right? Thanks for the amazing OSS! Regarding the containers, AFAIK it's 5 for the core setup (dashboard/signal/management/relay/coturn) plus Traefik in my case. It feels like a bit much, but the services are almost stateless and not resource intensive even on my little VPS. The setup script (bash + envsubst) is so straightforward and thanks to good documentation, I’ve never found the setup c…

Coturn is not needed in the new versions as STUN is embedded in the relay service now

Re: Netbird – Open Source Zero Trust Networking

#184

Post by PLG88 »

smashed wrote: post #181
PLG88 wrote: post #179

Earlier quoted context omitted.

Ahh, I see, thanks for clarifying. That was correct, now any OIDC-compatible identity provider (Auth0, Okta, Azure/Microsoft Entra, Google, Keycloak, etc.) is supported on all the tunnelers to my knowledge. Lots of work continues to go into the UX, but I would note that we focus most of the UI/UX work into NetFoundry, our commercial product.

That is good news! The problems we had is users could not reliably tell when they were connected/disconnected, how to initiate the login flow, get network status (why is that service not working, but this other one is?), tell to which router they were connected, etc etc. I know these are big asks, and I suspect a lot of these troubleshooting and status info are probably available in the commercial offering. That bein…

Yeah, definitely more on the commercial side of the product.

And agreed, I like NetBird/Tailscale/Wireguard, but they are better VPNs, not identity-first, zero trust overlays as OpenZiti/NetFoundry is. That's why companies like Siemens have adopted it and many more will.

Re: Netbird – Open Source Zero Trust Networking

#189

Post by blue_pants »

aaronds wrote: post #36

A bit lower level than most things discussed here but on the topic of overlay networks, I’ve used nebula for years and can recommend it https://github.com/slackhq/nebula

What about DNS integration? As far as I know, you can't resolve nodes by name (http://media-server), you have to use node's internal IP.

Re: Netbird – Open Source Zero Trust Networking

#190

Post by dwedge »

markonen wrote: post #132
jscd wrote: post #123

Earlier quoted context omitted.

Tailscale itself only uses sqlite[1], so I’m not sure if that really holds in this case. [1]: https://tailscale.com/blog/database-for-2022

TIL! My problem with them requiring sqlite was that I assumed it would make a high availability setup either hard or impossible. Maybe that's not true, but definitely off the beaten path for headscale.

I suppose there's always the old fashioned way of using drbd with heartbeat
Post reply on HN