Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Tailscale is pretty useful

blog.6nok.org

Post reply on HN
Print view View original

251–260 of 419 posts

Re: Tailscale is pretty useful

#251

Post by aborsy »

selfhoster wrote: post #238
codetrotter wrote: post #104

Earlier quoted context omitted.

> Is that a gigantic PITA to implement? Oh heck, you betcha it is I use my own self-hosted Wireguard VPN server. I agree with a lot of what you were saying about client certificates etc. And I plan to eventually do that sort of thing on some of my services in my own Wireguard VPN too. But in terms of Tailscale, if you are going to set up all kinds of client certificate things that will take a lot of time and effort,…

> Unless like OP your ISP has put CGNAT on you. I run Wireguard on a VPS and route public traffic with it over Wireguard to my home machine. Are you saying my ISP must not be CGNAT or else it wouldn't work?

How is this a good solution, when traffic is decrypted in the cloud, all traffic goes through one node, there is no ACL, key distribution, static IP, …?

Tailscale addressed those issues.

Re: Tailscale is pretty useful

#252

Post by VikingCoder »

apitman wrote: post #138

Tailscale is one of my favorite companies. They're clearly on to something. Here's a great post by their CTO explaining a lot of the motivation and vision behind it: https://crawshaw.io/blog/remembering-the-lan IMO the main outstanding questions/concerns are: * Is the VPN model really the way to go? If someone gets their hands on one of your Tailscale nodes, they can access every service on your tailnet, which are li…

I personally feel like paid DERP is unfortunately the way of the future.

Re: Tailscale is pretty useful

#253

Post by leoqa »

parasubvert wrote: post #179
hattmall wrote: post #170

Earlier quoted context omitted.

Do mainstream consumers really need a VPN?

Tailscale isn’t really a VPN, it’s an OSI layer 5 for the TCP/IP world. It makes connectivity as easy as 90s LAN parties were. I use Tailscale - so I can do remote tech support on my 81 year old mother’s computer - So I can remote in to my desktop from anywhere with my mobile phone or iPad or Vision Pro or Steam Deck if I need a file or need to print something - watching streaming media from my home network when I’m…

I hosted an Arma 3 server via Tailscale with a bunch of non technical folks running the daemon using magic links b

Re: Tailscale is pretty useful

#254

Post by LeoPanthera »

apitman wrote: post #138

Tailscale is one of my favorite companies. They're clearly on to something. Here's a great post by their CTO explaining a lot of the motivation and vision behind it: https://crawshaw.io/blog/remembering-the-lan IMO the main outstanding questions/concerns are: * Is the VPN model really the way to go? If someone gets their hands on one of your Tailscale nodes, they can access every service on your tailnet, which are li…

> install a VPN app on all their devices

I run it on my router, providing access to the entire subnet, so it doesn't have to be all your devices.

Re: Tailscale is pretty useful

#255

Post by rrrx3 »

TacticalCoder wrote: post #147
EVa5I7bHFq9mnYK wrote: post #28

I remember Hamachi did the same as Tailscale in the 90s, we used it to play virtual LAN DOOM. Greed killed it.

Not identical but in the 90s to play Windows games that only had a LAN mode over the Internet, we were using Kali in the 90s: https://en.wikipedia.org/wiki/Kali_(software) This allowed us to play Warcraft II with random strangers: RTS games over the Internet... Felt like the future!

So many good memories from Kali!

Re: Tailscale is pretty useful

#256

Post by derefr »

apitman wrote: post #138

Tailscale is one of my favorite companies. They're clearly on to something. Here's a great post by their CTO explaining a lot of the motivation and vision behind it: https://crawshaw.io/blog/remembering-the-lan IMO the main outstanding questions/concerns are: * Is the VPN model really the way to go? If someone gets their hands on one of your Tailscale nodes, they can access every service on your tailnet, which are li…

> If someone gets their hands on one of your Tailscale nodes, they can access every service on your tailnet, which are likely running with reduced security since that's a huge part of the appeal. This is exactly the situation BeyondCorps/Zero Trust was created to avoid.

In addition to the ACLs mentioned by the sibling, a tailnet is not quite a plain-old VPN overlay network, in that each device on a tailnet gets assigned a predictable, durable LAN IP address based on the credentials that device is logged into Tailscale with.

Which means that, for at least the "personal" devices (laptops, phones, tablets), you can configure your servers on a tailnet to do something that's less finicky than full-on credential-based auth, but still more secure in practice than no auth: namely, host-based authentication — which should be a reasonable 1:1 proxy for user authentication (assuming the constraints from the previous paragraph.)

To put that in concrete terms: on a tailnet, a user's SSH credential for a given server can simply be the fact that the user is able to originate the connection from the expected LAN IP address of the user's workstation. Except that instead of that LAN + the user's workstation living in a physical building, they're both virtual, and the user's physical workstation (of the moment) must provide credentials to bind to the tailnet IP that allows it to present itself as the virtual workstation.

Re: Tailscale is pretty useful

#257

Post by cjcampbell »

frenchtoast8 wrote: post #189
thewebguyd wrote: post #148

Earlier quoted context omitted.

> * Is the VPN model really the way to go? If someone gets their hands on one of your Tailscale nodes, they can access every service on your tailnet, which are likely running with reduced security since that's a huge part of the appeal. This is exactly the situation BeyondCorps/Zero Trust was created to avoid. Tunneling services[0] are more of a Zero Trust approach, but they can't match the seamlessness of Tailscale…

> What Tailscale doesn't solve is access to the data that web app serves if the user's machine is compromised, as tailscale is just determining "can the user hit the webserver on port 443?" and does nothing to evaluate the state of the user's host. Tailscale has some cybersecurity integrations to configure access depending on the device posture. For example, blocking access to a webserver if the device is out of date…

The posture implementation is quite easy to work with. There’s a growing list of integrations, and you can also roll your own with the posture API. I’ve used Kolide so far and will be integrating with Kandji on another tailnet. They also have Intune, JAMF, Crowdstrike, and SentinelOne.

The same posture API can be used to restrict access to devices in your inventory or to set up just-in-time access to a sensitive asset. For the latter, you can use a Slack app provided by Tailscale or integrate with an identity governance workflow to set a posture attribute with a limited TTL. Your tailscale policy just needs to condition the relevant access on the attribute.

Re: Tailscale is pretty useful

#258

Post by aborsy »

Tailscale is not just a wrapper around Wireguard, as some people imply in the comments. The codebase is far bigger, and it does far more. They are different products.

What Tailscale does is difficult to do with Wireguard: Easy VPN, SSO with MFA, key distribution, static private IP for each node, peer to peer direct connectivity, split tunneling, fine grained access control rules down to per port and application, Wireguard over TCP, NAT transversal for devices behind firewall, central management, sharing nodes with others, DNS, file sending, routing rules (with exit nodes, subnet routers, “via”), key rotation, …

Wireguard connects peer A to peer B, and its simplicity stops there.

I found Tailscale to be a very good tool, that I extensively use.

My only concern is: what happens if their infrastructure is compromised at some point, like Okta’s? Assuming I have tail lock enabled.

Re: Tailscale is pretty useful

#259

Post by xarope »

tjoff wrote: post #89
stego-tech wrote: post #49

Earlier quoted context omitted.

Call me Cappy Paranoid, but I fall into the camp of "You should never trust a service provider, ever ," and build infrastructure accordingly; I believe this falls into an extreme interpretation of "zero trust". So while also implementing Tailnet locks and other security measures to constrict traffic flow, I'd also consider going a step further by only permitting server or resource access based on client certificate v…

Then why go with tailscale in the first place? There is slacks nebula and other options that are completely self-hosted from the start. Feels like such a weird hype around tailscale.

I self host tailscale with headscale [0].

[0]: https://github.com/juanfont/headscale

Re: Tailscale is pretty useful

#260

Post by nine_k »

xienze wrote: post #129
stego-tech wrote: post #101

Earlier quoted context omitted.

I feel like a lot of hype around Tailscale is because it vastly simplifies VPNs and their associated networking, especially for businesses, startups, or homelabs where the focus might be elsewhere or specific talent is unavailable. The problem arises when folks don't quite understand why specific decisions are being made, or use the product in nonstandard (or even negative) ways. I've seen stories of folks deploying…

> I feel like a lot of hype around Tailscale is because it vastly simplifies VPNs and their associated networking Tailscale is based on Wire Guard, isn’t it? Now there’s a piece of software that truly made VPNs simple. I have a tunnel back into my LAN by way of an EC2 instance and all it took was two super simple config files on each machine.

Wireguard vastly simplifies the transport level, and attains high performance because it runs in the kernel.

Tailscale simplifies: authentication (including OIDC), authorization (via ACLs), DNS, NAT piercing. All of that is not obvious or easy for someone without deeper expertise.

Post reply on HN