Live data from Hacker News

Tailscale Peer Relays is now generally available

tailscale.com

251–260 of 267 posts

Re: Tailscale Peer Relays is now generally available

#251
post #204

Earlier quoted context omitted.

It's difficult for us to maintain documentation of exactly the kind you'd want there, though we do try to keep up with docs as best we can. In particular there is a fairly wide array of heuristics in the client to adapt to the environment that it's running in - and this is most true on Linux where there are far far too many different configuration patterns and duplicate subsystems (example: https://tailscale.com/blog…

> It's difficult for us to maintain documentation of exactly the kind you'd want there Suggestion: let an LLM maintain it for you. Alternate suggestion for OP: let an LLM generate the explanations you want from the code (when available).

This problem space is not small enough to stay within current LLM attention span. A sufficiently good agent setup might be able to help maintain docs somewhat through changes, but organizing them in an approachable way covering all the heuristics spread across so many places and external systems with a huge amount of time and versioning multivariate factors is hugely troublesome for current LLM capabilities. They're better at simpler problems, like typing the code.

Re: Tailscale Peer Relays is now generally available

#252
post #2

I just set this up the other day, and I got my ping to drop from 16 to 10ms, and my bandwidth tripled, when connecting from a remote natted site to a matter desktop my house. Together with Moonlight/Sunshine I can now play Windows games on my Linux desktop from my MacBook, with 50mbps/10ms streaming. So far so good! Not a single port forwarded, I just set my router up as peer node.

Neat use case. But in fairness, you've simply 'offloaded' NAT traversal/port forwarding to automagic helper protocols over which you have no control even if you wanted it.

I recently tried whitelisting IPv6 prefixes at the network border and running straight IPv6 traffic from end to end.

It works really well so long as there's an encrypted transport, although I'm a little annoyed that the routes are very different and the ping times are different too. Although at the moment I can't remember if they're worse ¯\_(ツ)_/¯

Re: Tailscale Peer Relays is now generally available

#253
post #116

I'm having a hard time understanding how this is different from a bastion server, where you're tunneling through an intermediary server that you've deployed in the target network. I guess the difference is the fact that the intermediary server doesn't need a port open (as standard nat punching will work)? Or are there other big differences?

I think that biggest difference is that your client applications don't need to be explicitly configured to use the bastion server. For example ssh, web browsers, rdp, samba and so on can just pretend that you are inside the target network. Doubly useful if this is a "customer" network and you are working with multiple customers.

Re: Tailscale Peer Relays is now generally available

#254
post #154
post #97

Earlier quoted context omitted.

UPnP allows literally any random piece of software inside your network to open and forward arbitrary ports on your firewall. Bad idea!

Why are you running software that randomly opens firewall ports?

malware. Got any no-name IOT devices on your network? Got some Huawei built hardware anywhere? Playing some new indie game from developers in romania?

I had to install openwrt on my router so that I could restrict access to upnp by mac address just to my gaming pc (imo this should be standard on any router as an advanced setting, most are just upnp yes/no) so that I can still play online games.

Re: Tailscale Peer Relays is now generally available

#255

Earlier quoted context omitted.

I don't understand this attitude. Some humans have to eat and put a roof over their heads sometimes, and extracting consulting fees from open-source work (i.e. the Redhat model) is not always a paying business model. A hybrid model is often the best way to compromise. Disclaimer: I'm pursuing a similar solution on an app I'm working on. The CLI will be free and open-source (and will have feature parity with the GUI),…

The logic of putting roof over the head is a point that is too broadly used is not at all valid for things like tailscale as... eventually most businesses at that level (tailscale revenue in 2025 was $45.2M) are crushing the customers. Either entshittification or lock-in. There is a loss of trust. The trust on SV/software is as much as bankers (during Lehmann bros crisis). Some people in HN think oh, we are growing s…

So the perverse "logic" here is basically that since very successful products sometimes get enshittified, there is no point to seeking ANY success?

Do you realize how out-of-touch with reality this sounds? For every $45M Tailscale there's a hundred companies you likely never heard of making respectable but not-very-excessive money in niches here and there. For example, I have a high school friend who owns one: https://speedify.com Thing is, you can't have one without the other. Hell, that's the kind of success (as in "moderate") I'm actually targeting with my work. Which is why comments like this irritate me.

Go make something that other people want and then try to live off it. Offering all of it for free won't cut it, because we don't live in a communist dictatorship (not that any of them might approve you spending your time on your pie-in-the-sky "contributory idea" in the first place).

By the way, in working on the thing I want to sell, I've made a number of offshoot projects open source as a side effect. Check my github, it's never been more active.

Re: Tailscale Peer Relays is now generally available

#256

Earlier quoted context omitted.

One feature is: it's a business and won't be abandoned due to OSS but out if it has a sustainable way to continue.

The (almost) opposite is also a feature: it's OSS and will still be available if the business goes out of business

Companies need someone to blame who has skin in the game.

An "open source contributor" is not gonna wake up at 2AM on a Saturday because the business that someone else partially built on their free code suddenly went down.

This is ALSO, conveniently, why AI's will never completely replace human developers. You cannot blame, reward, or punish an entity that has no such sensitivities.

Re: Tailscale Peer Relays is now generally available

#257
post #116

I'm having a hard time understanding how this is different from a bastion server, where you're tunneling through an intermediary server that you've deployed in the target network. I guess the difference is the fact that the intermediary server doesn't need a port open (as standard nat punching will work)? Or are there other big differences?

We've setup and used peer-relays since it was first announced and they've been great, but they do solve a somewhat specific problem.

Some of our users experienced fairly limited throughput from time to time. Under certain circumstances (eg. always ipv4 NAT/double-NAT, never for ipv6) their Tailscale client couldn't establish a direct connection to the Tailscale node in the datacenter, so data was relayed through Tailscales public relay nodes. Which at times was rate limited/bottleneck - in all fairness, that is to be expected according to their docs.

The first mitigation was to "ban" the specific public relay they were using in the policy. Which helped, but still not a great solution and we might just end up in a weird whack-a-mole-ish ban game with the public peer relays in the long run.

So we setup a peer relay, which networking-wise is in a DMZ sort of network (more open), but location wise still in the datacenter and allowed it to easily reach the internal (more restricted networking) Tailscale nodes. Which solved all throughput problems, since we no longer have users connecting through the public relays.

Also, the peer relays feels a little bit magic, once you allow the use of them in the Tailscale policy, it just works(tm) - there is basically zero fiddling with them.

EDIT: I'll happily provide more details if interested - we did a fair amount of testing and debugging along the way :)

Re: Tailscale Peer Relays is now generally available

#258
post #166
post #135

Earlier quoted context omitted.

Home users being on multiple tailnets is serious power user territory

There are a lot of workarounds these days, such as tailnet switching, and, of course, if you're admin on both tailnets, you're practically golden with the "share" option. But even power users have to pick and choose their battles. If I had a nice tailnet home setup going I might be seriously miffed if I had to try to fit in some of my devices to a corporate tailnet I didn't control.

True, but to be frank you shouldn’t be using personal devices for work purposes anyway.

Re: Tailscale Peer Relays is now generally available

#259
post #3

How does Tailscale make money? I really like their service but I'm worried about a rug pull in the future. Has anyone tried alternative FOSS solutions? Also, sometimes it seems like I get rate limited on Tailscale. Has anyone had that experience? This usually happens with multiple SSH connections at the same time.

https://netbird.io/ is open source, with a freemium hosted option. Works for us and I find it easier to configure than tailscale for routing rules.

Re: Tailscale Peer Relays is now generally available

#260
post #37
post #3

How does Tailscale make money? I really like their service but I'm worried about a rug pull in the future. Has anyone tried alternative FOSS solutions? Also, sometimes it seems like I get rate limited on Tailscale. Has anyone had that experience? This usually happens with multiple SSH connections at the same time.

> How does Tailscale make money? They spy on your network behavior by default, so free users are still paying with their behavioral data. See https://tailscale.com/docs/features/logging “Each Tailscale agent in your distributed network streams its logs to a central log server (at log.tailscale.com). This includes real-time events for open and close events for every inter-machine connection (TCP or UDP) on your networ…

That’s misleading; you have to pay extra to get access to that feature.
Post reply on HN