Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Tailscale is pretty useful

blog.6nok.org

Post reply on HN
Print view View original

361–370 of 419 posts

Re: Tailscale is pretty useful

#361

Post by 1oooqooq »

kortilla wrote: post #192

> But my old Raspberry Pi was too weak to run it, so I ended up uninstalling it, and unrelatedly my pet project grew out and has its place in the cloud now. It’s incredible how shitty modern software is that a raspberry pi couldn’t run a basic VPN. If any tailscale devs see this you should try to reproduce this issue and use it as an opportunity to clean up a bunch of dumb assumptions that likely hurt real users as w…

i always evaluate TS, the see the enterprisey crap it is and just keep ssh without being brain dead about unix auth and user management.

honestly, not sure what's all the hype. ssh under wg with sane user management and key distribution cover 110% of the TS use cases. and thebonly difficult part is the key distribution but that should be difficult by design otherwise you're doingnit wrong anyway. you can even resuse the ssh keys for the wg tunnel if you're smart about it.

Re: Tailscale is pretty useful

#362

Post by linsomniac »

eddieroger wrote: post #130
haswell wrote: post #64

Earlier quoted context omitted.

What are the primary downsides of self-hosting this? The top issues that come to mind: 1. Maintaining high availability 2. Dealing with patches/upgrades But I'm also really curious how likely a self-hosted instance is to be an attack vector potentially more dangerous than using something like Tailscale.

> 1. Maintaining high availability In my experience as a poor sysadmin (as in, bad), you don't /need/ HA for Headscale because the clients are pretty resilient. I've had my instance go down for a little bit and it's fine. Stale and new connections aren't, obviously, but it will work well enough that you won't realize Headscale itself has gone down until a while after it did.

My experience has been the opposite: I have to restart headscale at night because a significant %age of the time when I do, the tailnet goes down. I'd say maybe 30% of the time, maybe more. I'm talking about when I update ACLs and OS updates. I run a single instance, and I will say it's been reliable over ~2 years. For the record, I just rebooted that node for OS updates and the tailnet stayed up.

Re: Tailscale is pretty useful

#363

Post by genpfault »

yjftsjthsd-h wrote: post #26
jaxtracks wrote: post #3

The features here seem to be fairly standard with most the WireGuard based VPNs these days. For example, I use Nord for my use-case which is very similar to the author's. This allows me to rsync my home directory between my laptop, tablet, phone's Termux env, and desktop (all running Linux) to maintain configuration parity and file locality regardless of where I turn these devices on, so long as they have internet. D…

What other VPNs do mesh networking? I only know of zerotier (proprietary) and nebula (FOSS except that the Android app is proprietary)

Tinc[1]

[1]: https://github.com/gsliepen/tinc

Re: Tailscale is pretty useful

#364

Post by apitman »

VikingCoder wrote: post #252
apitman wrote: post #138

Tailscale is one of my favorite companies. They're clearly on to something. Here's a great post by their CTO explaining a lot of the motivation and vision behind it: https://crawshaw.io/blog/remembering-the-lan IMO the main outstanding questions/concerns are: * Is the VPN model really the way to go? If someone gets their hands on one of your Tailscale nodes, they can access every service on your tailnet, which are li…

I personally feel like paid DERP is unfortunately the way of the future.

I think paid DERP could be an excellent model, especially since it lends itself well to small local companies that offer service for 5-10USD/mo.

I'm mostly concerned about whether the DERP protocol can scale in that way.

Re: Tailscale is pretty useful

#365

Post by linsomniac »

DictumMortuum wrote: post #329

Also check out zerotier. I've been using it because it has a lot more features that tailscale (although it's been 4-5 years that I have the zerotier network set up). Pretty damn useful to connect to services in my internal network wherever I go. I have it set up on my router, so I don't need to install it on every single server in the house :D

ZeroTier is definitely very good. I came very close to using it instead of Tailscale at work. One of the big reasons I didn't was I had asked sales a question about redundancy and they said "we've never gone down", so I quoted a tweet from them saying "Our control plane is coming back after the outage" and asked about it, and never got a reply.

I'm looking at setting up a VPN for my services at home and am considering ZeroTier or Nebula. Tailscale is out because I already have a tailnet and you can only have one (you have to switch networks if you have multiple).

I kind of regret not having used Nebula instead of Tailscale, because it gets rid of the control plane and it has less "magic" to it. Though Nebula seems to be moving much slower as far as improvements. I also checked out defined.net for nebula hosting, but at that time they were just starting to work on their API and I absolutely needed that because we have hosts that respin and join our net every night.

Re: Tailscale is pretty useful

#366

Post by apitman »

LeoPanthera wrote: post #254
apitman wrote: post #138

Tailscale is one of my favorite companies. They're clearly on to something. Here's a great post by their CTO explaining a lot of the motivation and vision behind it: https://crawshaw.io/blog/remembering-the-lan IMO the main outstanding questions/concerns are: * Is the VPN model really the way to go? If someone gets their hands on one of your Tailscale nodes, they can access every service on your tailnet, which are li…

> install a VPN app on all their devices I run it on my router, providing access to the entire subnet, so it doesn't have to be all your devices.

That's a useful tool. But you lose all the Tailscale security features like ACLs in that case right?

And configuring a router also isn't something most people can/will do.

Re: Tailscale is pretty useful

#367

Post by Valien »

apitman wrote: post #138

Tailscale is one of my favorite companies. They're clearly on to something. Here's a great post by their CTO explaining a lot of the motivation and vision behind it: https://crawshaw.io/blog/remembering-the-lan IMO the main outstanding questions/concerns are: * Is the VPN model really the way to go? If someone gets their hands on one of your Tailscale nodes, they can access every service on your tailnet, which are li…

Psst...did you say browsers?

https://github.com/tailscale/ts-browser-ext

super experimental but really cool

Re: Tailscale is pretty useful

#368

Post by jFriedensreich »

I really love tailscales offering but the performance was just significantly worse compared to cloudflare.one to the level of switching back and biting the bitter pill of fully depending on orange cloud for everything as well as having sub par usability compared to tailscale or even the rest of cloudflare.

Re: Tailscale is pretty useful

#370

Post by selfhoster »

codetrotter wrote: post #261
selfhoster wrote: post #238

Earlier quoted context omitted.

> Unless like OP your ISP has put CGNAT on you. I run Wireguard on a VPS and route public traffic with it over Wireguard to my home machine. Are you saying my ISP must not be CGNAT or else it wouldn't work?

No. I was talking specifically about the case where you want to host the Wireguard VPN server at home. See earlier in the comment where I said: > opening up a port for it for inbound connections if you host it from your home connection rather than a rented server Although I can see how it might not be clear that in the end where I’m mentioning CGNAT I am still specifically talking about hosting the VPN server from yo…

That makes sense, I forgot people also expose a server at home the way I do on the VPS then route to a peer at home. Appreciate the insight.
Post reply on HN