Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Tailscale is pretty useful

blog.6nok.org

Post reply on HN
Print view View original

201–210 of 419 posts

Re: Tailscale is pretty useful

#201

Post by gabeio »

sureglymop wrote: post #178
gabeio wrote: post #155

Earlier quoted context omitted.

> Yeah, I don't understand how it is so prevalent in the self-hosted community. Not just CGNAT but not having _any_ external ports open can be a beautiful thing. I used to have an ssh port (not on the standard 22) and the amount of auth attempts back then was insane. I now have a full firewall zero open ports but, thanks to tailscale, I can still safely access my machines while not being at home with zero unauthorize…

If you're a security person, can you explain why a centralized key exchange server is needed at all? If you care about security you have to verify every nodes key anyway... Also, it seems their infrastructure runs on AWS, not exactly confidence inspiring from a censorship/privacy risk standpoint. I think tailscale also doesn't provide transient quantum resistance. Wireguard traffic can be made quantum resistant with…

> If you're a security person, can you explain why a centralized key exchange server is needed at all? If you care about security you have to verify every nodes key anyway...

I do verify every node’s key. That’s kind of the point of tailscale lock unless I am missing something.

> Also, it seems their infrastructure runs on AWS, not exactly confidence inspiring from a censorship/privacy risk standpoint.

I don’t understand what censorship has to do with a personal home network?

Privacy on the other hand, is fair. For my usecase this is a home network I am not that concerned that they know what devices talk to what devices. Yes they know my ip address but that’s not valuable since it’s all defended by the tailnet lock.

> I fail to see why one would use Tailscale over just wireguard other than for "convenience" reasons which are almost never good reasons if security and privacy also matter. Please correct me if I'm wrong with anything, I'm happy to learn. Direct access to my network being limited behind tailscale with a requirement to be part of my tailscale network signature satisfies my requirements for no one else’s access to my network at all. And only if I am away from home does any of my traffic pass through a relay.

Tailscale has more device support than any wireguard apps than I know of. I don’t believe wireguard has Apple TV support, but tailscale does.

I am not the only member of my family either, including them in this network with the simplicity of tailscale’s apps is also important.

Re: Tailscale is pretty useful

#202

Post by dharmab »

hattmall wrote: post #170
epscylonb wrote: post #152

Earlier quoted context omitted.

Agree that they are on to something. I gave a tech talk about them a while ago at work and said that I think they are on the cusp of providing a consumer VPN product that appeals to mainstream consumers. The Apple of VPNs, everything "just works" and is easy to understand.

Do mainstream consumers really need a VPN?

I had some of my family install Tailscale to access my tailnet. They can watch movies from my collection more easily than using Netflix, and we can share files through the client with a single click. I have other friends using it to play old-school dedicated server games without having to deal with CGNAT/hairpin NAT problems.

Re: Tailscale is pretty useful

#203

Post by devilbunny »

kdmtctl wrote: post #166
danudey wrote: post #120

Earlier quoted context omitted.

I was on a cruise ship a few weeks ago and realized that, instead of being throttled, a lot of sites were completely blocked. Very irritating. They also do DPI on the cruise ship network so that VPN clients like OpenVPN are blocked regardless of port. Without a laptop handy, I had to use my iPhone to set up a droplet running Ubuntu, then install vray onto it and configure it to run on port 443. vray uses "standard" S…

Wireguard is easy to block. Some VPN providers do implement an obfuscation layer for it, but Tailscale uses plain WG, so if WG is blocked, you will get no connection. Control plane would still work, though.

Intriguingly, my work network (both guest and employee networks) blocks OpenVPN, commercial VPN (Proton I use, plus a couple of others I tried just as an experiment), and Tailscale authentication, but if the device is already authenticated to the tailnet, it will continue to work. Turns out that work uses the same ISP my home does, so perhaps that's part of it, but I have another TS exit node running at my in-laws' house (so I can remotely maintain their network, and so I can get out to the Internet via TS even if my home is down), and they're in another state with a different ISP.

I haven't actually tried this when my home service is down, because it's basically never down, but I can easily switch exit nodes when they are both running without hitting the authentication servers again.

Re: Tailscale is pretty useful

#204

Post by [deleted] »

stego-tech wrote: post #140
HPsquared wrote: post #95

Earlier quoted context omitted.

If you can't trust service providers, you probably also can't trust software suppliers.

I mean, yes? It's why Zero Trust is growing as an operations model. Supply chain attacks, vendor hostility, zero days being hoarded by nations and bad actors for exploit, the list goes on. You emphatically cannot trust vendors, suppliers, users, software, systems, or governments. Ergo, your infrastructure should be built with an appropriate risk assessment in mind, and have proper safeguards in place where feasible.…

[deleted]

Re: Tailscale is pretty useful

#205

Post by deadbabe »

danudey wrote: post #120
Trumpi wrote: post #6

I was once in South Africa and needed to look up my prescriptions in the CVS app. I had lost my pills and needed to show a local pharmacist what I needed. CVS geoblocked me. Luckily I had a TailScale exit node running at home, which solved the problem.

I was on a cruise ship a few weeks ago and realized that, instead of being throttled, a lot of sites were completely blocked. Very irritating. They also do DPI on the cruise ship network so that VPN clients like OpenVPN are blocked regardless of port. Without a laptop handy, I had to use my iPhone to set up a droplet running Ubuntu, then install vray onto it and configure it to run on port 443. vray uses "standard" S…

Why not just use shadowsocks

Re: Tailscale is pretty useful

#206

Post by HumanOstrich »

stego-tech wrote: post #49
iamdamian wrote: post #38

I'm curious to hear well-informed reasons from this crowd for why we can trust Tailscale given the non-self-hosted part of the architecture? Does it come down to Tailnet locks [1], not worrying that Tailscale will be compromised, not worrying that your home network is worth compromising, or something else? [1]: https://tailscale.com/kb/1226/tailnet-lock

Call me Cappy Paranoid, but I fall into the camp of "You should never trust a service provider, ever ," and build infrastructure accordingly; I believe this falls into an extreme interpretation of "zero trust". So while also implementing Tailnet locks and other security measures to constrict traffic flow, I'd also consider going a step further by only permitting server or resource access based on client certificate v…

> Call me Cappy Paranoid, but I fall into the camp of "You should never trust a service provider, ever," and build infrastructure accordingly; I believe this falls into an extreme interpretation of "zero trust".

That's not what Zero Trust means, at all.

Re: Tailscale is pretty useful

#207

Post by metadat »

deuschelandian wrote: post #187
gabeio wrote: post #163

Earlier quoted context omitted.

> OpenVPN server on your router. Honestly I would suggest wireguard on your router before openvpn.

That’s all Tailscale is really.

Tailscale even supports OPNSense routers (BSD-based):

https://tailscale.com/kb/1097/install-opnsense

I'm not sure about the performance yet, however.

Re: Tailscale is pretty useful

#208

Post by CharlesW »

amlib wrote: post #197
CharlesW wrote: post #92

Networking SmartFriends: Is port forwarding intrinsically a bad idea (as compared to using Tailscale Funnel) from a security perspective if I want to expose, say, a Plex server running on my NAS to the outside world?

The main question is weather you want to share something like a Plex server with other people and force/convince them to essentially install a VPN to do so (which usually mean other VPNs are out of the game. You can't, for example, have Tailscale work alongside an adblock VPN in Android). To me thats a deal breaker and quite a burden to the people who want to access it. You are better off putting all those services b…

All good points, thank you! I was considering Tailscale Funnel (which is like Cloudflare Tunnel) and doesn’t require Tailscale on the client side. https://tailscale.com/blog/introducing-tailscale-funnel

Re: Tailscale is pretty useful

#209

Post by devilbunny »

elevation wrote: post #111

Tailscale is becoming less useful as network providers become hostile to it. Last week I noticed McDonalds guest wifi is blocking new connections over the tailscale control ports. It will pass wireguard mesh traffic for established sessions, but their firewall rules prevent you from establishing new ones.

So connect over cellular or personal hotspot, then connect to WiFi to avoid burning your data. This is definitely becoming more common.

I discovered the workaround purely by accident, when I took my laptop to work (which is unusual, it's a personal device not used for work but I needed to do some work on files that were on it). It was logged into my Tailscale when I last turned it on at the house and I discovered that it reconnected fine as long as it didn't have to do the authentication over the work network.

Re: Tailscale is pretty useful

#210

Post by hamandcheese »

stego-tech wrote: post #49
iamdamian wrote: post #38

I'm curious to hear well-informed reasons from this crowd for why we can trust Tailscale given the non-self-hosted part of the architecture? Does it come down to Tailnet locks [1], not worrying that Tailscale will be compromised, not worrying that your home network is worth compromising, or something else? [1]: https://tailscale.com/kb/1226/tailnet-lock

Call me Cappy Paranoid, but I fall into the camp of "You should never trust a service provider, ever ," and build infrastructure accordingly; I believe this falls into an extreme interpretation of "zero trust". So while also implementing Tailnet locks and other security measures to constrict traffic flow, I'd also consider going a step further by only permitting server or resource access based on client certificate v…

> I'd also consider going a step further by only permitting server or resource access based on client certificate validation

This is where I'm the most curious on what Tailscale will do next. So far all their products seem to contrast at the IP level, but for enterprise use cases there's a real need for application level protections as well. Cloudflare Access is a great example of what I mean.

Post reply on HN