7 ms·
TailScale – Instantly interconnect your devices and services, wherever they are
- twistiti 7y agoZeroTier is an alternative, free up to 100 devices.
- api 7y agoIts free for unlimited devices if you run your own network controller, which is not that hard. Look under controller/ in the github repo.
- Multicomp 7y agoI wonder if Tailscale will offer something similar? I don't know the lift cost to do a 'sharealike' network controller but perhaps if it is not burdening their network more than a line in a DB somewhere, they might be willing to do something similar.
- jonathanoliver 7y ago+1 for ZT. It's been an awesome service.
- ss3000 7y agoZeroTier is also open-source. If TailScale isn't then I personally wouldn't even consider it a competitor.
- wscott 7y agoAs much as I love ZT they actually dropped the GPL license a couple months ago, but they do publish source.
- Nullabillity 7y agoOr Nebula?
- kenrose 7y agoAvery Pennarun is one of the founders (aka apenwarr.ca). Avery’s one of the most knowledgeable folks about TCP I know and has been building virtual networks of all kinds 20+ years. Congrats on the launch!
- crawshaw 7y agoFunnily enough this one isn't built on TCP. This overlay network uses WireGuard which moves packets over UDP. I guess Avery has had enough TCP for a while. :) (Tailscale cofounder here.)
- rsync 7y ago"Avery Pennarun is one of the founders (aka apenwarr.ca). Avery’s one of the most knowledgeable folks about TCP I know and has been building virtual networks of all kinds 20+ years." I really appreciate his (imo) inspired work on 'sshuttle'[1] which he no longer maintains. I really wish this project would get the attention and development it deserves... [1] https://github.com/sshuttle/sshuttle https://github.com/sshuttle/sshuttle
- apenwarr 7y agoAs far as I know, the person who took over maintaining sshuttle does a pretty good job - it still works well today on more platforms than ever. However, I've been thinking that the sshuttle model doesn't completely keep up with the way the world has been going since I first wrote it ~10 years ago. There's a lot more stuff in the cloud now! And you want to be connected to multiple locations, not just a single location, because your team's resources tend to be scattered over many locations. Tailscale is a more modern approach based on a similar philosophy: minimizing setup time and complexity, while relying on an existing mature layer for the cryptography part so we can't screw it up. (And yes, it's funny trying to argue both sides in a thread where I'm competing with myself :))
- caseymarquis 7y agoSo, is this basically a service which simulates a managed VPN, but establishes secure P2P connections between devices to maximize throughput? If so, I'm very curious about pricing.
- apenwarr 7y agoYes, it uses point-to-point connections and there's no VPN server to install. We're still figuring our pricing, but for now you can try it out for free if you put your name on the waiting list. -- a person who did not expect our site to hit HN quite so soon
- NetOpWibby 7y agoHaha, congrats! I’m loving the web design, feels...comfortable? Idk, I like it.
- atonse 7y agoThis looks really awesome (glad it’s based on WireGuard). Can’t wait to try it out and use something like this for our infrastructure.
- atonse 7y agoHow would this work, would your servers run as sort of the wireguard ”server?” Also would we be able to connect a pure wireguard client too? (For my router but probably not needed)
- crawshaw 7y agoInstall the software on each machine you want in the network, servers and clients. Any machine in your network can connect to any other machine when it wants to send a packet. The protocol is pure wireguard, but it's a little tricky to generate direct configs for it from the Tailscale network, for various reasons I really should write up in a blog post. (Tailscale cofounder.)
- akerl_ 7y agoHow are connections handled if both devices are behind NAT?
- crawshaw 7y agoWe adapt the tricks from RFC 8445 to WireGuard so two nodes behind NAT routers can find each other.
- namibj 7y agoThanks for this. I was planning a similar setup with udpspeeder and possibly an anycast core with fallback to e.g. iodine if the network is that broken. This was motivated by things like to ~80% downstream packet loss my grandma's DOCSIS 3 link had (likely due to bad wiring in her apartment complex, as DVB-C was similarly impacted), which broke things _hard_. I quickly went to dialing aria2c way up in powerpill for archlinux package upgrades. Other times I have dual/triple/quadruple homed hosts (to be fair, I won't have the quad-homed host for a while, because it's dual-provider LTE + wifi + 1000BASE-T, LTE + 2.4G wifi + 5G wifi + 1000BASE-T, or some other dual-mode wireless that will require hacking two cards into the laptop and for wifi also getting a 2.4 vs. 5.8 diplexer so the cards can share the same antennas without interfering with each other too much.
- Multicomp 7y agoThis concept seems interesting and I want to know more. Unfortunately, I'm getting a large amount of friction trying to join your newsletter. Why do I get a reCAPTCHA to 'verify I'm human' if I've already typed my email in, then clicked the confirmation link? I have uBO and noscript to stop most sites trying to get me to enter my email into their modals, but for the site I actually want I'm being pushed through unnecessary hoops...dang you mailchip.
- crawshaw 7y agoSorry about that. You can email us directly if you like: info@tailscale.com
- Multicomp 7y agoYour offer is kind; I was more griping about MC not liking any user that doesn't use an un-VPNed connection or running a non-Chrome browser. I worked my way through the captchas and after a few rounds it let me in. I am curious - does MC give you insight as to why it captchas certain users?
- apenwarr 7y agoA few people have been asking about Raspberry Pi support. We don't exactly "support" it yet but we can send an armv7 binary for you to play with if you ask after signing up. I'm told it works for, say, streaming a home webcam directly to your phone :)
- prox 7y agoThis definitely looks like a product that could be great in raspberry dev projects and other situations that benefit from a direct mesh network!
- dfcarney 7y ago(Co-founder here) https://motion-project.github.io/ https://motion-project.github.io/ made it really easy for me to setup a webcam on my Raspberry Pi. Accessing that using HTTP over WireGuard (via Tailscale) from my iPhone when out of the house was one of those "delight and amaze" moments.
- TKAB 7y agoIs this manly for businesses or would I also benefit from it in a private (family, alone) setting?
- crawshaw 7y agoOur focus has been business so far, but I use it for my personal home network. I would like to explore other uses.
- _Codemonkeyism 7y agoHow does it relate to ZeroTier (which I currently use for a lot of things, lately to connect to my NextCloud from my phone)
- rbinv 7y agoSomewhat off-topic, but I found it funny that the logo dots animate differently (within the SVG) on each page view.
- akerl_ 7y agoLooking at your site, I’m confused by two of the features: It says “Zero trust” and “Identity via SSO”. Given that the WireGuard protocol operates on keypairs, if I’m identifying via SSO, what system is converting my authorization into a keypair? How are existing devices in my network gaining my public key to communicate with me? The description of “Zero trust” given also doesn’t really align with the actual definition of zero trust ( https://en.m.wikipedia.org/wiki/Zero_Trust https://en.m.wikipedia.org/wiki/Zero_Trust ); the description talks about device visibility.
- dfcarney 7y ago(Co-founder here) We integrate with existing identity providers (for instance, GSuite, Okta, Ping, AD) to perform authentication and generate keypairs. Public keys are shared via a coordination server (and each device's private keys never leave it). There's an (optional) additional layer of authorization required in which an admin reviews the endpoints asking to connect. A combination of user and machine certificates makes it possible to ensure that both the users and machines are managed properly. So, basically, we're enabling the "enforcement" side of identity and policy management at the networking layer, with visibility into users and their devices. I hope this helps! Please keep the questions coming.
- akerl_ 7y agoI’m still trying to square the concept of “zero trust” here. The private keys never leave my devices, but the TailScale service is responsible for distributing public keys (which is what makes network access possible between my new system and another system). If I’m understanding correctly: I open the TailScale app on my device, and auth to the TailScale platform using SSO. My device makes a private key, and sends my public key to TailScale. In the default mode, the TailScale platform gives me back the pub keys for other devices in my network, and gives my pub key to those devices. In the optional mode, an admin has to go into the TailScale platform UI and approve my device. If that’s correct, in both modes, TailScale could compromise my traffic by making their own keypair and doing the pub key sharing process. Because it’s TailScale that’s responsible for validating my SSO before accepting my pubkey, and it’s the TailScale platform admin interface that’s responsible for deciding that an admin approved my device (if that feature is enabled), TailScale can just inject their own pubkey into my network. Am I missing something? Because that would be the opposite of “zero trust”.
- mbn12 7y ago- If both devices are under a NAT the packets flow relayed through a server? (or in cases where direct connection can be established somehow) - And if direct connection is available (both in the same LAN) the flow is direct? (reducing latency) If yes, is this done automatically? If I'm not mistaken this what Logmein Hamachi does. I experience low lat/high speed in the LAN and in a few cases high latency in some devices (due the "relayed mode"), when direct link is not established. Good part is that it seamless for the end user... best case is found automatically and transparently.
- antpls 7y agoJust by my understanding after reading the front page, it means I can ssh into my Android phone (on LTE) from a desktop computer from another location. Since most mobile network providers block listening to sockets on the phone, server applications (to the internet) cannot be hosted on mobile phones. Does it mean Tailscale app always run in the background and keeps an active connection to Tailscale servers? Wouldnt it negatively impact the battery of the phone?