Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Tailnet Lock

tailscale.com

Post reply on HN
Print view View original

61–70 of 119 posts

Re: Tailnet Lock

#61

Post by TkTech »

tiffanyh wrote: post #21

Cloudflare + Tailscale would be a super interesting combination for a business. I wonder if Tailscale is an acquisition target.

From a business sense, it would likely be a reasonable and profitable acquisition for both parties.

From a personal standpoint, I would like to see Cloudflare (among others) smashed into a neutral backbone provider and all its product offerings spun off, ala https://en.wikipedia.org/wiki/Breakup_of_the_Bell_System. It's dangerous for one company to control so much of the internet's infrastructure and it's causing massive problems (like https://news.ycombinator.com/item?id=32912075). Tailscale should remain independent.

Re: Tailnet Lock

#62

Post by gog »

teaearlgraycold wrote: post #50
0x0000000 wrote: post #48

Earlier quoted context omitted.

It's a usability thing, IMO. Historically you had enterprise-grade VPNs that cost a lot of money, or OpenVPN. Both ran over IPSec or SSL, and neither were super straightforward to config/maintain, nor were they particularly performant. Then came wireguard, which is awesome, but wireguard is just a transport. It doesn't have all the UX niceties built on top of it, like registering clients or generating / distributing…

What does everyone use it for?

I have a Tailscale client running on my NAS at home, this allows me to access stuff at home when I am not there, mostly my Home Assistant instance but sometimes the files on the NAS as well.

Without Tailscale I would need a way to publish my routers current WAN address somehow (probably with DDNS), create a port forward rule on my ISPs router/modem and then setup a VPN server to listen to those connections.

Not to mention that the current ISP doesn't even allow me to login to their modem and setup port forwarding.

Re: Tailnet Lock

#63

Post by influx »

teaearlgraycold wrote: post #50
0x0000000 wrote: post #48

Earlier quoted context omitted.

It's a usability thing, IMO. Historically you had enterprise-grade VPNs that cost a lot of money, or OpenVPN. Both ran over IPSec or SSL, and neither were super straightforward to config/maintain, nor were they particularly performant. Then came wireguard, which is awesome, but wireguard is just a transport. It doesn't have all the UX niceties built on top of it, like registering clients or generating / distributing…

What does everyone use it for?

I use it on my EC2 dev box and my home network, allowing me to block ssh on all the firewalls, yet ssh freely between all of them.

Re: Tailnet Lock

#65

Post by makeworld »

bradfitz wrote: post #57
sureglymop wrote: post #37

Earlier quoted context omitted.

I recently read this blog [0] about how tailscale was thinking of open sourcing a small coordination server but headscale had already been created so that effort was put on hold. Is tailscale at this point in any way involved in headscale or contributing to it or are there plans to fork it to keep it maintained? Asking out of curiosity. [0]: https://tailscale.com/blog/opensource/

We hired one of the Headscale developers and let him work on it (as part of his job, not just moonlighting) and we help out when there are issues and give them a heads-up when protocol changes/etc are coming.

This is such an outstanding response to the existence of Headscale that I struggle to understand it. Why not just open source Tailscale's control server? Don't get me wrong though, what you guys are doing now is great.

Edit: some explanation here: https://tailscale.com/blog/opensource/

Re: Tailnet Lock

#66

Post by akerl_ »

fragmede wrote: post #30
aborsy wrote: post #9

I am one of those users who have asked, but how can I trust that the Tailscale coordination server will not inject hidden public keys to my network. This feature is a very good step forward in security. I will take a look and if the implementation is sound, I am going to use Tailscale (namely if the Tailscale is compromised, I will not be automatically compromised, unless I manually accept external public keys, or in…

One option is don't . Run tailscaled inside a container with host network access, that way you can connect to the host, but it doesn't have the ability (unless it escapes the container) to write (ssh) keys.

I think y’all are talking about different things; the parent comment seems to be talking about injecting additional keys into the tailnet (basically, letting other devices communicate inside your Wireguard VPN).

Re: Tailnet Lock

#67

Post by 0x0000000 »

unshavedyak wrote: post #51
0x0000000 wrote: post #46

Earlier quoted context omitted.

Dynamic DNS with wireguard works great, especially for a small footprint (sounds like you only have one LAN you want to access remotely, not multiple sites). It'll be free, and you won't have any cloud centralized service you're dependant on. Personally I host both of these services (dynamic DNS client, wireguard server) right on my WAN edge router, but you could also run it on a host (e.g., VM or raspberry pi) insid…

How was wireguard setup? My fear with manually setting up wireguard is making some mistake that compromises security. While i like free (selfhosting), my gut says $5/m would be worth having Tailscale manage security for me to ensure it's done right.

I'd say it depends on how many remote clients you plan to have, since you have to manually configure the associated key per client. Unlike a traditional VPN which was just username/password based (from the user perspective, anyway) wireguard is based on keys, which means if you want to get in remotely, you need to have a key which has been configured. If you only have a few clients, this is easy enough to get going. If you have lots of clients, or want to be able to easily add new clients, I can see it becoming cumbersome.

As far as setting it up securely, I don't think you're any worse off doing it yourself compared to using tailscale. You can define what networks each client may access. Personally I run wireguard on top of OpnSense, so I also have firewall rules in place to limit what any client can do from my remote-access network towards other parts of my network.

Re: Tailnet Lock

#68

Post by pyinstallwoes »

TkTech wrote: post #55
teaearlgraycold wrote: post #50

Earlier quoted context omitted.

What does everyone use it for?

I have it on all my personal and family servers and devices. I use it so that for both myself and my family all our internal stuff (unraid network shares, jellyfin, homepages, photo backups, etc, etc) "just works" for the less technical members of the family even when they're not at home. It seamlessly detects when the peer is local so it doesn't route out to the internet and back, has an easy ACL to segment things (…

Can you use it like a VLAN for segmenting devices? I have eero’s and a firewalla but since my eero’s don’t support tagged vlan traffic I can’t segment my devices as much as I’d like to.

Re: Tailnet Lock

#69

Post by infogulch »

unshavedyak wrote: post #60
TheFlyingFish wrote: post #56

Earlier quoted context omitted.

Yeah, they get a lot of flak for that from HN. Doesn't bother me personally, but I can see why it would be a dealbreaker for some people. On the other hand, I sympathize with their decision to just not have to worry about storing passwords, account recovery, and all the associated headaches, because I hate those headaches too. My guess is they will eventually add a sign-up-with-email option, but it's pretty far from…

In researching the email issue i saw a fair number of people arguing to decouple accounts from identities. I thought that was fair. I use Github and i have no problem there, but i didn't want some snafu on my account (Github) to somehow block my home network access. So i just signed up with an alternate Github "Identity" account to use with Tailscale. Still feels weird, but we'll see how it goes.

Note a discussion elsethread about this where a tailscalar chimed in: https://news.ycombinator.com/item?id=33987904

Re: Tailnet Lock

#70

Post by ukd1 »

jchw wrote: post #52
teaearlgraycold wrote: post #45

At this point I have no idea why HN cares so much about a VPN company, but I’m too afraid to ask.

For personal stuff, it feels totally new. It's like having your own intranet. It's like being on LAN with all of your personal devices, plus any bridged into your tailnet, at all times, anywhere on earth. You can route your internet traffic through another machine, or not (default.) It has built-in basic file transfer, and a nice little SSH bridge. Technologically, it's based on Wireguard. Wireguard is fast; really f…

Did you ever use Zero Tier before?
Post reply on HN