Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Tailscale is pretty useful

blog.6nok.org

Post reply on HN
Print view View original

31–40 of 419 posts

Re: Tailscale is pretty useful

#31

Post by baq »

jaxtracks wrote: post #3

The features here seem to be fairly standard with most the WireGuard based VPNs these days. For example, I use Nord for my use-case which is very similar to the author's. This allows me to rsync my home directory between my laptop, tablet, phone's Termux env, and desktop (all running Linux) to maintain configuration parity and file locality regardless of where I turn these devices on, so long as they have internet. D…

It just works, literally. I haven’t tried nord, but I’ve got clients on Mac, Linux, windows, rpis, it all just works. I used to run pivpn, but the key exchange magic Tailscale employs is so much simpler and it somehow works on networks blocking unknown packets like the pivpn I had set up on some random udp port.

Re: Tailscale is pretty useful

#32

Post by vlovich123 »

laidoffamazon wrote: post #21
vlovich123 wrote: post #12

Earlier quoted context omitted.

15 MiB/s is trivially handled by any CPU you're likely to run. Indeed 100 MiB/s seems reasonable. 15 MiB/s cap seems either the protocol being used is doing too many round trips (assuming the machines you're testing with are far apart) or the network that's being set up requires routing through Tailscale's infra for hole punching.

Not a cap. It’s the delta. About 117megabytes a second measured by windows explorer to around 101. These are on my local network, connected to my switch over 1gig Ethernet.

Ok a 12% differential on a LAN is kind of surprising. I wonder what Tailscale could possibly doing that would be causing this issue because aside from the control plane I don't believe they're in the data path all that much. Maybe WireGuard on Windows isn't as optimized as it is on Linux?

https://www.reddit.com/r/linux/comments/9bnowo/wireguard_ben... from 7 years ago is about trying to get it running at 10Gbps speeds.

Re: Tailscale is pretty useful

#33

Post by zrail »

jaxtracks wrote: post #3

The features here seem to be fairly standard with most the WireGuard based VPNs these days. For example, I use Nord for my use-case which is very similar to the author's. This allows me to rsync my home directory between my laptop, tablet, phone's Termux env, and desktop (all running Linux) to maintain configuration parity and file locality regardless of where I turn these devices on, so long as they have internet. D…

Maybe not if all you're doing is hooking some nodes together. That said, I have personally used these Tailscale features that with a quick glance I don't see Meshnet having:

- ephemeral nodes are super useful for things like attaching a GitHub action runner or a fly.io instance to your tailnet

- Tailscale's ACL system has a ton of capabilities

- getting corporate buy-in is possible, vs trying to get a business to buy into Nord meshnet for actual workloads

Re: Tailscale is pretty useful

#34

Post by baq »

laidoffamazon wrote: post #21
vlovich123 wrote: post #12

Earlier quoted context omitted.

15 MiB/s is trivially handled by any CPU you're likely to run. Indeed 100 MiB/s seems reasonable. 15 MiB/s cap seems either the protocol being used is doing too many round trips (assuming the machines you're testing with are far apart) or the network that's being set up requires routing through Tailscale's infra for hole punching.

Not a cap. It’s the delta. About 117megabytes a second measured by windows explorer to around 101. These are on my local network, connected to my switch over 1gig Ethernet.

IME it adds about (at least) 1ms of latency over local networks. You should be able to use a different dns suffix to use the LAN interface instead of Tailscale.

Re: Tailscale is pretty useful

#35

Post by tsujamin »

The tailscale.com/tsnet package in Go [1] is really useful if you've not looked at it before: you can make single binary HTTP or whatever servers that are only exposed inside your tailnet.

Their golink project [2] is a good example (and useful itself), but I've used it to build "peer to peer" comms for one application, and to host an API and Svelte SPA to control some other things in a tailnet.

[1] https://pkg.go.dev/tailscale.com/tsnet

[2] https://github.com/tailscale/golink

Re: Tailscale is pretty useful

#37

Post by radlad »

yjftsjthsd-h wrote: post #26
jaxtracks wrote: post #3

The features here seem to be fairly standard with most the WireGuard based VPNs these days. For example, I use Nord for my use-case which is very similar to the author's. This allows me to rsync my home directory between my laptop, tablet, phone's Termux env, and desktop (all running Linux) to maintain configuration parity and file locality regardless of where I turn these devices on, so long as they have internet. D…

What other VPNs do mesh networking? I only know of zerotier (proprietary) and nebula (FOSS except that the Android app is proprietary)

Shameless plug, but some of the Nebula team (including myself) works on https://www.defined.net/ (proprietary managed Nebula networks.)

Also, ZeroTier is "open-source ish." They use the BSL license for most of their code (https://www.zerotier.com/blog/on-the-gpl-to-bsl-transition/) and I believe you can self-host (https://docs.zerotier.com/selfhost/)

Re: Tailscale is pretty useful

#38

Post by iamdamian »

I'm curious to hear well-informed reasons from this crowd for why we can trust Tailscale given the non-self-hosted part of the architecture? Does it come down to Tailnet locks [1], not worrying that Tailscale will be compromised, not worrying that your home network is worth compromising, or something else?

[1]: https://tailscale.com/kb/1226/tailnet-lock

Re: Tailscale is pretty useful

#39

Post by aodin »

tass wrote: post #24
ydnaclementine wrote: post #11

> it’s no longer possible thanks to a cursed thing called CGNAT as someone who does publicly expose services that have auth, why does CGNAT make exposing ports publicly bad?

Other replies explained the why, though cgnat wouldn’t be a problem if you also had ipv6. Luckily for me I have a regular ip4 address but if that ever changed I’d be out of luck unless my isp (quantum fibre) implemented a proper ipv6 solution.

I have Quantum Fiber in Colorado and enabled IPv6 on the old CenturyLink C4000XG modem following these directions: https://www.centurylink.com/home/help/internet/modems-and-ro...

Re: Tailscale is pretty useful

#40

Post by thomastjeffery »

In other words (they do get to this point right away), port forwarding is pretty useful, and most of us don't have it anymore.

I'm sick and tired of the way ISPs treat us. It's literally written into my lease what company I will pay for internet, and how much I will pay them. It is not, however, written in my lease how fast the connection will be. Not only am I unable to forward ports, I can't even change my own WiFi password! Sure, I could make a fuss and probably obtain access to my router, but it isn't worth the hassle.

But why is there a hassle to begin with? How in the hell is it in anyone's interest to keep me from configuring my own router? I can come up with plenty of authoritative bullshit answers to this question, but they are all authoritative bullshit. I think that's the real answer: we have systemically built our society to operate on authoritative bullshit. sigh

Tailscale is a usable workaround, but it shouldn't exist. It shouldn't need to exit. I just want to be able to host a server. Is that really so much to ask?

Post reply on HN