Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Tailscale is pretty useful

blog.6nok.org

Post reply on HN
Print view View original

371–380 of 419 posts

Re: Tailscale is pretty useful

#371

Post by selfhoster »

aborsy wrote: post #251
selfhoster wrote: post #238

Earlier quoted context omitted.

> Unless like OP your ISP has put CGNAT on you. I run Wireguard on a VPS and route public traffic with it over Wireguard to my home machine. Are you saying my ISP must not be CGNAT or else it wouldn't work?

How is this a good solution, when traffic is decrypted in the cloud, all traffic goes through one node, there is no ACL, key distribution, static IP, …? Tailscale addressed those issues.

I guess I'm not clear what "when traffic is decrypted in the cloud" means but, here's how it works...public traffic comes in on port 80 to the VPS, Wireguard is configured to route it over the VPN to a VM on my home machine. I control the VPS and the peer receiving the traffic.

Re: Tailscale is pretty useful

#372

Post by gabeio »

papichulo2023 wrote: post #316
gabeio wrote: post #185

Earlier quoted context omitted.

> If you're using only key-auth and have password auth disabled, I'm not sure why unauthorized attempts are a problem. See xz vulnerability for more details. It’s about not trusting people with any of my ports/software (directly).

Did you vet all Tailgate infra? Because now your attack surface is way higher. Wouldnt surprise the xz is somewhere there as well.

> Did you vet all Tailgate infra?

> I use the tailscale lock feature so not even tailscale themselves can add nodes to my network.

https://tailscale.com/blog/tailnet-lock

https://tailscale.com/kb/1226/tailnet-lock

Re: Tailscale is pretty useful

#373

Post by o1o1o1 »

frontsideair wrote: post #293
o1o1o1 wrote: post #279

Earlier quoted context omitted.

I'd be very interested, is there someone who could elaborate please? I'm terrified using a service like Vercel because I heard about the massive cost trap that can hit you hard and I don't know if there is any alternative for (easily & quickly) hosting NextJS apps.

That’s exactly why I put the spend limit, and this was the first time to confirm that it actually works.

Good to know that this is possible, thank you!

Re: Tailscale is pretty useful

#374

Post by ramses0 »

yjftsjthsd-h wrote: post #284
ramses0 wrote: post #85

See also Nebula: https://nebula.defined.net/docs/ https://nebula.defined.net/docs/guides/quick-start/ ...I believe 100% open source. You can basically hub between different devices (including iOS/Android) that are identified via certs. Recommended to have one or more public "lighthouses" so anything that can reach a lighthouse can reach any of your other servers (maybe kindof "syncthing for vpn/overlay-network?"). I'…

The Nebula Android app is not open source:( That's why I dropped it, personally. https://github.com/DefinedNet/mobile_nebula/issues/19#issuec... https://github.com/DefinedNet/mobile_nebula/issues/142

Source Available vs Open Source on a monetizable/enterprise component? There are worse tradeoffs one could make, but thanks for pointing it out!

Re: Tailscale is pretty useful

#375

Post by o1o1o1 »

ashfn wrote: post #311
o1o1o1 wrote: post #279

Earlier quoted context omitted.

I'd be very interested, is there someone who could elaborate please? I'm terrified using a service like Vercel because I heard about the massive cost trap that can hit you hard and I don't know if there is any alternative for (easily & quickly) hosting NextJS apps.

Its relatively straightforward to host a nextjs app in a docker container and route it with nginx and cloudflare, but you probably wont get as good uptime

Thank you for the advice, didn't consider using docker instead and saw a lot of potential alternatives to Vercel for self-hosting which support a great deployment experience (Caprover, Dokploy, Coolify, Stacktape etc.).

Re: Tailscale is pretty useful

#376

Post by VikingCoder »

apitman wrote: post #364
VikingCoder wrote: post #252

Earlier quoted context omitted.

I personally feel like paid DERP is unfortunately the way of the future.

I think paid DERP could be an excellent model, especially since it lends itself well to small local companies that offer service for 5-10USD/mo. I'm mostly concerned about whether the DERP protocol can scale in that way.

I think if there's revenue, they will revise and scale.

I suspect it'll be more complicated than a flat subscription, which is unfortunate. I think it'll be a combination of bytes and number of connections.

Re: Tailscale is pretty useful

#377

Post by Toutouxc »

briHass wrote: post #291
freetime2 wrote: post #249

I'm thinking about exposing some services outside of my LAN, and wondering whether it would be better to go with Tailscale or Cloudflare Tunnel. [1]. At a high-level both solutions seems pretty similar, with a client service running on the machine you want to share. My sense is that tailscale makes sense for a more locked-down service that is not accessible to the general public (although they do have a way to open u…

Good luck with CF's Tunnel. It may have been the complexity of my network at work, but I wasted a day trying to get that to work. Endless web setup 'wizards' and clicking around different components and their settings in the CF portal. It felt like trying to build out a moderately complicated cloud infra environment. Tailscale is dead simple, even to create 'routers' that act more like a VPN appliance inside your net…

I'm very happy with Cloudflare Tunnel on the free tier. Setting it up didn't feel that complex, you just install a client app, link it to your account/domain and then go through their equivalent of setting up nginx, i.e. assign hostnames to ports, and you can even do that through the web interface.

Yes, Cloudflare has tons of functionality you probably won't need and their dashboards can be several layers deep, but just setting up the tunnel with HTTPS and some basic security takes one evening at most.

Re: Tailscale is pretty useful

#378

Post by thomastjeffery »

devilbunny wrote: post #216
thomastjeffery wrote: post #40

In other words (they do get to this point right away), port forwarding is pretty useful, and most of us don't have it anymore. I'm sick and tired of the way ISPs treat us. It's literally written into my lease what company I will pay for internet, and how much I will pay them. It is not , however, written in my lease how fast the connection will be . Not only am I unable to forward ports, I can't even change my own Wi…

> Not only am I unable to forward ports, I can't even change my own WiFi password! You can't BYOD? I got a lot of info out of the install techs when my home fiber was installed, including the router password, because they saw my setup and said "whoa... this is not a normal person setup". I said no, it isn't, you want me to walk you through what I've got? They did. I ended up putting their device to DMZ all traffic to…

> when my home fiber was installed

I live in an apartment. The router was here before me.

Re: Tailscale is pretty useful

#379

Post by concerndc1tizen »

PLG88 wrote: post #346
concerndc1tizen wrote: post #343

Earlier quoted context omitted.

How does OpenZiti compare to Nebula? What does it do better/worse, and are the use cases different?

I will preface by saying I am not a Nebula expert, and it may have changed since I last looked. Similarities: - Fully open source, using CAs as strong identities (rather than relying on SSO from third parties), completely self-hosted (with 3rd party SaaS options), and providing scalable, performant overlay networking. Differences: - OpenZiti is focused on connecting services based on zero trust principles. In contras…

Sounds amazing and like it addresses my issues with Nebula. I know that Nebula/Defined Networks was/is working on better Kubernetes integration, but it seems unlikely to become generally available. Is that something you're supporting? i.e. as pod sidecar to authenticate services like nebula has ACL.

What's your funding model? Are enterprises willing to sponsor the development?

I think Nebula has a lot of trust solely because it's made at/used by Slack. In a similar sense, why should enterprises trust OpenZiti? If services do not use e2ee (e.g. service mesh with TLS) but rely on OpenZiti, it places a lot of trust in OpenZiti. How has the code been audited? Why are you confident that it's cryptographic implementation is secure?

Re: Tailscale is pretty useful

#380

Post by PLG88 »

concerndc1tizen wrote: post #379
PLG88 wrote: post #346

Earlier quoted context omitted.

I will preface by saying I am not a Nebula expert, and it may have changed since I last looked. Similarities: - Fully open source, using CAs as strong identities (rather than relying on SSO from third parties), completely self-hosted (with 3rd party SaaS options), and providing scalable, performant overlay networking. Differences: - OpenZiti is focused on connecting services based on zero trust principles. In contras…

Sounds amazing and like it addresses my issues with Nebula. I know that Nebula/Defined Networks was/is working on better Kubernetes integration, but it seems unlikely to become generally available. Is that something you're supporting? i.e. as pod sidecar to authenticate services like nebula has ACL. What's your funding model? Are enterprises willing to sponsor the development? I think Nebula has a lot of trust solely…

OpenZiti is developed and maintained by NetFoundry (https://netfoundry.io/). We provide a productised version which is very easy to deploy, manage, operate, and monitor with high SLAs, support, legal/compliance, liability, security, updates, feature requests etc.

We are not rolling our own crypto, we use well vetted open source standards/implementations - https://openziti.io/docs/learn/core-concepts/security/connec.... If you don't trust that, you can easily roll your own - https://github.com/openziti/tlsuv/blob/main/README.md. I know people who do that. Yes, its been audited, and run my many large enterprises in security conscious use cases - e.g., 8 of the 10 largest banks, some of the largest defence contractors, leaders in ICS/OT automation as well as grid etc.

Yes, we support K8S in a lot of ways, both for tunnelling and deployement - https://openziti.io/docs/reference/tunnelers/kubernetes/. There are more native options being worked on incl. Admission Controller and Ingress Controller but I honestly don't know the exact status of either. If they interest you, feel free to ping me on philip.griffiths@netfoundry.io. I can get more info.

Post reply on HN