Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Tailscale is pretty useful

blog.6nok.org

Post reply on HN
Print view View original

411–419 of 419 posts

Re: Tailscale is pretty useful

#411

Post by TNorthover »

PLG88 wrote: post #346
concerndc1tizen wrote: post #343

Earlier quoted context omitted.

How does OpenZiti compare to Nebula? What does it do better/worse, and are the use cases different?

I will preface by saying I am not a Nebula expert, and it may have changed since I last looked. Similarities: - Fully open source, using CAs as strong identities (rather than relying on SSO from third parties), completely self-hosted (with 3rd party SaaS options), and providing scalable, performant overlay networking. Differences: - OpenZiti is focused on connecting services based on zero trust principles. In contras…

> - OpenZiti does not require inbound ports or hole punching, it builds outbound only connections via an overlay which looks sort of similar to DERP (but better with app specific encryption, routing, flow control, smart routing etc). This overlay also removes need for complex FW rules, ACLs, public DNS, L4 loadbalancers, etc.

The routers that you deploy to make up the overlay still need inbound ports though, right? I thought that's what 10080 was doing.

Re: Tailscale is pretty useful

#412

Post by dovholuknf »

TNorthover wrote: post #411
PLG88 wrote: post #346

Earlier quoted context omitted.

I will preface by saying I am not a Nebula expert, and it may have changed since I last looked. Similarities: - Fully open source, using CAs as strong identities (rather than relying on SSO from third parties), completely self-hosted (with 3rd party SaaS options), and providing scalable, performant overlay networking. Differences: - OpenZiti is focused on connecting services based on zero trust principles. In contras…

> - OpenZiti does not require inbound ports or hole punching, it builds outbound only connections via an overlay which looks sort of similar to DERP (but better with app specific encryption, routing, flow control, smart routing etc). This overlay also removes need for complex FW rules, ACLs, public DNS, L4 loadbalancers, etc. The routers that you deploy to make up the overlay still need inbound ports though, right? I…

Maintainer here. Yes. The routers and the controller will have a port that can accept mTLS traffic.

Re: Tailscale is pretty useful

#413

Post by PLG88 »

TNorthover wrote: post #411
PLG88 wrote: post #346

Earlier quoted context omitted.

I will preface by saying I am not a Nebula expert, and it may have changed since I last looked. Similarities: - Fully open source, using CAs as strong identities (rather than relying on SSO from third parties), completely self-hosted (with 3rd party SaaS options), and providing scalable, performant overlay networking. Differences: - OpenZiti is focused on connecting services based on zero trust principles. In contras…

> - OpenZiti does not require inbound ports or hole punching, it builds outbound only connections via an overlay which looks sort of similar to DERP (but better with app specific encryption, routing, flow control, smart routing etc). This overlay also removes need for complex FW rules, ACLs, public DNS, L4 loadbalancers, etc. The routers that you deploy to make up the overlay still need inbound ports though, right? I…

Yes, but the risk posture is very different. The question I like to ask is, 'what does it take to exploit a listening port on the overlay to get to a service':

- (1) need to bypass the mTLS requirement necessary to connect to the data plane (note, each hope is uses its own mTLS with its own, separate key).

- (2) have a strong identity that authorizes them to connect to the remote service in question (or bypass the authentication layer the controller provides through exploits; note again, each app uses separate and distinct E2EE, routing, and keys)

- (3) know what the remote service name is, allowing the data to target the correct service (not easy as OpenZiti has its own private DNS that does not need to comply to TLDs)

- (4) bypass whatever "application layer" security is also applied at the service (ssh, https, oauth, whatever)

- (5) know how to negotiate the end to end encrypted tunnel to the 'far' identity

So yes, if they can do all that, then they'd definitely be able to attack that remote service. Note, they only have access to 1 single service among hundreds, thousands, or potentially millions of services. Lateral movement is no possible. So the attacker would have to repeat each of the 5 steps for every service.

A colleague wrote this too, its from a slightly different angle but still very relevant - https://blog.openziti.io/no-listening-ports.

Re: Tailscale is pretty useful

#414

Post by RGBCube »

danudey wrote: post #120
Trumpi wrote: post #6

I was once in South Africa and needed to look up my prescriptions in the CVS app. I had lost my pills and needed to show a local pharmacist what I needed. CVS geoblocked me. Luckily I had a TailScale exit node running at home, which solved the problem.

I was on a cruise ship a few weeks ago and realized that, instead of being throttled, a lot of sites were completely blocked. Very irritating. They also do DPI on the cruise ship network so that VPN clients like OpenVPN are blocked regardless of port. Without a laptop handy, I had to use my iPhone to set up a droplet running Ubuntu, then install vray onto it and configure it to run on port 443. vray uses "standard" S…

I'm pretty sure it would work. From my testing, Tailscale works where Shadowsocks, plain Wireguard and any other VPN don't. And it also works to pierce through the great F*W, which was actually really surprising. I suppose Tailscale has DERP and other nodes in Cn too?

Re: Tailscale is pretty useful

#415

Post by RGBCube »

aborsy wrote: post #258

Tailscale is not just a wrapper around Wireguard, as some people imply in the comments. The codebase is far bigger, and it does far more. They are different products. What Tailscale does is difficult to do with Wireguard: Easy VPN, SSO with MFA, key distribution, static private IP for each node, peer to peer direct connectivity, split tunneling, fine grained access control rules down to per port and application, Wire…

You can completely selfhost a control server, using Headscale: https://headscale.net>

It's completely OSS, just like the Android & Linux clients.

Re: Tailscale is pretty useful

#416

Post by Andrew_nenakhov »

JFingleton wrote: post #309
hn_throwaway_99 wrote: post #287

Earlier quoted context omitted.

But what you're referring to as a "VPN app" is something very different than what the parent poster is referring to with respect to what Tailscale is. When you use services like NordVPN, Mullvad, Surfshark, etc., you're just installing a VPN client , and you're basically just using them as a reverse proxy to hide your IP address (present it as coming from another country). That is the use case you are talking about.…

Indeed. VPNs were originally created to allow secure remote connections to and between LANs. The whole privacy thing is a by-product, and they're not that great at it. Tor exists and is far better at providing privacy.

Tor is far to easily blocked, and given that a great number of nodes are compromised, it is likely it is far worse at providing privacy than some self-hosted vpn on some cheap hosting.

Re: Tailscale is pretty useful

#417

Post by PLG88 »

concerndc1tizen wrote: post #390
PLG88 wrote: post #380

Earlier quoted context omitted.

OpenZiti is developed and maintained by NetFoundry ( https://netfoundry.io/ ). We provide a productised version which is very easy to deploy, manage, operate, and monitor with high SLAs, support, legal/compliance, liability, security, updates, feature requests etc. We are not rolling our own crypto, we use well vetted open source standards/implementations - https://openziti.io/docs/learn/core-concepts/security/connec…

Sounds great. It puzzles me that Nebula hasn't done what you're doing with OpenZiti. In my opinion, Kubernetes networking is flawed, in that service mesh authentication with mTLS has unnecessary overhead, Cilium network policies are clumsy using labels and work poorly with non-pod workloads (i.e. CIDR-based policies), multi-cluster is hacky, and external workloads are inconvenient to set up. So a simple plug-and-play…

You comment kicked off a big internal chat, which led to someone creating a document on our overlay approach, vs service meshes. I took that, wrote some extra details, comparison and summary - https://docs.google.com/document/d/1ih-kuRvfiGrJODZ5zVjwFLC2....

TL:DR, we believe service meshes introduce complexity with control plane synchronization, service discovery challenges, and network overlays. A Global Overlay removes Kubernetes service dependencies and shifting networking to a Zero Trust, software-defined global overlay which is much simpler, automated and secure.

Super curious to get your thoughts.

Re: Tailscale is pretty useful

#419

Post by devilbunny »

thomastjeffery wrote: post #410
devilbunny wrote: post #395

Earlier quoted context omitted.

Ah, haven’t lived in an apartment since the late dialup era (2005). No sticker on the bottom with login info? Could you exchange it with the ISP? I’m sure you have tried these, just spitballing about how I would try to deal with that…

Anything that's more effort than using tailscale isn't worth it to me. I just treat it like public Wi-Fi that no one but me uses. My frustration is that it's difficult in the first place. I shouldn't need to call someone (and hope they both comprehend and help) just to configure a device inside my home . It's absurd, and everything that led us to this point deserves criticism.

Sorry for the late reply, just wanted to say I have felt your pain starting a long time ago, and I agree it's absurd. I don't even do this as a job. I'm just out there trying to make sure that my wife and I have functional internet at our house and her parents' house as a layman with a modicum of experience.
Post reply on HN