Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Netbird – Open Source Zero Trust Networking

netbird.io

Post reply on HN
Print view View original

231–240 of 299 posts

Re: Netbird – Open Source Zero Trust Networking

#231

Post by SebastianKra »

smashed wrote: post #156
regisso wrote: post #64

I recommend it the NetBird team is transparent and easy to reach. I switched from Tailscale a while ago (2y), went fully self-hosted, and upgrades across versions have been smooth, which tells me they care about the self-hosted, not just their cloud offering.

We tried netbird but could not get the client to register to a self hosted server. It ignored the setting or failed. Good chance it was user error on our part. Most of their documentation is very unclear about what is a cloud offering feature and what is possible using self-hosting. There are features not available on the community edition and you have to be very careful reading their doc. Just putting it out there s…

We also had a bunch of problems. The DNS resolution didn't work, and support was unable to figure out the reason.

A coworker reported domain access breaking when he went to office 1, but fixed itself when he went to office 2.

For a while, when you logged in with the wrong account, it was near impossible to replace it. This on is fixed now, but the entire thing still feels very much like paying for beta software.

Re: Netbird – Open Source Zero Trust Networking

#232

Post by ptx »

newzino wrote: post #167

[flagged]

> the strict BeyondCorp definition

The NetBird docs [1] talk about "Zero Trust" being defined by NIST SP 800-207 and NIST SP 1800-35. This is also one of the definitions Wikipedia describes, with only one (uncited) mention of BeyondCorp.

Anyway, I still have no idea how this stuff is supposed to be "zero trust". It seems to place almost complete trust in the external authentication provider and also in the agent software that's rummaging around on all the clients while, as Wikipedia puts it, "checking the identity and integrity of users" (perhaps by examining the purity of the their precious bodily fluids).

[1] https://docs.netbird.io/use-cases/implement-zero-trust

Re: Netbird – Open Source Zero Trust Networking

#233

Post by redeeman »

hamandcheese wrote: post #206
xyst wrote: post #174

Earlier quoted context omitted.

headscale is an awesome project. And I love tailscale as a product. But this is where netbird beats tailscale: coordinator server open sourced out/self hosted out the gate. Headscale is currently maintained by a few tailscale employees on their spare time. Currently, Tailscale allows this to happen but clearly there’s some internal management of what gets downstreamed to headscale. What I don’t like about headscale i…

> What I don’t like about headscale is that you can only host a single coordinator server as well. If I need to do maintenance on the server, it means an impact to the tailnet. It’s rare but annoying. Any p2p connections should keep working for some time even if the coordinator goes down... right?

can confirm that connections do not die while taking the coordinator down during update (not long time, but still)

Re: Netbird – Open Source Zero Trust Networking

#234

Post by redeeman »

smashed wrote: post #152
PLG88 wrote: post #143

I like Netbird, its a better VPN, but its not zero trust networking. Zero Trust requires identity to create connectivity itself—per service, per session—rather than granting network reachability and constraining it with routes and rules. I have had this conversation on Reddit many times... curious if anyone agrees/disagrees.

I think the desktop client can authenticate to an IdP by opening a browser window and doing a login flow. If the user is forced to authenticate to start the VPN session, would that make it zero trust? I think once the VPN is on, it's on, and the remote service cannot get identity info from the network layer. Seems like what you want to achieve can only be built on the application layer?

it should have support for signing of the configuration that is sent out to all nodes by a key the administrator controls, and which is then whitelisted on all nodes by oneself. That way the central node is just a simple data provider/helper.

right now you are screwed if someone compromises your coordinator

Re: Netbird – Open Source Zero Trust Networking

#236

Post by Ingon »

mirashii wrote: post #224
Ingon wrote: post #131

I've been working for a while on https://github.com/connet-dev/connet . It gives a different twist at the same problem - instead of an overlay network at L4 (wireguard, etc) or publicly accessible endpoint at L7 (like ngrok) it "projects" a remote endpoint locally (e.g. as if you are running the service on your computer). Of course "locally" can always be a VPS that has caddy in front to give you ngrok-like experienc…

A neat idea, but projecting all of these services onto localhost is a bit of a security nightmare. Have you considered looking at what something like Twingate does? Using the CGNAT IP space for the projection allows you to give every individual service its own IP address, which helps quite a bit in terms of allowing you to isolate the services from e.g. malicious web pages.

I'll take a look at what twingate does for sure, thanks for pointing that out.

A few things that worth mentioning for connet's current state - you can technically bind to any local IP, not just loopback (or listen to them all). You also have the option of directly running a TLS/HTTPS destination (for mutual TLS directly to the service) or source (e.g. for mutual authentication between your local listener and the outside world). Another option is to build your own client and define how you want to source traffic - maybe its part of your app and there are no sockets or anything - you just connect and start talking.

Re: Netbird – Open Source Zero Trust Networking

#237

Post by esseph »

PLG88 wrote: post #228
tjoff wrote: post #218

Earlier quoted context omitted.

How does that make it not "truly open source"? I made a shell script that does most of that for my needs.

Fair, I was being loose with my language. What I should have said is that it does not come fully featured open source, that you need to do a certain amount of rolling your own.

The same could be said for a webserver, a radius server, etc. I mean ssh "requires" a network to be remotely useful :)

Edit, since I can't reply sadly:

You're right, that was a bad example.

I can probably list at least a few dozen things that all require certificates though, which was really my point. Everything has dependencies.

Also if you just... Don't trust big tech, run your own CA.

Re: Netbird – Open Source Zero Trust Networking

#238

Post by ysleepy »

cpach wrote: post #160
c0balt wrote: post #87

Earlier quoted context omitted.

Nebula does not require O(n) config changes for adding a node. O(n) is only required for: - active revocation of a certificate (requires adding the CA fingerprint to the config file) - adding/removing a lighthouses (hub for publishing IPs for p2p) or relay (for going over p2p) - CA rotation

AFAICT you and 'ysleepy are in agreement.

We are, wireguard needs O(N) updates to add a node to every other node.

Re: Netbird – Open Source Zero Trust Networking

#239

Post by PLG88 »

esseph wrote: post #237
PLG88 wrote: post #228

Earlier quoted context omitted.

Fair, I was being loose with my language. What I should have said is that it does not come fully featured open source, that you need to do a certain amount of rolling your own.

The same could be said for a webserver, a radius server, etc. I mean ssh "requires" a network to be remotely useful :) Edit, since I can't reply sadly: You're right, that was a bad example. I can probably list at least a few dozen things that all require certificates though, which was really my point. Everything has dependencies. Also if you just... Don't trust big tech, run your own CA.

nah, I dont buy that. A network is not a functional requirement of SSH etc in your use case.

Re: Netbird – Open Source Zero Trust Networking

#240

Post by nine_k »

blue_pants wrote: post #217
bink wrote: post #216

Earlier quoted context omitted.

Nebula uses lighthouses instead of DNS for finding other nodes. https://github.com/slackhq/nebula?tab=readme-ov-file#2-optio...

Yes, but when you connect your phone to a Nebula network, and go to http://media-server in your browser, the DNS won't resolve it to your desired node, because the phone client (same on desktop) didn't update DNS of the phone, so you'll have to use node's IP address. That's what I've read (when evaluating Nebula), at least.

When your nodes are not very numerous, and their IPs are statically assigned, you can just have them in a hosts file, or even served by your normal name server if you're using a split-horizon configuration.
Post reply on HN