Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Tailscale is pretty useful

blog.6nok.org

Post reply on HN
Print view View original

311–320 of 419 posts

Re: Tailscale is pretty useful

#311

Post by ashfn »

o1o1o1 wrote: post #279
tills13 wrote: post #271

Earlier quoted context omitted.

Maybe a cost based trigger on the vercel project?

I'd be very interested, is there someone who could elaborate please? I'm terrified using a service like Vercel because I heard about the massive cost trap that can hit you hard and I don't know if there is any alternative for (easily & quickly) hosting NextJS apps.

Its relatively straightforward to host a nextjs app in a docker container and route it with nginx and cloudflare, but you probably wont get as good uptime

Re: Tailscale is pretty useful

#312

Post by PLG88 »

high_byte wrote: post #55

tailscale to expose a port is such overkill. just use ngrok for that.

or one of the many alternatives - https://github.com/anderspitman/awesome-tunneling. I will advocate for zrok.io as I work on its parent project, OpenZiti. zrok is open source and has a free (more generous and capable) SaaS than ngrok.

Re: Tailscale is pretty useful

#313

Post by ebr4him »

radlad wrote: post #37
yjftsjthsd-h wrote: post #26

Earlier quoted context omitted.

What other VPNs do mesh networking? I only know of zerotier (proprietary) and nebula (FOSS except that the Android app is proprietary)

Shameless plug, but some of the Nebula team (including myself) works on https://www.defined.net/ (proprietary managed Nebula networks.) Also, ZeroTier is "open-source ish." They use the BSL license for most of their code ( https://www.zerotier.com/blog/on-the-gpl-to-bsl-transition/ ) and I believe you can self-host ( https://docs.zerotier.com/selfhost/ )

ZeroTier works where Tailscale (Wireguard) is blocked eg Egypt.

Re: Tailscale is pretty useful

#314

Post by kdmtctl »

devilbunny wrote: post #203
kdmtctl wrote: post #166

Earlier quoted context omitted.

Wireguard is easy to block. Some VPN providers do implement an obfuscation layer for it, but Tailscale uses plain WG, so if WG is blocked, you will get no connection. Control plane would still work, though.

Intriguingly, my work network (both guest and employee networks) blocks OpenVPN, commercial VPN (Proton I use, plus a couple of others I tried just as an experiment), and Tailscale authentication , but if the device is already authenticated to the tailnet, it will continue to work. Turns out that work uses the same ISP my home does, so perhaps that's part of it, but I have another TS exit node running at my in-laws'…

It's easy to block the control plane because Tailscale has endpoints listing all current control and DERP servers. On Linux you can use a SOCKS proxy for control plane traffic, if connections still work. Some firewalls are really restrictive.

I can understand the work network policy, someone could use Tailscale to leak data, but a residential ISP should not block it. I would rather bother their support for an incomplete service.

Re: Tailscale is pretty useful

#315

Post by PLG88 »

apitman wrote: post #112
tsujamin wrote: post #35

The tailscale.com/tsnet package in Go [1] is really useful if you've not looked at it before: you can make single binary HTTP or whatever servers that are only exposed inside your tailnet. Their golink project [2] is a good example (and useful itself), but I've used it to build "peer to peer" comms for one application, and to host an API and Svelte SPA to control some other things in a tailnet. [1] https://pkg.go.dev…

See also OpenZiti: https://openziti.io/

For replacing port forwarding, OpenZiti definitely works. zrok, which is built on top of OpenZiti, could also be a great option for sharing resources - https://zrok.io/

Re: Tailscale is pretty useful

#316

Post by papichulo2023 »

gabeio wrote: post #185
Carrok wrote: post #165

Earlier quoted context omitted.

If you're using only key-auth and have password auth disabled, I'm not sure why unauthorized attempts are a problem.

> If you're using only key-auth and have password auth disabled, I'm not sure why unauthorized attempts are a problem. See xz vulnerability for more details. It’s about not trusting people with any of my ports/software (directly).

Did you vet all Tailgate infra? Because now your attack surface is way higher. Wouldnt surprise the xz is somewhere there as well.

Re: Tailscale is pretty useful

#318

Post by jpgvm »

We recently did a pretty big rollout of Tailscale and tbh I am presently surprised with how well it works. Between subnet routing to our bare metal stuff and the Kubernetes operator, especially the ability to expose services to the Tailnet has been a big win.

I was a doubter a bit as to how it would work at a bigger org but so far rock solid, easy to setup and great user experience.

Re: Tailscale is pretty useful

#319

Post by PLG88 »

apitman wrote: post #138

Tailscale is one of my favorite companies. They're clearly on to something. Here's a great post by their CTO explaining a lot of the motivation and vision behind it: https://crawshaw.io/blog/remembering-the-lan IMO the main outstanding questions/concerns are: * Is the VPN model really the way to go? If someone gets their hands on one of your Tailscale nodes, they can access every service on your tailnet, which are li…

Great insights, I think you will like OpenZiti, Anders, which is included in your list for both itself and zrok, which we built on top.

Directly answering your concerns:

- Deny by default and least privilege model means getting access to a node does not give you access to all services on the overlay. This includes SDKs so that only embedded apps are authorised, the apps have no listening ports on underlay and are literally unattackable via conventional IP-based tooling, all conventional network threats are immediately useless.

- Its open source nature means its being adopted by companies to create more powerful ecosystems.

- The overlay, while looking similar to DERP, uses individual service encryption and routing with flow control and smart routing (I know people who get much much better performance as a result).

- Our SDK includes a 'clientless' endpoint for the browser called BrowZer - https://blog.openziti.io/introducing-openziti-browzer. All users need to do it log into their IdP and everything else is done automatically, without involvement from the user.

- We don't build on Wireguard, which provides much more flexibility.

Re: Tailscale is pretty useful

#320

Post by jcgl »

gabeio wrote: post #155
phito wrote: post #66

Earlier quoted context omitted.

Yeah, I don't understand how it is so prevalent in the self-hosted community. I would never install this on my server, just use wireguard/openvpn ... edit: okay, CGNAT

> Yeah, I don't understand how it is so prevalent in the self-hosted community. Not just CGNAT but not having _any_ external ports open can be a beautiful thing. I used to have an ssh port (not on the standard 22) and the amount of auth attempts back then was insane. I now have a full firewall zero open ports but, thanks to tailscale, I can still safely access my machines while not being at home with zero unauthorize…

Wireguard, unlike SSH, behaves like a closed port unless the client successfully authenticates. As far as an unauthenticated client is concerned, you don't have a listening service ("opened port") at all.

I mean, yeah, if you unfortunately have to deal with CGNAT, then you gotta do what you gotta do. But other than that, what's the issue with self-hosting Wireguard?

Post reply on HN