Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Tailscale is pretty useful

blog.6nok.org

Post reply on HN
Print view View original

211–220 of 419 posts

Re: Tailscale is pretty useful

#211

Post by tsujamin »

xlii wrote: post #71
tsujamin wrote: post #35

The tailscale.com/tsnet package in Go [1] is really useful if you've not looked at it before: you can make single binary HTTP or whatever servers that are only exposed inside your tailnet. Their golink project [2] is a good example (and useful itself), but I've used it to build "peer to peer" comms for one application, and to host an API and Svelte SPA to control some other things in a tailnet. [1] https://pkg.go.dev…

How difficult it is to use? Right now I’m working on orchestrating dev-local service clusters here I bind plenty of hosts to mimick real world. I’m using proxy tunneling to punch in but I’d love to have Tailscale endpoint which I could use to connect external devices (like mobile clients or non-technical stakeholders for show and tell).

It’s pretty simple, I’ve not updated my package version in a while but iirc you give it a state directory, an auth key, and you get a Dial-like interface you can use with the stdlib http libraries

Re: Tailscale is pretty useful

#212

Post by gz5 »

apitman wrote: post #138

Tailscale is one of my favorite companies. They're clearly on to something. Here's a great post by their CTO explaining a lot of the motivation and vision behind it: https://crawshaw.io/blog/remembering-the-lan IMO the main outstanding questions/concerns are: * Is the VPN model really the way to go? If someone gets their hands on one of your Tailscale nodes, they can access every service on your tailnet, which are li…

I think you nailed it. TS is great but is in a middle ground niche with more targeted alternatives squeezing it from both sides:

1. If you actually need strong security, you are likely to go with open source zero trust or their commercial versions.

2. If you don't need strong security, you will often view VPN an insurance policy (TS simplifies but is still more difficult than 'do nothing').

So you end up with a relatively narrow band of 'use cases' like NAT traversal; semi-privacy; access to private IP hosted services. Enough to sustain a venture funded company?

Re: Tailscale is pretty useful

#213

Post by tsujamin »

gabeio wrote: post #160
tsujamin wrote: post #35

The tailscale.com/tsnet package in Go [1] is really useful if you've not looked at it before: you can make single binary HTTP or whatever servers that are only exposed inside your tailnet. Their golink project [2] is a good example (and useful itself), but I've used it to build "peer to peer" comms for one application, and to host an API and Svelte SPA to control some other things in a tailnet. [1] https://pkg.go.dev…

You don't actually need tsnet for that. tailscale cli itself running the subcommand serve will allow you to share a specific port on your machine either with your tailnet or use funnel and share it out to the internet. I pulled tsnet out of my go application and switched entirely to `tailscale serve` and just use the header that adds to auth my family into apps I write. I love it.

funnel and serve are also awesome, but in this case the use case necessitated a single binary that worked without the full package installed/didn’t touch the routing table or tun device

Re: Tailscale is pretty useful

#214

Post by nl »

danudey wrote: post #120
Trumpi wrote: post #6

I was once in South Africa and needed to look up my prescriptions in the CVS app. I had lost my pills and needed to show a local pharmacist what I needed. CVS geoblocked me. Luckily I had a TailScale exit node running at home, which solved the problem.

I was on a cruise ship a few weeks ago and realized that, instead of being throttled, a lot of sites were completely blocked. Very irritating. They also do DPI on the cruise ship network so that VPN clients like OpenVPN are blocked regardless of port. Without a laptop handy, I had to use my iPhone to set up a droplet running Ubuntu, then install vray onto it and configure it to run on port 443. vray uses "standard" S…

I've run a SSH server on port 443 to bypass blocking before. Probably wouldn't work if they are _actually_ doing DPI, but a surprising number of networks don't - just have blocklists and only support port 80 and 443 access.

Re: Tailscale is pretty useful

#215

Post by tsujamin »

b_fiive wrote: post #93
tsujamin wrote: post #35

The tailscale.com/tsnet package in Go [1] is really useful if you've not looked at it before: you can make single binary HTTP or whatever servers that are only exposed inside your tailnet. Their golink project [2] is a good example (and useful itself), but I've used it to build "peer to peer" comms for one application, and to host an API and Svelte SPA to control some other things in a tailnet. [1] https://pkg.go.dev…

If you're a rust fan we make a similar library, that's all-in on "p2p-QUIC", with pre-baked protocols to import on top: https://github.com/n0-computer/iroh

That’s super cool, I was going to say “nat punching and public relays are a requirement for me” but you already do that! Definitely filing this away for future projects.

Re: Tailscale is pretty useful

#216

Post by devilbunny »

thomastjeffery wrote: post #40

In other words (they do get to this point right away), port forwarding is pretty useful, and most of us don't have it anymore. I'm sick and tired of the way ISPs treat us. It's literally written into my lease what company I will pay for internet, and how much I will pay them. It is not , however, written in my lease how fast the connection will be . Not only am I unable to forward ports, I can't even change my own Wi…

> Not only am I unable to forward ports, I can't even change my own WiFi password!

You can't BYOD? I got a lot of info out of the install techs when my home fiber was installed, including the router password, because they saw my setup and said "whoa... this is not a normal person setup". I said no, it isn't, you want me to walk you through what I've got? They did.

I ended up putting their device to DMZ all traffic to my device and turning off its radios (I have multiple AP's with wired backend). Technically double NAT, but in the first step all ports were forwarded, so it didn't affect anything. It took me a while to have a weekend where my wife was gone and I could risk breaking things for a few hours, but after that I was able to remove their device entirely. Turns out it uses a VLAN on the outgoing connection, so I had to figure out how to set that up on my router.

Re: Tailscale is pretty useful

#217

Post by sotix »

I don’t understand why one would use Tailscale over WireGuard. Is it because it’s easier to setup sort of like how Dropbox was? I’m primarily wary of the rug being pulled out and Tailscale suddenly costing me a lot of money whereas my WireGuard setup seems more stable in the long term.

Or is there more to it that I’m missing?

Re: Tailscale is pretty useful

#218

Post by 2OEH8eoCRo0 »

sotix wrote: post #217

I don’t understand why one would use Tailscale over WireGuard. Is it because it’s easier to setup sort of like how Dropbox was? I’m primarily wary of the rug being pulled out and Tailscale suddenly costing me a lot of money whereas my WireGuard setup seems more stable in the long term. Or is there more to it that I’m missing?

Tailscale uses wireguard

Re: Tailscale is pretty useful

#219

Post by christina97 »

sotix wrote: post #217

I don’t understand why one would use Tailscale over WireGuard. Is it because it’s easier to setup sort of like how Dropbox was? I’m primarily wary of the rug being pulled out and Tailscale suddenly costing me a lot of money whereas my WireGuard setup seems more stable in the long term. Or is there more to it that I’m missing?

Yes: much easier to set up. It also provides a backup relay node system in case it can’t establish direct connection between your devices.

When you set up wireguard you have to update every system’s config to add a new device, Tailscale does this for you. That’s the key thing.

Re: Tailscale is pretty useful

#220

Post by gabeio »

tsujamin wrote: post #213
gabeio wrote: post #160

Earlier quoted context omitted.

You don't actually need tsnet for that. tailscale cli itself running the subcommand serve will allow you to share a specific port on your machine either with your tailnet or use funnel and share it out to the internet. I pulled tsnet out of my go application and switched entirely to `tailscale serve` and just use the header that adds to auth my family into apps I write. I love it.

funnel and serve are also awesome, but in this case the use case necessitated a single binary that worked without the full package installed/didn’t touch the routing table or tun device

Ah if you truly need a single binary, yes it is nice.

I had some issues with builds every once in a while, which is another reason I switched to using tailscale serve instead.

Post reply on HN