Live data from Hacker News

Tailscale is pretty useful

blog.6nok.org

221–230 of 419 posts

Re: Tailscale is pretty useful

#221
I like tailscale as a replacement for the dogshit enterprise VPNs I have had to use in the past (looking at you, ZScaler). But for personal/single home use it’s overkill.

I used to run a WireGuard server on a raspberry pi with ddns to update dns record on an as needed basis.

Eventually replaced it with my gateways built in WireGuard server which also has ddns enabled

The use cases described by the author are taken care of with a simple wg server. Sure you don’t get the distributed peer network of tailscale but I can live without that.

Re: Tailscale is pretty useful

#223
Tailscale is great but one thing i dont like about it is that i cannot re-use ip addresses. This feature is offered by ZeroTier it can be very useful if for some reason you have to format and re-install os and everything.. Unfortunately, i cannot use zerotier because the speed i get over it is terrible

Re: Tailscale is pretty useful

#224

Earlier quoted context omitted.

> What Tailscale doesn't solve is access to the data that web app serves if the user's machine is compromised, as tailscale is just determining "can the user hit the webserver on port 443?" and does nothing to evaluate the state of the user's host. Tailscale has some cybersecurity integrations to configure access depending on the device posture. For example, blocking access to a webserver if the device is out of date…

I don't think most users use those integrations, they're mostly just a feature bullet point.

SO those features are unusable?

Re: Tailscale is pretty useful

#226
post #217

I don’t understand why one would use Tailscale over WireGuard. Is it because it’s easier to setup sort of like how Dropbox was? I’m primarily wary of the rug being pulled out and Tailscale suddenly costing me a lot of money whereas my WireGuard setup seems more stable in the long term. Or is there more to it that I’m missing?

Wireguard is not an alternative to Tailscale, any more than FTP is an alternative to Dropbox. And not just because Tailscale actually uses Wireguard under the hood. Also if your comment is a sarcastic callback to the "why don't you just use FTP" comments when Dropbox came out, well done.

Wireguard is a great VPN protocol, but what the basic protocol doesn't do is make it transparently easy to use in a wide variety of edge cases without having to reconfigure anything. If all I want is two devices to be able to talk to each other, at least one of which is in a fixed location where I have total control over the network, then yeah, raw Wireguard is probably a decent solution. If I want to do anything else, I need a management layer on top of Wireguard, and Tailscale is by far the best solution for that out there.

As a thought exercise, consider a home network where a laptop connects to a NAS to store media files. I take the laptop to some random destination and connect it to hotel WiFi, while someone else takes the NAS to a totally different hotel and connects it to the WiFi. With Tailscale, the laptop can immediately directly access the NAS without even having to change the mount point. Think about what it would take to set up similar functionality with raw Wireguard. I'm not saying this is a common scenario, or that you can't do the same thing manually. But the fact that such a setup would just work is pretty impressive.

Re: Tailscale is pretty useful

#227
post #37

Earlier quoted context omitted.

What other VPNs do mesh networking? I only know of zerotier (proprietary) and nebula (FOSS except that the Android app is proprietary)

Shameless plug, but some of the Nebula team (including myself) works on https://www.defined.net/ (proprietary managed Nebula networks.) Also, ZeroTier is "open-source ish." They use the BSL license for most of their code ( https://www.zerotier.com/blog/on-the-gpl-to-bsl-transition/ ) and I believe you can self-host ( https://docs.zerotier.com/selfhost/ )

I've tried Nebula before, admittedly a while ago, and it seemed interesting, but much less user friendly than Tailscale. But one of these days I would like to play around with defined.net just to see what other options are out there.

I also tried ZeroTier and was extremely unimpressed, although again that was a few years ago. The performance on single threaded systems was absolutely terrible, which suggests some deeply broken code and made it unusable with a cheap VPS. The paceof development was also pretty slow and the insistence on homebrew crypto was also not confidence inspiring compared to something that used a proven solution like Wireguard.

Re: Tailscale is pretty useful

#228
I previously used WireGuard and for a bit tried just having an SSH tunnel with autossh, but in the end just settled on using Tailscale, because it doesn’t ask me to manually manage the keys and also doesn’t drop around every 30 minutes for a bit and doesn’t need weird hacks to expose ports for my Docked network traffic.

That said, what messed with me greatly was the fact that Tailscale seems to have an MTU of 1280 whereas Docker by default had 1500 which lead to inexplicably dropped overlay traffic with nonsensical log messages in my reverse proxy web server.

Basically, I had to delete docker_gwbridge and recreate it with some specific options: https://docs.docker.com/engine/swarm/networking/#customize-t...

It was quite the mess. I have no idea why Docker couldn’t just figure out that it needs the smaller MTU by itself, cause it listens for the Swarm on an interface that’s related to Tailscale and it can see what MTU that has.

Still, Tailscale in of itself is pretty nice.

Re: Tailscale is pretty useful

#229
post #39
post #24

Earlier quoted context omitted.

Other replies explained the why, though cgnat wouldn’t be a problem if you also had ipv6. Luckily for me I have a regular ip4 address but if that ever changed I’d be out of luck unless my isp (quantum fibre) implemented a proper ipv6 solution.

I have Quantum Fiber in Colorado and enabled IPv6 on the old CenturyLink C4000XG modem following these directions: https://www.centurylink.com/home/help/internet/modems-and-ro...

That uses 6rd which is typically slow (since it basically proxies through an ipv4->6 bridge), and in my case it worked on their provided router but not with opnsense.

Re: Tailscale is pretty useful

#230
Been using it since the early days and it has become a core tool in my arsenal. Tailscale along with 5G and RDP or Parsec means I have access to my powerful home server and primary dev machine no matter where I am. Can even access it on my iPhone (only RDP).
Post reply on HN