Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Launch HN: Firezone (YC W22) – Zero-trust access platform built on WireGuard

news.ycombinator.com

Post reply on HN
Print view View original

51–60 of 90 posts

Re: Launch HN: Firezone (YC W22) – Zero-trust access platform built on WireGuard

#51

Post by RsmFz »

taekwondo123 wrote: post #38

The concern I have with these types of solutions (meaning Tailscale, Firezone, etc.), is that I need to trust the provider not to mess up or maliciously exchange keys with rouge devices. Is this the case with Firezone as well? I see that tailscale addresses this now somewhat: https://tailscale.com/kb/1226/tailnet-lock

Firezone employee here. I believe we have an idea to let customers sign their keys so that they don't need to trust our portal not to rewrite keys. This is probably the same idea Tailscale hit on.

(I can't find this idea in the issue tracker and I don't think it's on the roadmap yet, but we've discussed it.)

Unfortunately there is a big convenience-security tradeoff, managing your own keys and certs is a lot of work.

Re: Launch HN: Firezone (YC W22) – Zero-trust access platform built on WireGuard

#52

Post by RsmFz »

psd1 wrote: post #44
taekwondo123 wrote: post #38

The concern I have with these types of solutions (meaning Tailscale, Firezone, etc.), is that I need to trust the provider not to mess up or maliciously exchange keys with rouge devices. Is this the case with Firezone as well? I see that tailscale addresses this now somewhat: https://tailscale.com/kb/1226/tailnet-lock

> maliciously exchange keys with rouge devices Companies are slow to respond to the growing threat from adversarial make-up brushes.

I live by but two rules, private keys stay on the storage device they're first saved to, and makeup stays with the first person to use it.

Re: Launch HN: Firezone (YC W22) – Zero-trust access platform built on WireGuard

#53

Post by jamilbk »

PLG88 wrote: post #42
jamilbk wrote: post #9

Earlier quoted context omitted.

I may not be fully understanding the question, but I think you may be referring to DNS-based resources? Those will allow you to manage access to an app or service by its DNS name (wildcards supported). You can also use IP or CIDR resources as well of course. In terms of scalability, are you referring to throughput or simply the complexity of policy management as the number of resources grows?

I refer to doing service based connections, abstracted away from whether its DNS, IP or something else. To do this you really need a private DNS function and to operate with attribute based access controls. Complexity of policy mngt. I read that ACLs are fine at small scale but become a nightmare at larger enterprise scale.

Firezone's DNS-based routing is able to manage access to multiple services independently, even if they share the same IP address. So you could for example allow access to gitlab.company.com but not jira.company.com even if they were on the same webserver / loadbalancer.

It took a couple iterations to get it right - lots of fun edge cases involved. We ended up having to build automatic NAT64 and 46 for DNS resources to handle some of them. We wrote a post on how this works: https://www.firezone.dev/blog/how-dns-works-in-firezone

In terms of attributes for allowing access, we currently support time-based, country/region-based, auth method, and IP-based, with more planned: https://www.firezone.dev/kb/deploy/policies#conditional-acce...

Re: Launch HN: Firezone (YC W22) – Zero-trust access platform built on WireGuard

#54

Post by jamilbk »

redrove wrote: post #43
jamilbk wrote: post #17

Earlier quoted context omitted.

This is a fairly common scenario and one that we had in mind when building the NAT traversal implementation. The short answer is that you wouldn't need to sign out of Firezone when in the office -- the connection should hairpin off the nearest common router and go directly to the SMB share in this case.

This single handedly convinced me to try it out in my homelab! Tailscale fails at this and I consider it fairly basic networking.

You can read more about how we came up with the current implementation here:

https://github.com/firezone/firezone/issues/3553

We didn't invent these techniques. Host candidates are part of standard ICE:

https://datatracker.ietf.org/doc/html/rfc8445#section-5.1.1....

Re: Launch HN: Firezone (YC W22) – Zero-trust access platform built on WireGuard

#55

Post by jamilbk »

indianmouse wrote: post #36
cedws wrote: post #10

I'm a big fan of Tailscale but it's unfortunate that it's proprietary, so it's really nice to see an open source alternative. The commercial pricing also looks very reasonable. Wishing your product much success.

Second that. I have tried to use Headscale with Tailscale clients and have been fairly successful in achieving a private P2P VPN. Since I have a lot of spare servers, was able to setup a GUI, Headscale server and configure Tailscale clients across different OS flavors. But it is not for the faint of heart or non-technical folks or for enterprise use. What I have implemented was for personal use and it has it's own pi…

We have a few intrepid users self-hosting the entire Firezone stack, but we don't have documentation to support it (yet), and wouldn't recommend it for production. It's something we'd like to write and maintain eventually, even if only for smaller / hobby deployments.

We do have a self-hosted community support channel on Discord if you are feeling adventurous: https://discord.gg/DY8gxpSgep

I would recommend starting here with a local development cluster:

https://github.com/firezone/firezone/blob/main/docs/CONTRIBU...

Re: Launch HN: Firezone (YC W22) – Zero-trust access platform built on WireGuard

#57

Post by nmadden »

PLG88 wrote: post #41
tptacek wrote: post #14

Earlier quoted context omitted.

It's a "virtual" or "overlay" central reference monitor for the whole network --- imagine collapsing an entire campus network down to a single firewall --- which makes it really easy to draw arbitrary internal perimeters. The real customers for these products all tend to have group-based policies. If you remember NAC products from back in the day (policy-driven 802.1x and filtering, all designed to deal with the "che…

I would add, doing Zero Trust Networking properly means deny by default (VPNs are open by default), service based access (not whole host or network), microsegmentation (not whole network), and least privilege. You should also use posture checks to ensure the end device is compliant and personally I prefer 'authenticate before connect' with outbound only connections from source and destination. Note, I am biased thoug…

I took tptacek’s comment as implying that ZTNA solutions do do microsegmentation. Otherwise, if I get a shell in one app and have access to the entire network then what was the point of any of it? Are you saying they don’t do microsegmentation?

Re: Launch HN: Firezone (YC W22) – Zero-trust access platform built on WireGuard

#58

Post by indianmouse »

jamilbk wrote: post #55
indianmouse wrote: post #36

Earlier quoted context omitted.

Second that. I have tried to use Headscale with Tailscale clients and have been fairly successful in achieving a private P2P VPN. Since I have a lot of spare servers, was able to setup a GUI, Headscale server and configure Tailscale clients across different OS flavors. But it is not for the faint of heart or non-technical folks or for enterprise use. What I have implemented was for personal use and it has it's own pi…

We have a few intrepid users self-hosting the entire Firezone stack, but we don't have documentation to support it (yet), and wouldn't recommend it for production. It's something we'd like to write and maintain eventually, even if only for smaller / hobby deployments. We do have a self-hosted community support channel on Discord if you are feeling adventurous: https://discord.gg/DY8gxpSgep I would recommend starting…

Thank you so much. Will check it out and probably create a pull request to add the documentation while I'm implementing it.

Re: Launch HN: Firezone (YC W22) – Zero-trust access platform built on WireGuard

#59

Post by gargan »

nmadden wrote: post #13

I don’t really get the threat model of these “zero trust” appliances and how they are really different from a VPN. Can someone explain it to me? It still looks very much like a perimeter.

Zero trust actually goes way beyond traditional VPNs. A key difference is granular access control and continuous verification. With zero trust, you're not only punching a hole through a firewall - you're creating dynamic, context-aware access policies for each user and device.

This helps contain breaches and lateral movement much better than VPNs. Plus, it plays nice with cloud and hybrid environments where traditional network perimeters get blurry.

Re: Launch HN: Firezone (YC W22) – Zero-trust access platform built on WireGuard

#60

Post by gargan »

gchamonlive wrote: post #47

At my last job, I implemented Firezone on AWS and it worked like a charm. It was before the refactoring and the move to zero trust, so back then it was a simple admin panel. It was maybe mid 2022 I implemented it. There was a terraform module I created for setting up the basic infrastructure, but there is no way the module supports the current state of the product. I guess it moved way quicker than I was able to foll…

Sounds like you had a cool experience with Firezone back in the day. Since you mentioned alternatives, have you checked out Netmaker? It's another open-source option (note I work there)
Post reply on HN