Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Tailscale is pretty useful

blog.6nok.org

Post reply on HN
Print view View original

391–400 of 419 posts

Re: Tailscale is pretty useful

#391

Post by samstave »

datadeft wrote: post #335
samstave wrote: post #190

Earlier quoted context omitted.

> I can also access my home network easily. expand plz

So I have this small form box (it is hardly bigger then few mobile phones stacked on each other) and I run Tailscale on it as well (also as an exit node). I installed Tailscale on my MBP and mobile phones as well. Now it is forming a network where regardless of where I am in the world I can chose my home server as an exit node and also access the samba shares and the other devices (rpi3 and rpi4).

Imagine a network of tailscale droplets that allow for agents to exit via a tailscale node in their locale and do work - then funnel data back to master wherever...

(Like If I wanted to crawl an area in germany, but needed an exit tracert that originated there - a tailscale droplet that could be connected to, perform [object] and openly pipe data back to master?

Re: Tailscale is pretty useful

#392

Post by MattSayar »

pushcx wrote: post #46
EVa5I7bHFq9mnYK wrote: post #28

I remember Hamachi did the same as Tailscale in the 90s, we used it to play virtual LAN DOOM. Greed killed it.

I remember XBConnect and GameSpy for playing Xbox Halo 1 over the internet. I think a couple were invented for every big game or console before 2010 or so. Tailscale doesn't really address connecting to strangers, though.

Yes, XBConnect! Nevermind that you threw a grenade in Halo a whole 2 seconds after you pressed the button, you were playing with your friends! Good times.

Re: Tailscale is pretty useful

#393

Post by aborsy »

selfhoster wrote: post #371
aborsy wrote: post #251

Earlier quoted context omitted.

How is this a good solution, when traffic is decrypted in the cloud, all traffic goes through one node, there is no ACL, key distribution, static IP, …? Tailscale addressed those issues.

I guess I'm not clear what "when traffic is decrypted in the cloud" means but, here's how it works...public traffic comes in on port 80 to the VPS, Wireguard is configured to route it over the VPN to a VM on my home machine. I control the VPS and the peer receiving the traffic.

If the Wireguard server is run on VPS, the encryption is not end to end from the client in public internet to your home.

It’s encrypted from client to VPS, then from VPS to home. The VPS sees the traffic inside of tunnel. That’s the first problem.

Re: Tailscale is pretty useful

#394

Post by PLG88 »

concerndc1tizen wrote: post #390
PLG88 wrote: post #380

Earlier quoted context omitted.

OpenZiti is developed and maintained by NetFoundry ( https://netfoundry.io/ ). We provide a productised version which is very easy to deploy, manage, operate, and monitor with high SLAs, support, legal/compliance, liability, security, updates, feature requests etc. We are not rolling our own crypto, we use well vetted open source standards/implementations - https://openziti.io/docs/learn/core-concepts/security/connec…

Sounds great. It puzzles me that Nebula hasn't done what you're doing with OpenZiti. In my opinion, Kubernetes networking is flawed, in that service mesh authentication with mTLS has unnecessary overhead, Cilium network policies are clumsy using labels and work poorly with non-pod workloads (i.e. CIDR-based policies), multi-cluster is hacky, and external workloads are inconvenient to set up. So a simple plug-and-play…

My guess is that is how they want to commercialise, they make that bit harder so that more people pay for their hosted solution. I have sympathy, monetisation allowing maintaining FOSS can be a challenge. We all have bills.

I agree with a lot of what you say. Tbh, this is also why we are advocates of app-embedded ZTNA. You get mTLS (and way, way more) out of the box, without the overhead, and its super easy to run your K8S or non-K8s workloads anywhere. No need for VPNs, inbound FW ports, complex ACLs, L4 loadbalancers, public DNS and more. It is thus much easier to build distributed systems which are secure by default from network attacks.

Re: Tailscale is pretty useful

#395

Post by devilbunny »

thomastjeffery wrote: post #378
devilbunny wrote: post #216

Earlier quoted context omitted.

> Not only am I unable to forward ports, I can't even change my own WiFi password! You can't BYOD? I got a lot of info out of the install techs when my home fiber was installed, including the router password, because they saw my setup and said "whoa... this is not a normal person setup". I said no, it isn't, you want me to walk you through what I've got? They did. I ended up putting their device to DMZ all traffic to…

> when my home fiber was installed I live in an apartment. The router was here before me.

Ah, haven’t lived in an apartment since the late dialup era (2005). No sticker on the bottom with login info? Could you exchange it with the ISP?

I’m sure you have tried these, just spitballing about how I would try to deal with that…

Re: Tailscale is pretty useful

#396

Post by gabeio »

jcgl wrote: post #320
gabeio wrote: post #155

Earlier quoted context omitted.

> Yeah, I don't understand how it is so prevalent in the self-hosted community. Not just CGNAT but not having _any_ external ports open can be a beautiful thing. I used to have an ssh port (not on the standard 22) and the amount of auth attempts back then was insane. I now have a full firewall zero open ports but, thanks to tailscale, I can still safely access my machines while not being at home with zero unauthorize…

Wireguard, unlike SSH, behaves like a closed port unless the client successfully authenticates. As far as an unauthenticated client is concerned, you don't have a listening service ("opened port") at all. I mean, yeah, if you unfortunately have to deal with CGNAT, then you gotta do what you gotta do. But other than that, what's the issue with self-hosting Wireguard?

> But other than that, what's the issue with self-hosting Wireguard?

User simplicity. I am not the only one on my home network which I want to be able to access some parts of the things I build.

Device support. I appreciate that tailscale has gone out of their way to bring tailscale to even more devices than even wireguard supports. Namely apple tv, wireguard does support iOS but doesn't seem to currently support apple tv or maybe just my version of apple tv.

Re: Tailscale is pretty useful

#397

Post by idatum »

sfink wrote: post #262
idatum wrote: post #175

Earlier quoted context omitted.

I still find SSH adequate for connecting to a home server remotely. I don't have the CGNAT terrible problem but I also don't do any port forwarding on my home router. Instead, I have a VM running on a cloud provider that I SSH to from an OpenBSD box inside my home network. The SSH connection establishes a reverse SSH tunnel. This opens a port on the cloud VM to tunnel to my OpenBSD sshd port. With the reverse proxy t…

If I'm understanding correctly, this will break whenever the IP address of your tunnel changes. You'll have to reestablish all of your connections. My use case for tailscale: have an SSH (or other) connection to my home server while working from home. Drive to a coffee shop, register on their network, and continue using the same connection. (Or hotspot, if I'm somewhere without Wifi.) The IP address of my server does…

> If I'm understanding correctly, this will break whenever the IP address of your tunnel changes. You'll have to reestablish all of your connections.

The tunnel is on localhost only. The VM has a static IPv4/IPv6 with DNS.

Connecting the SSH tunnel from my home is stable as well as connecting to the VM remotely.

I do appreciate Tailscale and Wireguard. I was more responding to the fact that I don't have to trust any provider here, other than the one keeping my VM running.

Also, there's tmux for preserving sessions.

Re: Tailscale is pretty useful

#398

Post by godelski »

nulbyte wrote: post #351
godelski wrote: post #248

Earlier quoted context omitted.

> set up a private network between all your ~~Google-signed-in~~ devices. I've been doing something like this as a fun side project. Idea is to get everything to pass through piholes and have both clear and VPN exit nodes. So then I can send some pis to people and we can create an internal network to share things like files, movies, streaming services, whatever. It also can increase security, especially making it eas…

> So I can't just make a conditional in my config to go through TS instead of local network based on that Tailscale can do hairpinning, so you may find you don't need a conditional config.

Thanks I'll look into that.

Though part of my gripe is just not having this in general. I can want to work on a certain machine I don't open and if I'm on an internal network but if external I want to do a proxy jump. The ssid is the most obvious and consistent way to determine this, at least to me. Anyone got another idea?

Re: Tailscale is pretty useful

#399

Post by ghoshbishakh »

idatum wrote: post #397
sfink wrote: post #262

Earlier quoted context omitted.

If I'm understanding correctly, this will break whenever the IP address of your tunnel changes. You'll have to reestablish all of your connections. My use case for tailscale: have an SSH (or other) connection to my home server while working from home. Drive to a coffee shop, register on their network, and continue using the same connection. (Or hotspot, if I'm somewhere without Wifi.) The IP address of my server does…

> If I'm understanding correctly, this will break whenever the IP address of your tunnel changes. You'll have to reestablish all of your connections. The tunnel is on localhost only. The VM has a static IPv4/IPv6 with DNS. Connecting the SSH tunnel from my home is stable as well as connecting to the VM remotely. I do appreciate Tailscale and Wireguard. I was more responding to the fact that I don't have to trust any…

If you want to run a VM then no need of any tailscale etc. You can even run your own openvpn server right.

Re: Tailscale is pretty useful

#400

Post by aborsy »

idatum wrote: post #397
sfink wrote: post #262

Earlier quoted context omitted.

If I'm understanding correctly, this will break whenever the IP address of your tunnel changes. You'll have to reestablish all of your connections. My use case for tailscale: have an SSH (or other) connection to my home server while working from home. Drive to a coffee shop, register on their network, and continue using the same connection. (Or hotspot, if I'm somewhere without Wifi.) The IP address of my server does…

> If I'm understanding correctly, this will break whenever the IP address of your tunnel changes. You'll have to reestablish all of your connections. The tunnel is on localhost only. The VM has a static IPv4/IPv6 with DNS. Connecting the SSH tunnel from my home is stable as well as connecting to the VM remotely. I do appreciate Tailscale and Wireguard. I was more responding to the fact that I don't have to trust any…

This is for ssh. You mean you automate ssh port forwarding to access https and other services?
Post reply on HN