Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Tailscale is pretty useful

blog.6nok.org

Post reply on HN
Print view View original

331–340 of 419 posts

Re: Tailscale is pretty useful

#331

Post by prennert »

notsylver wrote: post #181
jdolak wrote: post #145

Earlier quoted context omitted.

On your first point, I've been using tailscale for a bit and its ACL feature addresses most of my concerns there. My laptop can ssh into any of my servers but not the other way around, and my servers cant talk to each other unless I set them to.

Could you share your ACL setup? I haven't had time to look at it much but this sounds like exactly what I want to do.

The ACLs might look a bit scary at first, but they are actually quite intuitive once you coded up a rule or two.

It basically works by tagging machines (especially those deployed with an API key) and grouping users. Then you set up rules which allow groups and tags can communicate with each other on specific ports. Since the default rule is DENY, you only need to specify rules for communication you actually want to allow.

For instance you would create a tag for `servers` and a group for `sre`. Then you setup an ACL rule like this to allow SRE to ssh into servers:

    "action": "accept",
    "src":    ["group:sre"],
    "dst": ["tag:server:22"]
Because there is no rule with `group:sre` in `src` and `dst`, SREs cannot connect to each others machines.

The tailscale docs are really good. And the videos they have are a great starting point if you dont come from a networking background.

[0]: https://tailscale.com/kb/1018/acls

Re: Tailscale is pretty useful

#332

Post by 9dev »

bboreham wrote: post #310
9dev wrote: post #296

Earlier quoted context omitted.

Consider `db` resolves to multiple A records: db. IN A 100.64.123.1 # prod-db-1. db. IN A 100.64.123.2 # prod-db-2. db. IN A 100.64.123.3 # prod-db-3. This is good for service discovery—e.g., you can configure something like RabbitMQ to discover cluster members from an A record—and it's nice for browsers, which will pick one host at random when connecting, which effectively is load balancing. In a usual setup, the pr…

Nit: the host is not picked at random, but according to the RFC3484 algorithm. Since people typically don’t believe me about this, here it is from someone who has done a lot of networking programming: https://daniel.haxx.se/blog/2012/01/03/getaddrinfo-with-roun...

Arghh. I want to love IPv6, but they really work hard against it, don't they.

Thanks, I didn't know this!

Re: Tailscale is pretty useful

#333

Post by greenicon »

globular-toast wrote: post #158

Is Tailscale useful if you don't have CGNAT? I solve the problem in the article using Wireguard on my router and a dyndns client. In a way I think all these solutions just keep enabling IPv4 to continue and that sucks. Does Tailscale offer anything in an IPv6 world? Are they another company with an interest in stopping IPv6 progress?

Wireguard does not re-resolve dns when your dyndns ip changes. This ip change is common in parts of Europe where it usually changes daily. To circumvent this you need a jumphost or similar. This again brings additional issues when you don’t want to go through the jumphost when at home (I use nftables-magic on the router, but it’s not very nice).

Re: Tailscale is pretty useful

#334

Post by esjeon »

xyst wrote: post #221

I like tailscale as a replacement for the dogshit enterprise VPNs I have had to use in the past (looking at you, ZScaler). But for personal/single home use it’s overkill. I used to run a WireGuard server on a raspberry pi with ddns to update dns record on an as needed basis. Eventually replaced it with my gateways built in WireGuard server which also has ddns enabled The use cases described by the author are taken ca…

Yup, port forwarding is always a big win over any VPN, for real. No random stutter, no random disconnection, no random DERP fallback. It's just that ISPs are killing home port forwarding with CGNAT.

Re: Tailscale is pretty useful

#335

Post by datadeft »

samstave wrote: post #190
datadeft wrote: post #188

It is one of the tools I use as well and I pay for it. It makes life so much easier. At work we have to test a lot of country dependent settings and with TS and Mullvad is is very simple. I can also access my home network easily.

> I can also access my home network easily. expand plz

So I have this small form box (it is hardly bigger then few mobile phones stacked on each other) and I run Tailscale on it as well (also as an exit node). I installed Tailscale on my MBP and mobile phones as well. Now it is forming a network where regardless of where I am in the world I can chose my home server as an exit node and also access the samba shares and the other devices (rpi3 and rpi4).

Re: Tailscale is pretty useful

#337

Post by jonathantf2 »

ashfn wrote: post #311
o1o1o1 wrote: post #279

Earlier quoted context omitted.

I'd be very interested, is there someone who could elaborate please? I'm terrified using a service like Vercel because I heard about the massive cost trap that can hit you hard and I don't know if there is any alternative for (easily & quickly) hosting NextJS apps.

Its relatively straightforward to host a nextjs app in a docker container and route it with nginx and cloudflare, but you probably wont get as good uptime

Better uptime than having to take it down bc it got hugged though

Re: Tailscale is pretty useful

#339

Post by sunshine-o »

The main advantage of Tailscale for most is it allows to avoid having a fixed IP address/DNS, and keep all ports closed.

As long as you trust them this really give you a lot of security at a very low cost.

Re: Tailscale is pretty useful

#340

Post by wh33zle »

yamrzou wrote: post #50

Is there an alternative to Tailscale with a lower memory footprint? I wanted to run Tailscale on a small router, but it failed due to out-of-memory (OOM) issues.

How low do you need the footprint? At firezone.dev, we also build a ZT product and our headless-client and Gateway are in Rust and use around 15-30 MB of RAM. Could likely be tuned further down if you need it :)
Post reply on HN