Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Tailscale is pretty useful

blog.6nok.org

Post reply on HN
Print view View original

341–350 of 419 posts

Re: Tailscale is pretty useful

#341

Post by aborsy »

PLG88 wrote: post #322
stego-tech wrote: post #49

Earlier quoted context omitted.

Call me Cappy Paranoid, but I fall into the camp of "You should never trust a service provider, ever ," and build infrastructure accordingly; I believe this falls into an extreme interpretation of "zero trust". So while also implementing Tailnet locks and other security measures to constrict traffic flow, I'd also consider going a step further by only permitting server or resource access based on client certificate v…

Particularly as it does not include its own PKI, so E2EE is done by MITM your IdP (OICD/SAML etc) and therefore, under court order Tailscale can decrypt your traffic. We took the opposite approach with NetFoundry. (1) We open sourced the code ( https://openziti.io/ ), (2) we built in PKI with private keys generated at source and destination so that even if traversing NF hosted data plane, we CANNOT decrypt traffic, (…

First of all, a node added to tailnet doesn’t not have the ability to decrypt the traffic in tailnet. All it can do to contact other nodes, decrypt traffic users sent to that hidden node, or modify settings in admin console. Furthermore, with tail lock, the coordination server should not be able to add nodes from outside.

Can you clarify?

Re: Tailscale is pretty useful

#342

Post by robertlagrant »

harrall wrote: post #273
felbane wrote: post #247

Earlier quoted context omitted.

This baffles me. What's to maintain? I've been running wireguard for years and never had to do anything except scan a QR code when I get a new phone. By "as if it were public facing" I assume you mean locked down as much as possible using either router or host-based firewall rules?

By locked down I mean everything requires authentication (and authorization), everything is containerized, and I have fairly strict firewall defaults. Let me explain what I mean by low maintenance... I was a very early containerization adopter and set up a company and also my home network using Docker around 10 years ago. I chose Docker because I thought it was reasonably polished and was the future of deployment. Ev…

I think it's interesting that they support Kubernetes connections as well, so you can access the control plane, or send data in or out of an environment via Tailscale. I don't have a use for it myself, but it does seem useful.

Re: Tailscale is pretty useful

#343

Post by concerndc1tizen »

PLG88 wrote: post #319
apitman wrote: post #138

Tailscale is one of my favorite companies. They're clearly on to something. Here's a great post by their CTO explaining a lot of the motivation and vision behind it: https://crawshaw.io/blog/remembering-the-lan IMO the main outstanding questions/concerns are: * Is the VPN model really the way to go? If someone gets their hands on one of your Tailscale nodes, they can access every service on your tailnet, which are li…

Great insights, I think you will like OpenZiti, Anders, which is included in your list for both itself and zrok, which we built on top. Directly answering your concerns: - Deny by default and least privilege model means getting access to a node does not give you access to all services on the overlay. This includes SDKs so that only embedded apps are authorised, the apps have no listening ports on underlay and are lit…

How does OpenZiti compare to Nebula?

What does it do better/worse, and are the use cases different?

Re: Tailscale is pretty useful

#344

Post by _jsdp »

- Install & authenticate on all your machines

- Boom, everything works

- Internet? feels like local-net

This is just brilliant tech. Thank you so much for building this guys and the amazing effort that goes behind it everyday

Re: Tailscale is pretty useful

#345

Post by dharmab »

EQYV wrote: post #306
dharmab wrote: post #265

Earlier quoted context omitted.

I used to host an Arma 3 server using Kubernetes, I had a scalable set of headless clients to distribute the AI load. My friends called said it was the smoothest server they ever played on despite using hundreds of AI groups. With Tailscale I wouldn't have needed host networking enabled on the Pods, come to think of it.

What do you mean by AI groups in this case?

The CPU controlled squads of enemy soldiers and vehicles the players shoot. Arma is a first-person shooter game. The game engine it uses is not heavily multi-threaded, but the multiplayer system has some weird quirks that you can exploit to distribute AI processing across multiple networked instances, either in a multi-core or multi-machine topology.

Re: Tailscale is pretty useful

#346

Post by PLG88 »

concerndc1tizen wrote: post #343
PLG88 wrote: post #319

Earlier quoted context omitted.

Great insights, I think you will like OpenZiti, Anders, which is included in your list for both itself and zrok, which we built on top. Directly answering your concerns: - Deny by default and least privilege model means getting access to a node does not give you access to all services on the overlay. This includes SDKs so that only embedded apps are authorised, the apps have no listening ports on underlay and are lit…

How does OpenZiti compare to Nebula? What does it do better/worse, and are the use cases different?

I will preface by saying I am not a Nebula expert, and it may have changed since I last looked.

Similarities: - Fully open source, using CAs as strong identities (rather than relying on SSO from third parties), completely self-hosted (with 3rd party SaaS options), and providing scalable, performant overlay networking.

Differences:

- OpenZiti is focused on connecting services based on zero trust principles. In contrast, Nebula focuses on connecting machines – e.g., you can authorize only a single port without needing to set up ACLs or firewall rules.

- OpenZiti does not require inbound ports or hole punching, it builds outbound only connections via an overlay which looks sort of similar to DERP (but better with app specific encryption, routing, flow control, smart routing etc). This overlay also removes need for complex FW rules, ACLs, public DNS, L4 loadbalancers, etc.

- As alluded to above, truly private, zero trust DNS entries with unique naming – if you wanted to call your service "my.secret.service", you can do that; it does not force you to have a valid Top Level Domain.

- OpenZiti includes SDKs (along with appliance or host based tunnels) to bring overlay networking and zero trust principles directly into your application.

- FOSS Nebula does not include "provisioning new clients with identities", as this person pointed out in our public forum - https://openziti.discourse.group/t/using-openziti-in-distrib...

Re: Tailscale is pretty useful

#347

Post by devilbunny »

kdmtctl wrote: post #314
devilbunny wrote: post #203

Earlier quoted context omitted.

Intriguingly, my work network (both guest and employee networks) blocks OpenVPN, commercial VPN (Proton I use, plus a couple of others I tried just as an experiment), and Tailscale authentication , but if the device is already authenticated to the tailnet, it will continue to work. Turns out that work uses the same ISP my home does, so perhaps that's part of it, but I have another TS exit node running at my in-laws'…

It's easy to block the control plane because Tailscale has endpoints listing all current control and DERP servers. On Linux you can use a SOCKS proxy for control plane traffic, if connections still work. Some firewalls are really restrictive. I can understand the work network policy, someone could use Tailscale to leak data, but a residential ISP should not block it. I would rather bother their support for an incompl…

My residential ISP does not block it. My issue with work isn’t that they block it on employee WiFi, it’s that they block it on the guest network too. Our nanny software is rather extreme - blocks, for example, alcohol-related sites. Which in a sense is fine, because I don’t need to read up on whiskey at work, but it also often blocks restaurant sites.

Re: Tailscale is pretty useful

#348

Post by LiquidFlux »

mafro wrote: post #272
tsujamin wrote: post #35

The tailscale.com/tsnet package in Go [1] is really useful if you've not looked at it before: you can make single binary HTTP or whatever servers that are only exposed inside your tailnet. Their golink project [2] is a good example (and useful itself), but I've used it to build "peer to peer" comms for one application, and to host an API and Svelte SPA to control some other things in a tailnet. [1] https://pkg.go.dev…

I've been using tailscale/tailscale-caddy[1] successfully to serve applications only on my tailnet. It says highly experimental, but it's worked just fine for me. [1] https://github.com/tailscale/caddy-tailscale

Another option to consider would be TSDProxy.

https://github.com/almeidapaulopt/tsdproxy

Re: Tailscale is pretty useful

#349

Post by PLG88 »

aborsy wrote: post #341
PLG88 wrote: post #322

Earlier quoted context omitted.

Particularly as it does not include its own PKI, so E2EE is done by MITM your IdP (OICD/SAML etc) and therefore, under court order Tailscale can decrypt your traffic. We took the opposite approach with NetFoundry. (1) We open sourced the code ( https://openziti.io/ ), (2) we built in PKI with private keys generated at source and destination so that even if traversing NF hosted data plane, we CANNOT decrypt traffic, (…

First of all, a node added to tailnet doesn’t not have the ability to decrypt the traffic in tailnet. All it can do to contact other nodes, decrypt traffic users sent to that hidden node, or modify settings in admin console. Furthermore, with tail lock, the coordination server should not be able to add nodes from outside. Can you clarify?

Comment edited due to an incorrect understand which has been rectified.
Post reply on HN