Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Netbird – Open Source Zero Trust Networking

netbird.io

Post reply on HN
Print view View original

261–270 of 299 posts

Re: Netbird – Open Source Zero Trust Networking

#261

Post by Borealid »

usagisushi wrote: post #104
sigio wrote: post #95

I've head Netbird running for the last few months... In general it works quite well, but it would keep messing with my dns-resolving, and I couldn't find the setting to stop it inserting itself into my resolv.conf. During the last few weeks I've removed netbird from all my systems (about 12), mostly because of issues on laptops where resolving or networking would break after they moved to a different network/location…

Just for future reference, you can disable DNS management for specific groups [0]. You can find the option under "DNS > DNS Settings > Disable DNS management for these groups". Netbird will stop modifying the resolv.conf on those groups. [0] https://docs.netbird.io/manage/dns#4-dns-management-modes

Can Netbird run the DNS resolver (so it can be used for the internal domain ONLY by systemd-resolved) but not alter the host's DNS settings?

It looks to me like the setting that tells Netbird to leave the system DNS alone is arbitrarily tied to the setting that causes it to run a resolver at all.

Re: Netbird – Open Source Zero Trust Networking

#262

Post by patmorgan23 »

woile wrote: post #195

For the guys at Netbird, please create an entry in the https://wiki.nixos.org explaining how to use it with nixos. - Tailscale has one entry - Pangolin is getting one I would like to see, even if brief: 1. Getting started 2. Hardware requirements 3. Security considerations 4. Recommended architecture, like running in a VPS if it makes sense 5. Configuring a server 6. Configuring devices 7. Resources (links to read mo…

Anyone can contribute to the nixos wiki, why don't you get the page started?

Re: Netbird – Open Source Zero Trust Networking

#263

Post by pkulak »

pranaysy wrote: post #65

Long-time ZeroTier user here. Recently switched to NetBird (self-hosted on a Hetzner VPS) and it’s been seamless so far. DNS functionality is excellent (something ZeroTier lacked), and the access-control model is very well designed. It’s easy to understand what’s going on and to grant one-off access when needed. Only real and very minor gripe is the Android app: I wish it were on F-Droid and a bit more robust, as it…

But paid Tailscale is $5 a month right? So you gotta be paying more to self host and deal with all the problems yourself, not have derp servers all over the world, etc. Why?

Re: Netbird – Open Source Zero Trust Networking

#264

Post by catlifeonmars »

h4kunamata wrote: post #252
catlifeonmars wrote: post #245

Earlier quoted context omitted.

Read the docs more closely. - TCP/80 is only required to answer let’s encrypt challenges for certificate issuance - UDP is only required to enable DERP. These are both optional. It’s not surprising that there are additional ports required on top of Wireguard. 443 is likely for key distribution and management. If you don’t want PKI then you don’t need headscale; you can always distribute the keys yourself and just run…

>If you don’t want PKI then you don’t need headscale; you can always distribute the keys yourself and just run plain wireguard It makes more sense to me, WireGuard + SPA (fkwnop aka replacement of port knocking that requires pre-shared key to even talk with, only that IP can access to it (IP Table), any scan tool seems it as closed) Headscale/Tailscale only has value if you are behind a CGNAT, otherwise, it just adds…

Well, it also lets you federate access and manages the keys for you. But yeah, if it’s a personal setup and you have good key rotation hygiene, I agree with you: it doesn’t add much value on top of wireguard. I’ll hazard a guess that you can just run your own DERP relay too for the CGNAT case.

Re: Netbird – Open Source Zero Trust Networking

#265

Post by littlecranky67 »

4k93n2 wrote: post #215
mittermayr wrote: post #157

Earlier quoted context omitted.

I have one VPS node that I use as a connector, where the headscale app is installed. I have this on a domain (for convenience), so think something like: hs.mygreatplace.com Now, when I install Tailscale client on any device (phones, tablets, Linux machines, proxmox nodes, etc.), I simply say: don't use the tailscale network for this, please route this over my own network, so you point it to hs.mygreatplace.com as a c…

tailscale were based in Canada last time i checked. has this changed recently?

well the OP talks about headscale server (self-host) which will run whereever your server that you install it onto will be. You just use the tailscale clients.

Re: Netbird – Open Source Zero Trust Networking

#267

Post by cheema33 »

binnacle wrote: post #113

I tried migrating our organization from Twingate to self-hosted Netbird for cost savings but couldn't get it working reliably for 10-15% of users. The client failed intermittently with no clear pattern to troubleshoot. It became very frustrating for our end users. My advice: if you're considering self-hosted Netbird, set clear expectations that it's best-effort QoS, not enterprise-grade reliability. There's no such t…

I have been using Netbird for my small company of 10 people for about 2 years. Users on slow connections complained that they could not stay connected with services reliably. I could not reproduce the problem as I mostly connected from very fast connections. I thought that maybe the users or their ISPs were to blame. And then one time I was using the wifi on a plane. It was a slow connection and I was connected to an RDP server. I could not stay connected. I also has Cloudflare VPN connected to the same server. It worked really well over the same connection. I went back ad forth many times as I had trouble believing how bad the Netbird connection was. Long story short, we are now completely switching over to Cloudflare VPN. It is free for first 50 users and is very very reliable, in our experience.

Re: Netbird – Open Source Zero Trust Networking

#268

Post by blue_pants »

bink wrote: post #256
blue_pants wrote: post #217

Earlier quoted context omitted.

Yes, but when you connect your phone to a Nebula network, and go to http://media-server in your browser, the DNS won't resolve it to your desired node, because the phone client (same on desktop) didn't update DNS of the phone, so you'll have to use node's IP address. That's what I've read (when evaluating Nebula), at least.

It doesn't automatically update, that's true. But I think the typical way to deal with this is to have a nebula subdomain. www.nebula.example.com instead of www.example.com.

I haven't thought about it, thanks

Re: Netbird – Open Source Zero Trust Networking

#269

Post by blue_pants »

nine_k wrote: post #240
blue_pants wrote: post #217

Earlier quoted context omitted.

Yes, but when you connect your phone to a Nebula network, and go to http://media-server in your browser, the DNS won't resolve it to your desired node, because the phone client (same on desktop) didn't update DNS of the phone, so you'll have to use node's IP address. That's what I've read (when evaluating Nebula), at least.

When your nodes are not very numerous, and their IPs are statically assigned, you can just have them in a hosts file, or even served by your normal name server if you're using a split-horizon configuration.

Editing hosts file seems unwieldy, and impossible on a phone without rooting it, AFAIK

> split-horizon configuration

Is it when your local router redirects media-server.mydomain.com to a local IP, and say Cloudflare DNS redirects it to your Nebula IP?

Re: Netbird – Open Source Zero Trust Networking

#270

Post by mixel »

pkulak wrote: post #263
pranaysy wrote: post #65

Long-time ZeroTier user here. Recently switched to NetBird (self-hosted on a Hetzner VPS) and it’s been seamless so far. DNS functionality is excellent (something ZeroTier lacked), and the access-control model is very well designed. It’s easy to understand what’s going on and to grant one-off access when needed. Only real and very minor gripe is the Android app: I wish it were on F-Droid and a bit more robust, as it…

But paid Tailscale is $5 a month right? So you gotta be paying more to self host and deal with all the problems yourself, not have derp servers all over the world, etc. Why?

If you run multiple services it gets cheaper. I would not see a reason to pay for 3 different cloud services that I am able to self host.
Post reply on HN