[deleted]
How Tailscale Works
61–70 of 82 posts
Re: How Tailscale Works
#62I tried to use it for creating a mesh network of my family's computers, but switched to zerotier.
I use ansible to keep all our computers up to date and maintain an ldap server for some basic information; my parents are old and not tech savvy, so I do my best to make it easy for them.
Initially I set up tailscale, but the lack of an android client and the difficulty of setting up the raspberry service made me to switch to zerotier. Thing is, I really wanted that to work, as the ping with wireguard between the mesh instances was so low that surprised me.
Oh well, zerotier achieves what I want for now and it has the added benefit of letting you choose the private IP range that you like. I'll definitely keep an eye out for tailscale in the future though.
Re: How Tailscale Works
#63I have what I think is a probably pretty common enterprise use case.
Windows Server with file share behind a sonicwall firwall. Large (now very large) number of remote users need to access file share.
Currently users connect using a VPN that terminates at the firewall, with access rules allowing access to file share.
Is this use case supported with tailscale? Ie, run something on server, allow users to run something, they can then connect to file share?
Anything to do on firewall to make this all go faster / easier?
As others have mentioned - we cannot let third party add nodes to our network without approval. Adding a PSK or something to let us lock network down a bit more would be good I think.
Edit: Installing at home (google wifi for router) and work machine (behind sonicwall) - can't get RDP/Remote Desktop to connect but client install / login is great and would be much easier than current approach if it worked.
Re: How Tailscale Works
#64Earlier quoted context omitted.
I was coming here to say that it looks a lot like ZeroTier. The main differentiator as far as I know is the support for SSO and MFA. With ZeroTier, the client connects to the network using a private shared key and then needs to be approved on the control plane independently.
ZeroTier original (and still main) author here. Objectively speaking another difference is the ACL scheme which seems perhaps less powerful than our own rules engine but easier to use. The ACLs are closer to intents while ZT rules require some TCP/IP knowledge (like raw iptables or pf). We have plans to address this ourselves more with a higher level UI to build rules from intents and common patterns. Also have more…
Do you have any news to ZeroTier 2.0? I'm really looking forward to it and being able to deploy my own controllers easily!
Re: How Tailscale Works
#65Earlier quoted context omitted.
ZeroTier original (and still main) author here. Objectively speaking another difference is the ACL scheme which seems perhaps less powerful than our own rules engine but easier to use. The ACLs are closer to intents while ZT rules require some TCP/IP knowledge (like raw iptables or pf). We have plans to address this ourselves more with a higher level UI to build rules from intents and common patterns. Also have more…
Do you have any news to ZeroTier 2.0? I'm really looking forward to it and being able to deploy my own controllers easily!
Significant performance improvements in the core, reworked CLI, crypto improvements, professional security audit of both design and code, easier root server federation, easier DIY controllers, better multicast, and of course bug fixes.
The firm doing our security audits is an extremely well known one. Don't want to reveal the name quite yet.
It's possible that some of that won't land fully formed right away in 2.0 but will follow shortly thereafter, but the performance, auditing, crypto, and multicast will be there.
Re: How Tailscale Works
#66Thanks for the blog post. I am following the project closely since Brad announced working for you. My main concern currently is the coordination server which does not fit the zero trust claim. I know that the traffic between peers is end-to-end encrypted and you did a good job designing your DERP protocol. However, the ability of the coordination server (login.tailscale.com) to add arbitrary nodes to my private netwo…
Well, this just listed out my concerns pretty well and I spent the last hour installing this on my devices. Specifically, how do I explain to a fortune 500 IT department how this is secure in a few simple sentences?
Large companies that want to remove us from the trusted group should run the coordination server on-prem.
We have considered other certification options, but so far they boil down to running a part of the coordination server on-prem. Still exploring the space though.
(I work at Tailscale)
Re: How Tailscale Works
#67Earlier quoted context omitted.
Is the client the important part of the software, or is there a server side?
The client contains our most sophisticated code. It's also the most important from a trust perspective, it is responsible for securing your data, our servers cannot see anything of yours because of the client. So it's vital the important parts of it are open source. That said, I'd like to open source a server. We need a reference implementation of our control protocol so it can be properly analyzed by security expert…
hi crawshaw, I've started playing with Tailscale as potential alternative for how we're using LISP in Project EVE (Edge Computing Mesh Network usecase) and was wondering whether there's any way today to make Linux clients negotiate (even if through a manual process without) going through your control plane?
Re: How Tailscale Works
#68Earlier quoted context omitted.
Is the client the important part of the software, or is there a server side?
The client contains our most sophisticated code. It's also the most important from a trust perspective, it is responsible for securing your data, our servers cannot see anything of yours because of the client. So it's vital the important parts of it are open source. That said, I'd like to open source a server. We need a reference implementation of our control protocol so it can be properly analyzed by security expert…
It is, admittedly, impossible for me to be unbiased in this discussion (coauthor of Nebula, hi), but I strongly disagree that your client code is your most important component, from a trust perspective.
Your coordination server tells every node about every other node and distributes the keys for the entire network. Everything on a tailscale network implicitly trusts your coordination service.
If an individual client is compromised, code or otherwise, the effect is more limited than your coordination service being compromised, in which case the entire system's trust is broken.
Re: How Tailscale Works
#69Add UDP relays and TCP hole punching and it'll finally be a better take on Hamachi :) https://swapped.cc/hamachi
(Tailscale employee here) UDP relays - that's roughly our DERP relay network. It currently operates over HTTPS because that's the last-resort "most likely to work in hard networks" transport, but adding a UDP option for efficiency is in the books.
TCP hole punching - I don't understand this, can you elaborate? By running Tailscale you can just talk to the machines on your Tailscale network, no hole punching required. At the transport layer we might do NAT traversal shenanigans to get the mesh network up, but that's invisible to the "user layer". I'm guessing you mean something slightly other and I'm just not parsing correctly?
Re: How Tailscale Works
#70Earlier quoted context omitted.
Well, this just listed out my concerns pretty well and I spent the last hour installing this on my devices. Specifically, how do I explain to a fortune 500 IT department how this is secure in a few simple sentences?
Large companies that want to remove us from the trusted group should run the coordination server on-prem. We have considered other certification options, but so far they boil down to running a part of the coordination server on-prem. Still exploring the space though. (I work at Tailscale)
Sure, large companies can easily run a on-premise coordination server. But large companies usually also have a network department and several other SDN and VPN solutions already. They are probably using highly tuned and standardized ipsec tunnels with hw accelerated AES encryption and special devices from different vendors.
I think tailscale could become the #1 solution for personal users and small / mid-sized companies (some of them might not even have an IT dept). At least the easy installation, the single process design (no separate IKE service etc.) and the opinionated modern cryptography - that deliberately does not allow any configuration at all - would make it a really good candidate for those use cases.
This users can probably rent a cheap $3 VPS easily and use it as an on-prem coordination server. However, this increases the installation effort considerable and trusting the cheap $3 VPS to be an essential part of your cooperate network might be a deal breaker. Many of those users might not even have a dedicated team for server maintenance and might not apply security updates regularly.
So, please add an (optional) additional PSK (or key pair / certificate) to each node that is not shared with the coordination server and can be used to sign / verify the configuration on each client. Users that do not care don't have to specify anything (they just have to log-in and everything works). Users that do care would have to login and provide the PSK on each device.
(And to be clear, the problem is not that I do not trust you. I am sure you are doing a great job and I would really like to use your service. But you are an US based company and with the new data protection laws within the EU it might not be easy to convince all customers that potentially sending all their data to a third-party company within the US is necessary.)