Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Headscale: Open-source implementation of the Tailscale control server

github.com

Post reply on HN
Print view View original

51–60 of 70 posts

Re: Headscale: Open-source implementation of the Tailscale control server

#51

Post by beagle3 »

Is there anything among these that incorporates a basic configurable firewall policy?

In the more distant past, I used sshuttle to create “one way” poor man’s VPN; it is slow, but it was enough to saturate the remote connections I had at the time; and —- unlike many other systems at the time —- I knew I could trust the cryptography and key distribution, which piggybacks ssh.

At the minimum,I want to have connections going only one way between sine hosts, or no way in the case of two edge devices - and possibly also list specific ports and protocols. Sshuttle only provided directionality - and not intentionally either…

Sshuttle was conceived and written by Avery Pennarun, who later went to co-create … tailscale.

Re: Headscale: Open-source implementation of the Tailscale control server

#52

Post by GekkePrutser »

RL_Quine wrote: post #33
bradfitz wrote: post #30

Earlier quoted context omitted.

Actually the version that's in the App Store does support alternate control servers. It just needs to be configured via MDM configuration ( https://support.apple.com/guide/mdm/mdm-overview-mdmbf9e668/... ). That's how our larger on-prem customers use the iOS client when they run their own in-house control plane server.

Is there any intent to make that just a setting? Using MDM for something like that as an individual seems a little over the top. I couldn't immediately find any information about how to configure this if I wanted to using MDM, even if it was the only option.

You can create MDM profiles even without a MDM server etc by using Apple Configurator 2. You will need a Mac however. You can then install those profiles manually.

A simple setting in the app would be far easier yeah. I would suspect that the ease of people bypassing the paid service is probably not a priority for them ;)

Personally I never even tried tailscale as I try to avoid Google. I definitely don't want to use my Google account to log into it and give Google more information.

But tinc serves my usecase well. The peer injection is a bit of a worry there too though. Especially because tinc peers are able to add any peers on their own (it's a feature meant to provide easier configuration).

I tried nebula extensively too but it didn't add enough over tinc to make it worthwhile switching especially now that tinc has an Android app.

Re: Headscale: Open-source implementation of the Tailscale control server

#53

Post by xarope »

beagle3 wrote: post #51

Is there anything among these that incorporates a basic configurable firewall policy? In the more distant past, I used sshuttle to create “one way” poor man’s VPN; it is slow, but it was enough to saturate the remote connections I had at the time; and —- unlike many other systems at the time —- I knew I could trust the cryptography and key distribution, which piggybacks ssh. At the minimum,I want to have connections…

+1. I use the postup/postdown settings in wireguard to add/remove iptables configuration, but it would be nice to have a more user-friendly setup.

Re: Headscale: Open-source implementation of the Tailscale control server

#54

Post by GekkePrutser »

robertlagrant wrote: post #42
cheesetable wrote: post #18

Not sure what I think about this. I don't use Tailscale because I don't trust their key distribution, and this open source project would solve that, but it might undermine Tailscale's sustainability. This would be a shame because Tailscale is working well with the open source community: open source clients, working well with distros, working well with Linux DNS stack, supporting a more P2P secure Internet, and docume…

I agree - there's always a danger with companies that try and have a lot of their product as OS that someone will come along with an OS product that plugs the gap in the only place they're trying to make a profit!

I think because in this case they enforce that by hosting the control plane themselves, it doesn't really matter. I wouldn't use something I can't self-host anyway, not something as security-sensitive as a VPN.

So many users will not have even considered the paid version anyway, and their participation will give tailscale a higher marketshare and thus more viability.

Re: Headscale: Open-source implementation of the Tailscale control server

#55

Post by kradalby »

bradfitz wrote: post #30
RL_Quine wrote: post #28

Earlier quoted context omitted.

Yes, but that version works only with the tailscale.com server, not a custom one.

Actually the version that's in the App Store does support alternate control servers. It just needs to be configured via MDM configuration ( https://support.apple.com/guide/mdm/mdm-overview-mdmbf9e668/... ). That's how our larger on-prem customers use the iOS client when they run their own in-house control plane server.

Any docs or tips on how the mobileconfig or configuration keys look like?

Re: Headscale: Open-source implementation of the Tailscale control server

#56

Post by arianvanp »

beagle3 wrote: post #51

Is there anything among these that incorporates a basic configurable firewall policy? In the more distant past, I used sshuttle to create “one way” poor man’s VPN; it is slow, but it was enough to saturate the remote connections I had at the time; and —- unlike many other systems at the time —- I knew I could trust the cryptography and key distribution, which piggybacks ssh. At the minimum,I want to have connections…

Tailscale has a pretty comprehensive ACL system

Re: Headscale: Open-source implementation of the Tailscale control server

#57

Post by ignoramous »

mediocregopher wrote: post #2

Another similar project to Tailscale, for those in the market: https://github.com/slackhq/nebula Crazy simple, fully open source, trivial to self-host. Maybe not as featureful as Tailscale, but imo that can be a feature unto itself.

Also:

WireTrustee: https://news.ycombinator.com/item?id=27672715

Netmaker: https://github.com/gravitl/netmaker

Defined.net (from makers of Slack Nebula): https://www.defined.net/

Re: Headscale: Open-source implementation of the Tailscale control server

#58

Post by iso1210 »

s_Hogg wrote: post #11

I read through the README and I'm still not quite sure - given how simple it is to set up wireguard, what's the value add here?

Wireguard is fairly easy to add between two machines, which allows you to set up a client/server setup which all traffic routes through

You can add a new machine, so to set up the third machine takes 10 minutes, the fourth takes 10, the fifth 10, etc

If machine 3 wants to talk to machine 6, packets are routed via the single central "vpn concentrator" machine.

However to really benefit from wireguard, you don't want to tunnel all the traffic through a single machine - both from a security perspective and performance perspective.

To add 3 machines is fine, you need to set up 3 tunnels, from machine 1-2, 2-3 and 1-3.

A fourth machine needs 3 new tunnels - 1-4, 2-4 and 3-4. A fifth machine needs 4 new tunnels.

You then need to manage all those keys and cycle through them (you should change private keys regularly)

Things like tailscale automate all this. You want to add 19th a machine, you simply add one entry and it handles the rest.

Re: Headscale: Open-source implementation of the Tailscale control server

#59

Post by lifty »

makeworld wrote: post #27
mediocregopher wrote: post #2

Another similar project to Tailscale, for those in the market: https://github.com/slackhq/nebula Crazy simple, fully open source, trivial to self-host. Maybe not as featureful as Tailscale, but imo that can be a feature unto itself.

Yggdrasil is not the same as either of these, but it can do similar things. https://yggdrasil-network.github.io/

Doesn’t Yggdrasil use WireGuard these days?
Post reply on HN