Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Tailnet Lock

tailscale.com

Post reply on HN
Print view View original

91–100 of 119 posts

Re: Tailnet Lock

#91

Post by leesalminen »

user- wrote: post #90

I have little to no idea what Tailscale does. Is it a VPN like Mullvad? What makes it so special? Ive heard a bit about tailscale networks connecting devices together easily. Is it for your own network only, or can other people access your tailscale devices directly as well? Ie, I host a minecraft server on my linux desktop. Can tailscale help me in the use case of providing an IP to people to connect to it? Or am I…

Tailscale is just fancy software that creates peer to peer encrypted tunnels between your devices using wireguard.

You can think of it as a LAN for all your devices regardless of what network they’re physically connected to.

The default use case of Tailscale is to have a private LAN, just for you, not your friends. This is changing now, though.

Tailscale does as of recently have the ability to do what you’re saying for Minecraft. It’s called Tailscale Funnel. This lets you expose a port on any of your devices to the public internet with a TLS enabled host name.

Another option for your Minecraft server is to use Cloudflare Tunnel. Works great for this kind of thing and is pretty much functionally equivalent to Tailscale Funnel.

Re: Tailnet Lock

#92

Post by linsomniac »

user- wrote: post #90

I have little to no idea what Tailscale does. Is it a VPN like Mullvad? What makes it so special? Ive heard a bit about tailscale networks connecting devices together easily. Is it for your own network only, or can other people access your tailscale devices directly as well? Ie, I host a minecraft server on my linux desktop. Can tailscale help me in the use case of providing an IP to people to connect to it? Or am I…

If you want to host a Minecraft server, ZeroTier is probably better. It has a couple of options that make it easier for third parties to be able to connect including automatically authorizing new connecting nodes, or an option where if you connect to a particular ZeroTier network, anyone with your ZeroTier IPv6 can connect to the corresponding port (I forget their exact name, but it's pretty slick).

Re: Tailnet Lock

#93

Post by bradfitz »

fomine3 wrote: post #85
atonse wrote: post #80

Earlier quoted context omitted.

My guess would have to be that their version is probably deeply integrated with the rest of the product and infra that it doesn’t make sense. Plus there’s the added benefit to their paying customers to know that we have an out if needed. It reduces friction in starting to use the product.

Or their own server is too big for small use so not welcomed by selfhoster, like Bitwarten/Vaultwarden case.

Yeah, that's probably very true. Our main coordination server should probably get easier to run (for our on-prem customers and our various country-specific instances we run) but Headscale is far ahead of Tailscale's on just being easy to run.

Re: Tailnet Lock

#94

Post by xeonmc »

leesalminen wrote: post #91
user- wrote: post #90

I have little to no idea what Tailscale does. Is it a VPN like Mullvad? What makes it so special? Ive heard a bit about tailscale networks connecting devices together easily. Is it for your own network only, or can other people access your tailscale devices directly as well? Ie, I host a minecraft server on my linux desktop. Can tailscale help me in the use case of providing an IP to people to connect to it? Or am I…

Tailscale is just fancy software that creates peer to peer encrypted tunnels between your devices using wireguard. You can think of it as a LAN for all your devices regardless of what network they’re physically connected to. The default use case of Tailscale is to have a private LAN, just for you, not your friends. This is changing now, though. Tailscale does as of recently have the ability to do what you’re saying f…

Does either Funnel or Tunnel allow this use case for old UDP-based games like Quake etc?

I would like to just be able to send strangers a temporary permalink to my server for a one-off session, then turn it off or have it expire automatically once we're finished. This would not be feasible if I have to also ask whomever I come across to install clients, as opposed to just connecting from within the game.

Re: Tailnet Lock

#95

Post by dkjaudyeqooe »

unshavedyak wrote: post #34

For basic tunneling into home servers, is Tailnet.. overkill? Ie i could expose my IP via Dyn DNS, or i could use something like Cloudflare or Tailnet to tunnel into the network. However.. i'm not sure what the right fit is. Would you recommend Tailnet for someone who just wants to expose some internal IPs to the public in a safe way? Tunneling compared to Dyn DNS at least has the advantage of more security via reduc…

> i could expose my IP via Dyn DNS

Not if your IP is behind CGNAT or the like.

> $10/m seems a bit steep

They have a free multi-user plan but it's in small print on the pricing page and requires use of Github for user management.

Re: Tailnet Lock

#96

Post by atonse »

TheFlyingFish wrote: post #28
ohbtvz wrote: post #12

Why is there a post by tailscale on the front page every single day?

Obviously "every single day" is hyperbole, but I agree with you that a much higher proportion of Tailscale blog posts end up on the front page than most corporate blogs. Finally I think it comes down to this: Tailscale is full of the same kind of people who tend to hang out on Hackernews. HN loves Tailscale because Tailscale is HN's ingroup. Fly.io is in a similar situation, and similarly sees a higher-than-average f…

Excellent counterexample. I think they made a huge mistake by not only sticking to their guns on telemetry, but also building a terminal client that you need to log in to even to use it.

I remember opening it, seeing a GitHub login page and instantly closing it.

It just seemed so tone deaf.

Re: Tailnet Lock

#97

Post by telotortium »

xeonmc wrote: post #94
leesalminen wrote: post #91

Earlier quoted context omitted.

Tailscale is just fancy software that creates peer to peer encrypted tunnels between your devices using wireguard. You can think of it as a LAN for all your devices regardless of what network they’re physically connected to. The default use case of Tailscale is to have a private LAN, just for you, not your friends. This is changing now, though. Tailscale does as of recently have the ability to do what you’re saying f…

Does either Funnel or Tunnel allow this use case for old UDP-based games like Quake etc? I would like to just be able to send strangers a temporary permalink to my server for a one-off session, then turn it off or have it expire automatically once we're finished. This would not be feasible if I have to also ask whomever I come across to install clients, as opposed to just connecting from within the game.

Seems like they're only TCP, unfortunately.

Re: Tailnet Lock

#98

Post by SadTrombone »

jchw wrote: post #78
ukd1 wrote: post #70

Earlier quoted context omitted.

Did you ever use Zero Tier before?

I tried, but I couldn't get it to work at all. I don't really know what I was doing wrong, it just hung without connecting. It's been a while and I haven't tried since.

Same. Tailscale just worked out of the box on all my devices. ZeroTier had issues connecting which I didn't bother troubleshooting because Tailscale just worked.

Re: Tailnet Lock

#99

Post by orthoxerox »

teaearlgraycold wrote: post #45

At this point I have no idea why HN cares so much about a VPN company, but I’m too afraid to ask.

Tailscale is a zero-friction VPN. You just install it on every machine, login on every machine and you get your own private network that just works. When I click on one of the machines in the admin console, I get a list of things it takes care of: "Varies" (Whether the machine is behind a difficult NAT that varies the machine’s IP address depending on the destination), Hairpinning, IPv6, UDP, UPnP, PCP, NAT-PMP. I don't even know what some of them mean, I thought PCP was something to get high on.

I run it on every device I own, plus a few at my parents' place. This way I can access my PC and my NAS from my phone, and my NAS from my PC, even though the NAS is behind my home router and the PC and the phone can be connected to a bunch of different networks.

Re: Tailnet Lock

#100

Post by dvzk »

akerl_ wrote: post #66
fragmede wrote: post #30

Earlier quoted context omitted.

One option is don't . Run tailscaled inside a container with host network access, that way you can connect to the host, but it doesn't have the ability (unless it escapes the container) to write (ssh) keys.

I think y’all are talking about different things; the parent comment seems to be talking about injecting additional keys into the tailnet (basically, letting other devices communicate inside your Wireguard VPN).

That's actually the point of this feature. Before, the key distribution server could add unauthenticated Wireguard nodes to your peer list. Now, the tailnet administrator can tell Tailscale nodes to reject new peer public keys unless the key is cryptographically signed by a trusted node. If you don't trust the implementation, wait until it's audited, I guess.
Post reply on HN