Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Netbird – Open Source Zero Trust Networking

netbird.io

Post reply on HN
Print view View original

251–260 of 299 posts

Re: Netbird – Open Source Zero Trust Networking

#251

Post by lwowowx »

geoctl wrote: post #105
CubsFan1060 wrote: post #96

Earlier quoted context omitted.

I've been keeping my eye on this one, it's very interesting. Feel free to ignore this, but, what's your long term plan here? I see you have Enterprise plans (especially that allow different licenses). From what I can tell you're the only contributor, but, I assume that if you accepted contributions there'd be a CLA?

Thank you, I haven't accepted any contributions so far primarily because of this reason but things might change in the future. As mentioned in the README and docs, Octelium is designed specifically for self-hosting so the commercial side of the project is simply confined to commercial AGPLv3-alternative licensing, support, and other very enterprise-y/customized features such as SCIM, SIEM to specific providers, etc..…

Please don’t put SCIM behind enterprise licenses, it makes IT Administrators life hell.

Re: Netbird – Open Source Zero Trust Networking

#252

Post by h4kunamata »

catlifeonmars wrote: post #245
h4kunamata wrote: post #244

Earlier quoted context omitted.

According to its own documentation: https://headscale.net/stable/setup/requirements/ So instead of opening a port on my firewall for WireGuard, I must have these ports public exposed: * tcp/80 * tcp/443 * udp/3478 * tcp/50443 I don't know about you but that seems the most insane approach. Even if HTTP-01 challenge is not used, you are still exposing 3 ports instead of 1 random-high port like 55555 for example. Yeah y…

Read the docs more closely. - TCP/80 is only required to answer let’s encrypt challenges for certificate issuance - UDP is only required to enable DERP. These are both optional. It’s not surprising that there are additional ports required on top of Wireguard. 443 is likely for key distribution and management. If you don’t want PKI then you don’t need headscale; you can always distribute the keys yourself and just run…

>If you don’t want PKI then you don’t need headscale; you can always distribute the keys yourself and just run plain wireguard

It makes more sense to me, WireGuard + SPA (fkwnop aka replacement of port knocking that requires pre-shared key to even talk with, only that IP can access to it (IP Table), any scan tool seems it as closed)

Headscale/Tailscale only has value if you are behind a CGNAT, otherwise, it just adds extra management and complexities.

Re: Netbird – Open Source Zero Trust Networking

#253

Post by commandersaki »

I can't tell if Netbird provides this feature but looking at their access control feature it doesn't seem to.

I just want a roaming access Wireguard terminating endpoint to restrict access to a user to initial subnets, and open / allow routing to further subnets based on multi factor authentication. That way a user can connect and only have access to say a wiki and internal chat, but then escalate access by MFA to access resources on other subnets that have stuff like internal gitlab and whatever other critical resources exist.

Re: Netbird – Open Source Zero Trust Networking

#254

Post by chillfox »

pranaysy wrote: post #65

Long-time ZeroTier user here. Recently switched to NetBird (self-hosted on a Hetzner VPS) and it’s been seamless so far. DNS functionality is excellent (something ZeroTier lacked), and the access-control model is very well designed. It’s easy to understand what’s going on and to grant one-off access when needed. Only real and very minor gripe is the Android app: I wish it were on F-Droid and a bit more robust, as it…

Does Tailscale/ZeroTier/Netbird provide anything beyond a GUI wrapper for Wireguard?

How easy is it to make it manage an already configured Wireguard mesh network?

Re: Netbird – Open Source Zero Trust Networking

#255

Post by pdimitar »

mirashii wrote: post #224
Ingon wrote: post #131

I've been working for a while on https://github.com/connet-dev/connet . It gives a different twist at the same problem - instead of an overlay network at L4 (wireguard, etc) or publicly accessible endpoint at L7 (like ngrok) it "projects" a remote endpoint locally (e.g. as if you are running the service on your computer). Of course "locally" can always be a VPS that has caddy in front to give you ngrok-like experienc…

A neat idea, but projecting all of these services onto localhost is a bit of a security nightmare. Have you considered looking at what something like Twingate does? Using the CGNAT IP space for the projection allows you to give every individual service its own IP address, which helps quite a bit in terms of allowing you to isolate the services from e.g. malicious web pages.

Me seeing "Request a Demo" button -> immediately leaving.

Re: Netbird – Open Source Zero Trust Networking

#256

Post by bink »

blue_pants wrote: post #217
bink wrote: post #216

Earlier quoted context omitted.

Nebula uses lighthouses instead of DNS for finding other nodes. https://github.com/slackhq/nebula?tab=readme-ov-file#2-optio...

Yes, but when you connect your phone to a Nebula network, and go to http://media-server in your browser, the DNS won't resolve it to your desired node, because the phone client (same on desktop) didn't update DNS of the phone, so you'll have to use node's IP address. That's what I've read (when evaluating Nebula), at least.

It doesn't automatically update, that's true. But I think the typical way to deal with this is to have a nebula subdomain. www.nebula.example.com instead of www.example.com.

Re: Netbird – Open Source Zero Trust Networking

#258

Post by clawsyndicate »

geoctl wrote: post #124
zakki wrote: post #121

Earlier quoted context omitted.

doest it have identity-aware proxy built-in?

Yes, every resource that needs to be protected is represented by a "Service" that's implemented as a L7-aware identity-aware proxy in the Octelium Cluster, which is a distributed system that's running on top of a k8s cluster. Users simply access the protected resource/upstream through the Cluster, namely the Service, from a data-plane perspective, and the Service/identity-aware proxy does authentication/authorization…

[dead]

Re: Netbird – Open Source Zero Trust Networking

#259

Post by newzino »

NewJazz wrote: post #202
jrm4 wrote: post #192

Earlier quoted context omitted.

Thats kind of wild, mostly because -- presuming it's correct, what bot is saying is actually valuable here?

Honestly no it is kind of nonsense. Nothing requires you to microsegment with wireguard meshes, for example.

[flagged]

Re: Netbird – Open Source Zero Trust Networking

#260

Post by FloatArtifact »

edentrey wrote: post #14
FloatArtifact wrote: post #12

If the VPN connection would stay connected despite having it set up that way in the web UI.. It would be a good product. Still haven't figured out how to do Termux on Android with netbird ssh yet.

can you please elaborate on this? I use termux on android with tailscale and it works flawless, is it not possible on Netbird?

The following documentation doesn't work obviously because it's not on path. I need to do further reading of the docs, but I haven't had time yet.

netbird ssh user@100.119.230.104 https://docs.netbird.io/manage/peers/ssh

Post reply on HN