Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Tailscale is pretty useful

blog.6nok.org

Post reply on HN
Print view View original

261–270 of 419 posts

Re: Tailscale is pretty useful

#261

Post by codetrotter »

selfhoster wrote: post #238
codetrotter wrote: post #104

Earlier quoted context omitted.

> Is that a gigantic PITA to implement? Oh heck, you betcha it is I use my own self-hosted Wireguard VPN server. I agree with a lot of what you were saying about client certificates etc. And I plan to eventually do that sort of thing on some of my services in my own Wireguard VPN too. But in terms of Tailscale, if you are going to set up all kinds of client certificate things that will take a lot of time and effort,…

> Unless like OP your ISP has put CGNAT on you. I run Wireguard on a VPS and route public traffic with it over Wireguard to my home machine. Are you saying my ISP must not be CGNAT or else it wouldn't work?

No. I was talking specifically about the case where you want to host the Wireguard VPN server at home.

See earlier in the comment where I said:

> opening up a port for it for inbound connections if you host it from your home connection rather than a rented server

Although I can see how it might not be clear that in the end where I’m mentioning CGNAT I am still specifically talking about hosting the VPN server from your home connection.

Re: Tailscale is pretty useful

#262

Post by sfink »

idatum wrote: post #175
iamdamian wrote: post #38

I'm curious to hear well-informed reasons from this crowd for why we can trust Tailscale given the non-self-hosted part of the architecture? Does it come down to Tailnet locks [1], not worrying that Tailscale will be compromised, not worrying that your home network is worth compromising, or something else? [1]: https://tailscale.com/kb/1226/tailnet-lock

I still find SSH adequate for connecting to a home server remotely. I don't have the CGNAT terrible problem but I also don't do any port forwarding on my home router. Instead, I have a VM running on a cloud provider that I SSH to from an OpenBSD box inside my home network. The SSH connection establishes a reverse SSH tunnel. This opens a port on the cloud VM to tunnel to my OpenBSD sshd port. With the reverse proxy t…

If I'm understanding correctly, this will break whenever the IP address of your tunnel changes. You'll have to reestablish all of your connections.

My use case for tailscale: have an SSH (or other) connection to my home server while working from home. Drive to a coffee shop, register on their network, and continue using the same connection. (Or hotspot, if I'm somewhere without Wifi.)

The IP address of my server does not change. When at home, the packets do not leave my home network. When out and about, they do.

It's magic to me. I set up a sophisticated (read: overkill) SSH tunneling setup previously, using Match rules in .ssh/config to autodetect the network I was on so that `ssh myserver` would always go via the correct route. But my connections were still interrupted broke when I switched, and I'm not good enough at networking to do any better.

(I guess this is what Wireguard is for? I could access my server via a fixed IP address on my machine that goes to a tun device, and that would send the packets to the actual server if nearby otherwise hand off to the carrier pigeons? Is that what the tailnet is doing? I don't understand how packets get intercepted by tailscaled, though I do see a tailscale0 device. Is that just a vanity license plate version of tun0? Why does `ip route show` give me only routes through my actual devices, then? Never mind, this isn't a helpdesk. I'm just getting old and stupid, I think.)

Re: Tailscale is pretty useful

#263

Post by enos_feedler »

hattmall wrote: post #170
epscylonb wrote: post #152

Earlier quoted context omitted.

Agree that they are on to something. I gave a tech talk about them a while ago at work and said that I think they are on the cusp of providing a consumer VPN product that appeals to mainstream consumers. The Apple of VPNs, everything "just works" and is easy to understand.

Do mainstream consumers really need a VPN?

Maybe if there was a mainstream reason to connect home machines with their phones. Personal backup, game streaming, etc. im not in this camp of believing it but maybe!

Re: Tailscale is pretty useful

#264

Post by gerdesj »

VPNs are complicated and its rarely a case of one is better than another.

Tools for the job, should be our watchword ... phrase 8)

IPSEC is somewhat old school but very solid - if you can do opportunistic IPSEC via DNS etc it can be rather nifty. You can also use FRRRRRRRRRRRR to do it routed. IPSEC with BINAT can be used to avoid issues involving duplicate network addressing.

I default to IPSEC for site to site links.

OpenVPN is more TCP/IP related compared to IPSEC - that's very simplified. You can easily set an IP address for a client and other niceties.

OpenVPN is superb for massive client deployment. If you have a central CA and can deploy certs on all devices eg via MS AD CA then you can use a single config file for all clients, which is a doddle to deploy via GPO.

Tailscale is the new kid on the block. As with all new kids you need to examine what works for you and you could be one person or an entire multi national.

The real world is rather messy. For example your home/office/corp network will almost certainly have a MTU of 1500 bytes. When you hit the internets it gets really messy. Some British Telecom links (for example) will support mini jumbo frames and some won't and the real world continues to get more and more complicated.

Re: Tailscale is pretty useful

#265

Post by dharmab »

leoqa wrote: post #253
parasubvert wrote: post #179

Earlier quoted context omitted.

Tailscale isn’t really a VPN, it’s an OSI layer 5 for the TCP/IP world. It makes connectivity as easy as 90s LAN parties were. I use Tailscale - so I can do remote tech support on my 81 year old mother’s computer - So I can remote in to my desktop from anywhere with my mobile phone or iPad or Vision Pro or Steam Deck if I need a file or need to print something - watching streaming media from my home network when I’m…

I hosted an Arma 3 server via Tailscale with a bunch of non technical folks running the daemon using magic links b

I used to host an Arma 3 server using Kubernetes, I had a scalable set of headless clients to distribute the AI load. My friends called said it was the smoothest server they ever played on despite using hundreds of AI groups. With Tailscale I wouldn't have needed host networking enabled on the Pods, come to think of it.

Re: Tailscale is pretty useful

#266

Post by ksajadi »

tsujamin wrote: post #35

The tailscale.com/tsnet package in Go [1] is really useful if you've not looked at it before: you can make single binary HTTP or whatever servers that are only exposed inside your tailnet. Their golink project [2] is a good example (and useful itself), but I've used it to build "peer to peer" comms for one application, and to host an API and Svelte SPA to control some other things in a tailnet. [1] https://pkg.go.dev…

Absolutely. You can run a go process that becomes a Tailscale client without any other dependencies. This is what I use it for issuing JWT for service authentication: https://github.com/AltaCoda/tailbone

Re: Tailscale is pretty useful

#267

Post by aborsy »

freetime2 wrote: post #249

I'm thinking about exposing some services outside of my LAN, and wondering whether it would be better to go with Tailscale or Cloudflare Tunnel. [1]. At a high-level both solutions seems pretty similar, with a client service running on the machine you want to share. My sense is that tailscale makes sense for a more locked-down service that is not accessible to the general public (although they do have a way to open u…

Cloudflare Access is a reverse proxy: you encrypt to Cloudflare, Cloudflare decrypts and scans the traffic, Cloudflare re encrypts to the origin server.

So, traffic is not end to end encrypted (Cloudflare man in the middles the traffic). That’s the reason we didn’t use it. Otherwise it’s a good service.

Re: Tailscale is pretty useful

#268

Post by spr-alex »

apitman wrote: post #138

Tailscale is one of my favorite companies. They're clearly on to something. Here's a great post by their CTO explaining a lot of the motivation and vision behind it: https://crawshaw.io/blog/remembering-the-lan IMO the main outstanding questions/concerns are: * Is the VPN model really the way to go? If someone gets their hands on one of your Tailscale nodes, they can access every service on your tailnet, which are li…

we've got a tailscale integration that takes care of the security concerns. set policy to decide what can talk out to the tailscale node and what the tailscale gateway is granted access to. this is especially important when you can't run a tailscale client on the devices you want to connect

https://github.com/spr-networks/spr-tailscale

Re: Tailscale is pretty useful

#269

Post by pkulak »

I set up a Wireguard tunnel into my home network years ago, before Tailscale was really a thing, and I always wonder if I should switch, but I can never make the effort worth it in my head. If I was starting all over, I'd go Tailscale for sure, but a single tunnel really gets me 99% of the way there.

Re: Tailscale is pretty useful

#270

Post by mbesto »

sureglymop wrote: post #182
mbesto wrote: post #127

Earlier quoted context omitted.

The data sent from one node to another doesn't pass through TS's infra. I basically just see Tailscale as an auth paradigm for managing wireguard keys.

I don't really understand this though.. The key exchange is perhaps the most important aspect. Just hypothetically, what if an intelligence service records your encrypted traffic and also happened to get AWS to mitm your communication with the tailscale key distribution server? Doesn't really matter if most of your traffic doesn't use their infrastructure if the most important parts of it do.

> Using Tailscale introduces a dependency on Tailscale’s security. Using WireGuard directly does not. It is important to note that a device’s private key never leaves the device and thus Tailscale cannot decrypt network traffic. Our client code is open source, so you can confirm that yourself.

https://tailscale.com/compare/wireguard

My understanding is that (in theory) the only way this is possible is if the attacker introduces a new node and then connected to other nodes that are in the tailnet. What you're suggesting is that a single node that is connected to the other nodes gets compromised, but this isn't possible without already being able to compromise that specific node. Alternatively, if someone hacks Tailscale itself, the only way they could get access to any nodes would be to add their own node, but if you have alerting set up you would know and you could shut down the attacker.

Post reply on HN