Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Headscale: Open-source implementation of the Tailscale control server

github.com

Post reply on HN
Print view View original

61–70 of 70 posts

Re: Headscale: Open-source implementation of the Tailscale control server

#61

Post by api »

a-dub wrote: post #17

so this whole zerocorp/zerotier/encrypted-mesh networking approach is pretty cool, but every time i see it i ask myself: how do you monitor for malicious nodes? in old setups, typically there would be some sort of passive monitoring system that would monitor the traffic between hosts and could be used for forensics/malicious traffic identification. but if you're encrypting traffic at each node for each other node, th…

ZeroTier rules can be used to monitor traffic via the "tee" rule. You can send copies of any packet matching any criteria (whole packet or part of it) to a monitor. Both sender and receiver can match, so someone would have to compromise both sides to evade it.

Re: Headscale: Open-source implementation of the Tailscale control server

#62

Post by sascha_sl »

victorhooi wrote: post #41
mediocregopher wrote: post #2

Another similar project to Tailscale, for those in the market: https://github.com/slackhq/nebula Crazy simple, fully open source, trivial to self-host. Maybe not as featureful as Tailscale, but imo that can be a feature unto itself.

One thing I can't figure out with Nebula is - how do you join multiple different networks? For example, I have a personal laptop - I want to join two different networks, that are for two different purposes, and be able to talk to hosts in each? (But hosts in each should not be able to talk to hosts in the other)

It doesn't do that, you get one CA per instance.

You can run multiple instances though.

Re: Headscale: Open-source implementation of the Tailscale control server

#63

Post by RL_Quine »

GekkePrutser wrote: post #52
RL_Quine wrote: post #33

Earlier quoted context omitted.

Is there any intent to make that just a setting? Using MDM for something like that as an individual seems a little over the top. I couldn't immediately find any information about how to configure this if I wanted to using MDM, even if it was the only option.

You can create MDM profiles even without a MDM server etc by using Apple Configurator 2. You will need a Mac however. You can then install those profiles manually. A simple setting in the app would be far easier yeah. I would suspect that the ease of people bypassing the paid service is probably not a priority for them ;) Personally I never even tried tailscale as I try to avoid Google. I definitely don't want to use…

I realize, but it's still a pain to do, and how to actually configure TailScale like this is completely undocumented, I couldn't find any mention of this feature outside of a hacker news comment. On the OSX application there's a hidden menu (hold option) which allows you to choose a different master server, but not enter your own, which is so close to being usable but just out of reach.

Re: Headscale: Open-source implementation of the Tailscale control server

#64

Post by juanfont »

arianvanp wrote: post #56
beagle3 wrote: post #51

Is there anything among these that incorporates a basic configurable firewall policy? In the more distant past, I used sshuttle to create “one way” poor man’s VPN; it is slow, but it was enough to saturate the remote connections I had at the time; and —- unlike many other systems at the time —- I knew I could trust the cryptography and key distribution, which piggybacks ssh. At the minimum,I want to have connections…

Tailscale has a pretty comprehensive ACL system

And it's fully supported by Headscale.

Re: Headscale: Open-source implementation of the Tailscale control server

#65

Post by JeremyNT »

rcrowley wrote: post #16
JeremyNT wrote: post #14

Earlier quoted context omitted.

I've been using Nebula for personal use and it's really great. I have a free Oracle Cloud vm as my "lighthouse." The advantage of Nebula is that it's dead simple. Generate a keypair, copy it over, copy the config file, and go. It can do mesh routing for the vpn and traverse nat magically. You can delegate dns to the lighthouse and name resolution just works too. That simplicity is awesome for personal use, and maybe…

Nebula transits every EC2-to-EC2 packet at Slack, across lots of AWS regions and tens of thousands of hosts. It’s probably doing petabits of traffic per second. And it’s a safer, more expressive firewall than EC2 security groups. So, yes, it works for personal use-cases but it works for truly gigantic applications, too.

The big thing I see missing is the management piece, which is what makes Tailscale compelling. If you're just running Nebula as an individual user, or for a small org, there wouldn't be much overhead. Otherwise, for larger deployments, you need to "roll your own" solution to manage configs outside of Nebula itself.

You'd also want this to be self-service in some way - so road warriors can rotate their own certs, with auth backed by some kind of central SSO system. The last I looked, Nebula didn't offer this stuff.

Re: Headscale: Open-source implementation of the Tailscale control server

#66

Post by rhuber »

sascha_sl wrote: post #62
victorhooi wrote: post #41

Earlier quoted context omitted.

One thing I can't figure out with Nebula is - how do you join multiple different networks? For example, I have a personal laptop - I want to join two different networks, that are for two different purposes, and be able to talk to hosts in each? (But hosts in each should not be able to talk to hosts in the other)

It doesn't do that, you get one CA per instance. You can run multiple instances though.

Actually it does do that, you can trust multiple CAs in a single instance and even write firewalls scoped to CAs.

Re: Headscale: Open-source implementation of the Tailscale control server

#67

Post by xyzzy_plugh »

cormacrelf wrote: post #39
xyzzy_plugh wrote: post #6

While this is great, of course, it's definitely not feature parity with Tailscale, which currently allows me to have nothing listening on the opening internet and still form a private network spanning hosts all over the world, share resources within that network with 3rd parties trivially and send files across my network, android/iOS apps, etc. I still posit the alternative to Tailscale is simply just wireguard. I do…

You don’t think Tailscale has things listening on the open internet? When you use their control plane you are just outsourcing doing this to someone else (who is probably better at it than you but it’s still someone else). Lack of “feature parity” is a strange term for something that completely replicates a third party service but requires self-hosting.

Of course they do -- that's why I use them. I don't have to.

> Lack of “feature parity” is a strange term for something that completely replicates a third party service but requires self-hosting.

It doesn't completely replicate it though, does it? No iOS app, no file sending -- heck the entire premise of Tailscale is oriented around SSO as they are explicitly not an IdP.

I don't mean to knock this effort -- it's great! -- but even if I were to switch to this today, there is a ton of missing functionality, and I'd need to do a ton of work beyond the scope of Headscale just to get this running in my corp.

Re: Headscale: Open-source implementation of the Tailscale control server

#68

Post by Anunayj »

jgilias wrote: post #47

Can someone shed some light on the full use-case of Tailscale/Zerotier/Nebula please? I may be not getting something fully. The question is this. Say, I use one of the above to form a private mesh network for the nodes that an organization needs to have access to. So far so good. But on the machine side I would still want to have key (ideally certificate) based authentication, and some user management, such that acce…

Oh yes, Tailscale/Zerotier actually has a centralized control plane such that access can be revoked centrally and users be managed centrally too. and Tailscale has very nice blog posts explaining their infrastructure [1]

[1] https://tailscale.com/blog/how-tailscale-works/

Re: Headscale: Open-source implementation of the Tailscale control server

#69

Post by jgilias »

Anunayj wrote: post #68
jgilias wrote: post #47

Can someone shed some light on the full use-case of Tailscale/Zerotier/Nebula please? I may be not getting something fully. The question is this. Say, I use one of the above to form a private mesh network for the nodes that an organization needs to have access to. So far so good. But on the machine side I would still want to have key (ideally certificate) based authentication, and some user management, such that acce…

Oh yes, Tailscale/Zerotier actually has a centralized control plane such that access can be revoked centrally and users be managed centrally too. and Tailscale has very nice blog posts explaining their infrastructure [1] [1] https://tailscale.com/blog/how-tailscale-works/

Thanks! I've read (again) the article, but it doesn't really answer my question. Here's a concrete example:

An organization uses Tailscale. There's 'server102' that is connected to the Tailscale network that all users of the `devops` team have access to. A new employee, Anne, joins the company. Sysadmins set up her SSO account, as well as makes her part of `devops` on Tailscale.

Anne gets her company computer, sets it up, connects to Tailscale, fires up her shell, types in `ssh anne@server102`, presses Enter.

What happens?

Re: Headscale: Open-source implementation of the Tailscale control server

#70

Post by kradalby »

kradalby wrote: post #55
bradfitz wrote: post #30

Earlier quoted context omitted.

Actually the version that's in the App Store does support alternate control servers. It just needs to be configured via MDM configuration ( https://support.apple.com/guide/mdm/mdm-overview-mdmbf9e668/... ). That's how our larger on-prem customers use the iOS client when they run their own in-house control plane server.

Any docs or tips on how the mobileconfig or configuration keys look like?

Figured it out :)
Post reply on HN