Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Tailscale is pretty useful

blog.6nok.org

Post reply on HN
Print view View original

71–80 of 419 posts

Re: Tailscale is pretty useful

#71

Post by xlii »

tsujamin wrote: post #35

The tailscale.com/tsnet package in Go [1] is really useful if you've not looked at it before: you can make single binary HTTP or whatever servers that are only exposed inside your tailnet. Their golink project [2] is a good example (and useful itself), but I've used it to build "peer to peer" comms for one application, and to host an API and Svelte SPA to control some other things in a tailnet. [1] https://pkg.go.dev…

How difficult it is to use? Right now I’m working on orchestrating dev-local service clusters here I bind plenty of hosts to mimick real world. I’m using proxy tunneling to punch in but I’d love to have Tailscale endpoint which I could use to connect external devices (like mobile clients or non-technical stakeholders for show and tell).

Re: Tailscale is pretty useful

#72

Post by porridgeraisin »

Hikikomori wrote: post #44
baq wrote: post #31

Earlier quoted context omitted.

It just works, literally. I haven’t tried nord, but I’ve got clients on Mac, Linux, windows, rpis, it all just works. I used to run pivpn, but the key exchange magic Tailscale employs is so much simpler and it somehow works on networks blocking unknown packets like the pivpn I had set up on some random udp port.

How is it on Android? Tried different vpns to access my pihole but its really slow at resolving sometimes.

It's great for my limited usecase (SSHing/HTTPing to my laptop/computer)

Re: Tailscale is pretty useful

#74

Post by klabb3 »

yegle wrote: post #41

CGNAT _can_ make it easier to access your server. If your Internet provider and your mobile provider is the same company, they could put all your connected devices in the same IP block within the CGNAT IP range. Now, not only you can access your device at home while away using your cellphone, you can also connect to your partner's phone with the same IP address at (or away from) home. Some Internet providers in China…

Easier than what? You mean it can in these special cases become like not having a CGNAT?

> they also make the traffic within the CGNAT free

So.. both data caps and breaking the principle of net neutrality?

Re: Tailscale is pretty useful

#75

Post by oDot »

stego-tech wrote: post #49
iamdamian wrote: post #38

I'm curious to hear well-informed reasons from this crowd for why we can trust Tailscale given the non-self-hosted part of the architecture? Does it come down to Tailnet locks [1], not worrying that Tailscale will be compromised, not worrying that your home network is worth compromising, or something else? [1]: https://tailscale.com/kb/1226/tailnet-lock

Call me Cappy Paranoid, but I fall into the camp of "You should never trust a service provider, ever ," and build infrastructure accordingly; I believe this falls into an extreme interpretation of "zero trust". So while also implementing Tailnet locks and other security measures to constrict traffic flow, I'd also consider going a step further by only permitting server or resource access based on client certificate v…

Yes. The best way to avoid trouble is build redundancies to it, rather than refine the troublesome part to no end

Re: Tailscale is pretty useful

#76

Post by dawnerd »

jaxtracks wrote: post #3

The features here seem to be fairly standard with most the WireGuard based VPNs these days. For example, I use Nord for my use-case which is very similar to the author's. This allows me to rsync my home directory between my laptop, tablet, phone's Termux env, and desktop (all running Linux) to maintain configuration parity and file locality regardless of where I turn these devices on, so long as they have internet. D…

I was all on board with WireGuard myself but couldn’t get smb working reliably. Saw someone say they’re had better performance with tailscale and sure enough I can actually use it. It’s not perfect or anything but quite amazing considering it’s still just WireGuard under the hood. Whatever magic configs they have, good job

Re: Tailscale is pretty useful

#77

Post by huslage »

haswell wrote: post #64
sgc wrote: post #47

Earlier quoted context omitted.

Use headscale: https://headscale.net/stable/

What are the primary downsides of self-hosting this? The top issues that come to mind: 1. Maintaining high availability 2. Dealing with patches/upgrades But I'm also really curious how likely a self-hosted instance is to be an attack vector potentially more dangerous than using something like Tailscale.

You own your attack surface at that point. Tailscale/Headscale is a matchmaker and key broker for the most part, the clients almost always (barring NAT issues) connect directly to one another. The normal security considerations apply as with running any service.

Re: Tailscale is pretty useful

#78

Post by dgacmu »

laidoffamazon wrote: post #23
renewiltord wrote: post #9

Earlier quoted context omitted.

WG is quite fast. Can’t be the limiter. Like this guy I’ve driven 1 G easily on 7950 and Epyc 9654. I think I did 10 G but I can’t recall because at some point I just moved everything local and did 40 G. But I’m sure it would work on CPU on reasonable machine https://old.reddit.com/r/mikrotik/comments/112mo4v/is_there_...

Tailscale is using a user space implementation of WG on my Windows machine for obvious reasons - I am imagining that to be part of the bottleneck.

A very likely culprit is the packet encapsulation changing things for the worse. An informative test would be to tcpdump (wireshark, etc) the packet stream with and without tailscale. Look at packet sizes, etc.

The overhead shouldn't be 15% but there could be some weird interaction with the link MTU for the VPN causing, e.g., smaller packets to be sent with more overhead.

Re: Tailscale is pretty useful

#79

Post by NexRebular »

yamrzou wrote: post #50

Is there an alternative to Tailscale with a lower memory footprint? I wanted to run Tailscale on a small router, but it failed due to out-of-memory (OOM) issues.

Maybe Nebula? You can do one yaml config file with all the certificates and firewall rules making it easy to script device provisioning too.

Re: Tailscale is pretty useful

#80

Post by minton »

jaxtracks wrote: post #3

The features here seem to be fairly standard with most the WireGuard based VPNs these days. For example, I use Nord for my use-case which is very similar to the author's. This allows me to rsync my home directory between my laptop, tablet, phone's Termux env, and desktop (all running Linux) to maintain configuration parity and file locality regardless of where I turn these devices on, so long as they have internet. D…

I had no idea Nord offered that and we’ve used them for years.
Post reply on HN