Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Tailnet Lock

tailscale.com

Post reply on HN
Print view View original

51–60 of 119 posts

Re: Tailnet Lock

#51

Post by unshavedyak »

0x0000000 wrote: post #46
unshavedyak wrote: post #34

For basic tunneling into home servers, is Tailnet.. overkill? Ie i could expose my IP via Dyn DNS, or i could use something like Cloudflare or Tailnet to tunnel into the network. However.. i'm not sure what the right fit is. Would you recommend Tailnet for someone who just wants to expose some internal IPs to the public in a safe way? Tunneling compared to Dyn DNS at least has the advantage of more security via reduc…

Dynamic DNS with wireguard works great, especially for a small footprint (sounds like you only have one LAN you want to access remotely, not multiple sites). It'll be free, and you won't have any cloud centralized service you're dependant on. Personally I host both of these services (dynamic DNS client, wireguard server) right on my WAN edge router, but you could also run it on a host (e.g., VM or raspberry pi) insid…

How was wireguard setup? My fear with manually setting up wireguard is making some mistake that compromises security.

While i like free (selfhosting), my gut says $5/m would be worth having Tailscale manage security for me to ensure it's done right.

Re: Tailnet Lock

#52

Post by jchw »

teaearlgraycold wrote: post #45

At this point I have no idea why HN cares so much about a VPN company, but I’m too afraid to ask.

For personal stuff, it feels totally new. It's like having your own intranet. It's like being on LAN with all of your personal devices, plus any bridged into your tailnet, at all times, anywhere on earth. You can route your internet traffic through another machine, or not (default.) It has built-in basic file transfer, and a nice little SSH bridge.

Technologically, it's based on Wireguard. Wireguard is fast; really fast, especially compared to OpenVPN. Using cutting edge cryptography and a new UDP protocol, Wireguard connections feel roughly zero-overhead (they're not, of course.) Connections are peer-to-peer and you usually will get pretty close to the fastest reasonable route between any two devices, whether you're on LAN or overseas, whether there's a strong NAT in front or not.

They've also engineered a lot of things carefully, instead of just cobbling together existing end-user tools in Rube Goldberg arrangements. (Not saying there isn't use of existing code; there totally is. But it's all very nicely integrated from what I can see.) Doing things "the hard way" can lead to more complicated software, but the way they've architected things makes the possibilities for expanding the utility of Tailscale to be nearly limitless. It's also amazingly entertaining to read about. Seriously, just read about how their web browser SSH client works:

https://tailscale.com/blog/ssh-console/

Re: Tailnet Lock

#53

Post by unshavedyak »

TheFlyingFish wrote: post #43
unshavedyak wrote: post #34

For basic tunneling into home servers, is Tailnet.. overkill? Ie i could expose my IP via Dyn DNS, or i could use something like Cloudflare or Tailnet to tunnel into the network. However.. i'm not sure what the right fit is. Would you recommend Tailnet for someone who just wants to expose some internal IPs to the public in a safe way? Tunneling compared to Dyn DNS at least has the advantage of more security via reduc…

Depends on whether you're talking about stuff that you actually want to be "exposed to the public" (i.e. can receive traffic from any IP) or just "accessible from outside the LAN." If the former, Tailscale isn't really a good fit since it only permits access to authenticated devices. If the latter, Tailscale is perfect. It's a VPN in the original sense of the world, "private" being the operative term - your devices c…

On the note of free plan. It's actually a bit of a shame.. i want to pay, i like $5/m, but it looks like $5/m is less devices than if i used free?

Though i just noticed that the Personal Pro plan works with up to 100 devices for $4/m. Might give that a try. I really like paying.. as i hate free VC services.

edit: Wow, the signup requirement is bizarre though. I don't have or want Google or Microsoft.. i do have a Github, which i guess i'll have to use... but what the hell? So odd that i can't just signup with my email.

Re: Tailnet Lock

#54

Post by TheFlyingFish »

teaearlgraycold wrote: post #50
0x0000000 wrote: post #48

Earlier quoted context omitted.

It's a usability thing, IMO. Historically you had enterprise-grade VPNs that cost a lot of money, or OpenVPN. Both ran over IPSec or SSL, and neither were super straightforward to config/maintain, nor were they particularly performant. Then came wireguard, which is awesome, but wireguard is just a transport. It doesn't have all the UX niceties built on top of it, like registering clients or generating / distributing…

What does everyone use it for?

Not GP, and I can only answer for myself, but:

Personally, I use it to connect my home devices as if they were always together on the same LAN, even when they're not. E.g. Raspberry Pi, home NAS, "home" server that's actually in a different physical location, etc. All accessible anywhere at any time, even (say) from my laptop in a moving vehicle, without connections dropping even when my IP changes. It really is like magic.

At work, we use it so that remote employees can access locally-hosted applications, office NAS, etc. ACLs make it easy to employ the principle of least privilege, so that having a route into the office LAN doesn't immediately mean any and every device is compromised.

Re: Tailnet Lock

#55

Post by TkTech »

teaearlgraycold wrote: post #50
0x0000000 wrote: post #48

Earlier quoted context omitted.

It's a usability thing, IMO. Historically you had enterprise-grade VPNs that cost a lot of money, or OpenVPN. Both ran over IPSec or SSL, and neither were super straightforward to config/maintain, nor were they particularly performant. Then came wireguard, which is awesome, but wireguard is just a transport. It doesn't have all the UX niceties built on top of it, like registering clients or generating / distributing…

What does everyone use it for?

I have it on all my personal and family servers and devices. I use it so that for both myself and my family all our internal stuff (unraid network shares, jellyfin, homepages, photo backups, etc, etc) "just works" for the less technical members of the family even when they're not at home. It seamlessly detects when the peer is local so it doesn't route out to the internet and back, has an easy ACL to segment things (wife's phone doesn't need access to dd-wrt), and a bunch of other features.

We've been able to do this with existing VPNs for a long, long time, but tailscale is by far the most painless offering I've ever used and I migrated away from OpenVPN completely.

Re: Tailnet Lock

#56

Post by TheFlyingFish »

unshavedyak wrote: post #53
TheFlyingFish wrote: post #43

Earlier quoted context omitted.

Depends on whether you're talking about stuff that you actually want to be "exposed to the public" (i.e. can receive traffic from any IP) or just "accessible from outside the LAN." If the former, Tailscale isn't really a good fit since it only permits access to authenticated devices. If the latter, Tailscale is perfect. It's a VPN in the original sense of the world, "private" being the operative term - your devices c…

On the note of free plan. It's actually a bit of a shame.. i want to pay, i like $5/m, but it looks like $5/m is less devices than if i used free? Though i just noticed that the Personal Pro plan works with up to 100 devices for $4/m. Might give that a try. I really like paying.. as i hate free VC services. edit : Wow, the signup requirement is bizarre though. I don't have or want Google or Microsoft.. i do have a Gi…

Yeah, they get a lot of flak for that from HN. Doesn't bother me personally, but I can see why it would be a dealbreaker for some people. On the other hand, I sympathize with their decision to just not have to worry about storing passwords, account recovery, and all the associated headaches, because I hate those headaches too.

My guess is they will eventually add a sign-up-with-email option, but it's pretty far from the top of their priority list.

Re: Tailnet Lock

#57

Post by bradfitz »

sureglymop wrote: post #37
crawshaw wrote: post #27

Earlier quoted context omitted.

Tailscalar here. IdP trust is on the list. There are some "easy" things we can do that help on the surface but make life harder for users. And there are some not-so-easy things we are researching. I hope to have answers in 2023.

I recently read this blog [0] about how tailscale was thinking of open sourcing a small coordination server but headscale had already been created so that effort was put on hold. Is tailscale at this point in any way involved in headscale or contributing to it or are there plans to fork it to keep it maintained? Asking out of curiosity. [0]: https://tailscale.com/blog/opensource/

We hired one of the Headscale developers and let him work on it (as part of his job, not just moonlighting) and we help out when there are issues and give them a heads-up when protocol changes/etc are coming.

Re: Tailnet Lock

#58

Post by bradfitz »

jchw wrote: post #29
bradfitz wrote: post #25

Earlier quoted context omitted.

What bug are you thinking of? Got a GitHub issue link?

I believe it might be this one. https://github.com/tailscale/tailscale/issues/4133 That said, I'm not near the computer where I have it occur right now to check.

That's hopefully fixed now in 1.34.0+. We'll see!

Re: Tailnet Lock

#59

Post by jabroni_salad »

wooltail wrote: post #10
shawnz wrote: post #6

This solves the #1 concern I had with tailscale. Now I feel comfortable recommending this software to anybody.

It still makes me jittery how much stuff they've packed into the client. The RCE vulnerability in their windows client is pretty strong indicator that things are moving a bit too fast for comfort.

My fortinet footprint would like to assure you that stuff which moves slowly also has problems. I try not to hold a CVE against anyone unless they are extremely stupid and reveal a lack of any technical controls.

wireguard is a linux-first solution and all of the windows stuff for it is subgrade, and probably will continue to be for awhile. Still selling plenty of anyconnect/globalprotect have a stranglehold on windowsland and probably will for a long time.

Re: Tailnet Lock

#60

Post by unshavedyak »

TheFlyingFish wrote: post #56
unshavedyak wrote: post #53

Earlier quoted context omitted.

On the note of free plan. It's actually a bit of a shame.. i want to pay, i like $5/m, but it looks like $5/m is less devices than if i used free? Though i just noticed that the Personal Pro plan works with up to 100 devices for $4/m. Might give that a try. I really like paying.. as i hate free VC services. edit : Wow, the signup requirement is bizarre though. I don't have or want Google or Microsoft.. i do have a Gi…

Yeah, they get a lot of flak for that from HN. Doesn't bother me personally, but I can see why it would be a dealbreaker for some people. On the other hand, I sympathize with their decision to just not have to worry about storing passwords, account recovery, and all the associated headaches, because I hate those headaches too. My guess is they will eventually add a sign-up-with-email option, but it's pretty far from…

In researching the email issue i saw a fair number of people arguing to decouple accounts from identities. I thought that was fair. I use Github and i have no problem there, but i didn't want some snafu on my account (Github) to somehow block my home network access.

So i just signed up with an alternate Github "Identity" account to use with Tailscale. Still feels weird, but we'll see how it goes.

Post reply on HN