Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Tailscale is pretty useful

blog.6nok.org

Post reply on HN
Print view View original

41–50 of 419 posts

Re: Tailscale is pretty useful

#41

Post by yegle »

CGNAT _can_ make it easier to access your server.

If your Internet provider and your mobile provider is the same company, they could put all your connected devices in the same IP block within the CGNAT IP range.

Now, not only you can access your device at home while away using your cellphone, you can also connect to your partner's phone with the same IP address at (or away from) home.

Some Internet providers in China very recently started providing this service, e.g. https://www.chiphell.com/thread-2666772-1-1.html (in Chinese). In addition to the convenience of accessing your home server while on the go, they also make the traffic within the CGNAT free.

Re: Tailscale is pretty useful

#42

Post by stego-tech »

I've harped on some Tailscale implementations before for what I perceived to be nonsensical or bad approaches, but this one is an excellent example of its capabilities. In no particular order:

* It's not reliant on port forwarding at your firewall

* It can get around bad ISP habits, like CGNAT or a lack of IPv6 (or IPv4)

* As the OP points out, it's broadly compatible with various forms of exit nodes

Straightforward and to-the-point. Great writeup.

Re: Tailscale is pretty useful

#43

Post by smy20011 »

I use tailscale to build my personal podcast that include local weather and stocks I interested in. Running the whole pipeline on a steamdeck and use tailscale to securely delivery the generated podcast to my phone.

Re: Tailscale is pretty useful

#44

Post by Hikikomori »

baq wrote: post #31
jaxtracks wrote: post #3

The features here seem to be fairly standard with most the WireGuard based VPNs these days. For example, I use Nord for my use-case which is very similar to the author's. This allows me to rsync my home directory between my laptop, tablet, phone's Termux env, and desktop (all running Linux) to maintain configuration parity and file locality regardless of where I turn these devices on, so long as they have internet. D…

It just works, literally. I haven’t tried nord, but I’ve got clients on Mac, Linux, windows, rpis, it all just works. I used to run pivpn, but the key exchange magic Tailscale employs is so much simpler and it somehow works on networks blocking unknown packets like the pivpn I had set up on some random udp port.

How is it on Android? Tried different vpns to access my pihole but its really slow at resolving sometimes.

Re: Tailscale is pretty useful

#45

Post by nsbk »

laidoffamazon wrote: post #2

I love tailscale, but the performance overhead on file transfer (my primary use case for it) is very real. Samba transfers take a 15 megabyte per second hit over tailscale even with a fairly fast CPU on both ends (Ryzen 3600 and Ryzen 7900X3D) on my local network

It is indeed! I used to connect to a Synology NAS as remote backup location through Tailscale and the transfers would peak at around 5 MB/s.

Now I mount the NAS volumes to a host at the same location and sftp to it. It’s still dog slow at 30MB/s but that’s the NAS limitation.

Direct access to the NAS can also be achieved via Subnet Routers

https://tailscale.com/kb/1019/subnets

Re: Tailscale is pretty useful

#46

Post by pushcx »

EVa5I7bHFq9mnYK wrote: post #28

I remember Hamachi did the same as Tailscale in the 90s, we used it to play virtual LAN DOOM. Greed killed it.

I remember XBConnect and GameSpy for playing Xbox Halo 1 over the internet. I think a couple were invented for every big game or console before 2010 or so.

Tailscale doesn't really address connecting to strangers, though.

Re: Tailscale is pretty useful

#47

Post by sgc »

iamdamian wrote: post #38

I'm curious to hear well-informed reasons from this crowd for why we can trust Tailscale given the non-self-hosted part of the architecture? Does it come down to Tailnet locks [1], not worrying that Tailscale will be compromised, not worrying that your home network is worth compromising, or something else? [1]: https://tailscale.com/kb/1226/tailnet-lock

Use headscale: https://headscale.net/stable/

Re: Tailscale is pretty useful

#49

Post by stego-tech »

iamdamian wrote: post #38

I'm curious to hear well-informed reasons from this crowd for why we can trust Tailscale given the non-self-hosted part of the architecture? Does it come down to Tailnet locks [1], not worrying that Tailscale will be compromised, not worrying that your home network is worth compromising, or something else? [1]: https://tailscale.com/kb/1226/tailnet-lock

Call me Cappy Paranoid, but I fall into the camp of "You should never trust a service provider, ever," and build infrastructure accordingly; I believe this falls into an extreme interpretation of "zero trust".

So while also implementing Tailnet locks and other security measures to constrict traffic flow, I'd also consider going a step further by only permitting server or resource access based on client certificate validation (in other words, a client that's missing a trusted certificate is rejected from even attempting to initiate AuthN); that way even if your Tailscale network is compromised somehow, untrusted clients and endpoints can't make inroads into your infrastructure as easily.

Is that a gigantic PITA to implement? Oh heck, you betcha it is, and I doubt 99% of folks need to go that far with their homelabs or home services. Still, that'd be my approach to zero trust - trusting Tailscale only so far as enabling virtual networking, but not blindly trusting traffic coming over that network at any point.

Post reply on HN