4 ms·

This post is partially plugging https://tailscale.com https://tailscale.com. With everyone looking at remote work, tons of people must be questioning their VPN

This post is partially plugging https://tailscale.com https://tailscale.com. With everyone looking at remote work, tons of people must be questioning their VPN strategy right now. I know we are. I was going to complain that that's a close source product (as I don't want to use something closed source for my network access controls) but it looks like the code is on Github, just not linked in an obvious way from the website. https://github.com/tailscale/tailscale https://github.com/tailscale/tailscale Has anyone used this or checked out the code? I may give it a spin.

Keverw 7y ago
Interesting, kinda reminds me of Nebula by Slack. https://github.com/slackhq/nebula https://github.com/slackhq/nebula - which I hope someday there's a CNI for Podman and Docker. I guess right now you have to run these solutions inside of the same container you want to allow in the network, so have to build it apart of your image... unless maybe you had your own custom base image with the VPN software loaded and just pass in the auth cert info at runtime. However tailscale has a polished UI it looks from the screenshots, maybe meant more for employees to use than using it for all the server to server stuff. I've been playing around with an idea on and off I was planning to use some sorta tech like this but seems like stuff is improving. Like early this year Podman folks are going to adopt a API like Docker instead of Varlink. Varlink seems cool too but I guess not as many people wanted to support it and then no lib for every language or runtime like Node.js, etc. Also even if your own private network, still recommended to encrypt and authenticate internal services talking to each others. but I guess it's like having multiple layers.
gz5 7y ago
A few solutions worth evaluating, especially w/ what is going on right now with the increased demand to securely support remote work: 1. Zscaler ZPA - closed source but from a market leader 2. Palo Alto - subjective if true zero trust but if you already have PA... 3. Akamai - based on a SDP acquisition which had good tech - not sure what Akamai has done with it 4. NetFoundry - both open source and SaaS options 5. Nebula - strengths for east-west microservices. Open source from Slack. 6. Tailscale - listed above. New but open source. 7. Appgate - closed source but nice implementation of the use cases it targets. 8. Illumio - a more mature version of Nebula; also targeted at east-west. 9. Centrify - closed source but solid option for IAM focused use cases. 10. Perimeter81 - not familiar with it but is well regarded. 11. Cloudflare - relatively new solution but leverages their network nicely 12. Duo - certainly was a nice solution - not sure what Cisco has done with it. 13. ZeroTier - not familiar but adding per comments below * Edits - added 11-13 per comments below in attempt to make this a more comprehensive list.
- api 7y ago
  I typically don't shill around here, but why isn't ZeroTier on that list? I suppose we don't have a giant marketing budget (yet). We do have a product used by hundreds of thousands for years and it has microsegmentation and other nifty stuff like multicast. https://www.zerotier.com/ https://www.zerotier.com/ Also not everything on that list is the same. Some of those are app-level gateways, IAM infrastructure, etc. That's a bag of stuff for different use cases. Some of that stuff is also cloud proxy based, not mesh based. Maybe some people don't care but I'm heavily biased toward peer-to-peer mesh. I find it offensively stupid for packets to travel 1000 miles to reach a system next to me or in the same city. Of course I guess everything has a use case. I might opt for a cloud proxy if the bandwidth were low, the users and/or customer were non-technical, and it was all web stuff.
  - nif2ee 7y ago
    > I typically don't shill around here, but why isn't ZeroTier on that list? I suppose we don't have a giant marketing budget (yet). now you know, nothing here is just coincidental, not even the timing the posts are submitted or the type of comments that get quickly upvoted or buried to derail the discussion in a certain direction or even the links injected in comments of popular threads to improve the SEO of some companies and projects. Every, again EVERY, WireGuard post over the past 2 months has instantly converted into a shilling party for this company that literally has no product to offer, its source-code is pre-alpha state yet the party is persistent for every thread, it seems that the owners have really powerful friends all over the place and that's why they're having free ride despite having no product. This recipe for having a popular startup name with no actual product has really worked very well in the easy times of 2014-2020. Let's see how things work out this time
  - 0az 7y ago
    I've been using ZeroTier for a small collection of two devices plus two servers. Honestly, the main pain points I have are UX: Android and Dashboard. Other than that, I have no complaints.
    - api 7y ago
someonehere 7y ago
I can’t figure it out. The pages load and work but it’s horrendous to understand how to get it set up. ZeroTier is much easier to understand and I like it.
sho 7y ago
Woah. I had been kinda trialing Tailscale casually for a little while but I see they've now introduced pricing of USD$10/user/month! That's gonna be a very hard sell for what it offers. I currently handle access via wireguard VLANs and some ruby scripts and it works fine - change is nowhere frequent enough to justify going from $0 to $250+/month just for a little automation. I'd advise Tailscale to rethink their pricing. I'm not averse to paid services at all, but it's pretty hard for me to justify hundreds of dollars a month for "VPN access management software", even to myself.
- sho 7y ago
  I'd like to add a little more productivity to this comment by telling tailscale exactly what I would pay. I ran the numbers - I'd be $310/month for VPN access for my devs and staff. It would be my single most expensive SAAS contract per head. No. Tailscale, if you're listening and are not too drunk on the patio11 "charge more" "i know what i'm worth" kool-aid: I am smack bang in your target market. Small to medium company, appreciative of wireguard, very security conscious, time poor, happy to spend money to make my life easier - but your pricing is ludicrous for what is essentially a VPN config manager. I am not paying USD$10/user/month for google login to a VPN. That's more than I pay for actual GSuite. I have to justify, broadly, what I spend. Can you put yourselves in my shoes? I suggest charging $24.95/m for 1 admin user, with 50 non-admin users free. $50 for 3 admins, 99 for 10, and so on.
jiveturkey 7y ago
Not partially. It is entirely an ad (SEO content) for tailscale. The author is one of the founders. I have to say, disappointed in the author's understanding of zero trust. Microsegmentation and ZT are at odds with each other; one is not a progression to the other. Of course, he has that POV because "his salary depends on it". I rather wish he had coined a new term here: nanosegmentation perhaps. Regardless of accuracy/understanding, tailscale is certainly interesting and perhaps a better (more practical) solution than others -- at small scale. So don't take my criticism as poo-pooing their interesting approach. Rather, I am not pleased with their furthering the widespread differing understandings of zero trust, in service to their own needs. Then again, I'm not a principal in a "zero trust" company, so who am I to say what is fair in love and war.
- apenwarr 7y ago
  I’m also a tailscale founder so perhaps I’m biased :) but I think you are both kinda right. I see zero trust and microsegmentation as two different axes. Zero trust proxies are a way to establish and authenticate an encrypted stream; microsegmentation stops streams from being established except through explicitly permitted (and presumably supposed to be secure) pathways. One enables good things, the other prevents bad things. A good security and connectivity system provides both.

Keverw 7y ago

Interesting, kinda reminds me of Nebula by Slack. https://github.com/slackhq/nebula https://github.com/slackhq/nebula - which I hope someday there's a CNI for Podman and Docker. I guess right now you have to run these solutions inside of the same container you want to allow in the network, so have to build it apart of your image... unless maybe you had your own custom base image with the VPN software loaded and just pass in the auth cert info at runtime. However tailscale has a polished UI it looks from the screenshots, maybe meant more for employees to use than using it for all the server to server stuff. I've been playing around with an idea on and off I was planning to use some sorta tech like this but seems like stuff is improving. Like early this year Podman folks are going to adopt a API like Docker instead of Varlink. Varlink seems cool too but I guess not as many people wanted to support it and then no lib for every language or runtime like Node.js, etc. Also even if your own private network, still recommended to encrypt and authenticate internal services talking to each others. but I guess it's like having multiple layers.

gz5 7y ago

A few solutions worth evaluating, especially w/ what is going on right now with the increased demand to securely support remote work: 1. Zscaler ZPA - closed source but from a market leader 2. Palo Alto - subjective if true zero trust but if you already have PA... 3. Akamai - based on a SDP acquisition which had good tech - not sure what Akamai has done with it 4. NetFoundry - both open source and SaaS options 5. Nebula - strengths for east-west microservices. Open source from Slack. 6. Tailscale - listed above. New but open source. 7. Appgate - closed source but nice implementation of the use cases it targets. 8. Illumio - a more mature version of Nebula; also targeted at east-west. 9. Centrify - closed source but solid option for IAM focused use cases. 10. Perimeter81 - not familiar with it but is well regarded. 11. Cloudflare - relatively new solution but leverages their network nicely 12. Duo - certainly was a nice solution - not sure what Cisco has done with it. 13. ZeroTier - not familiar but adding per comments below * Edits - added 11-13 per comments below in attempt to make this a more comprehensive list.

api 7y ago
I typically don't shill around here, but why isn't ZeroTier on that list? I suppose we don't have a giant marketing budget (yet). We do have a product used by hundreds of thousands for years and it has microsegmentation and other nifty stuff like multicast. https://www.zerotier.com/ https://www.zerotier.com/ Also not everything on that list is the same. Some of those are app-level gateways, IAM infrastructure, etc. That's a bag of stuff for different use cases. Some of that stuff is also cloud proxy based, not mesh based. Maybe some people don't care but I'm heavily biased toward peer-to-peer mesh. I find it offensively stupid for packets to travel 1000 miles to reach a system next to me or in the same city. Of course I guess everything has a use case. I might opt for a cloud proxy if the bandwidth were low, the users and/or customer were non-technical, and it was all web stuff.
- nif2ee 7y ago
  > I typically don't shill around here, but why isn't ZeroTier on that list? I suppose we don't have a giant marketing budget (yet). now you know, nothing here is just coincidental, not even the timing the posts are submitted or the type of comments that get quickly upvoted or buried to derail the discussion in a certain direction or even the links injected in comments of popular threads to improve the SEO of some companies and projects. Every, again EVERY, WireGuard post over the past 2 months has instantly converted into a shilling party for this company that literally has no product to offer, its source-code is pre-alpha state yet the party is persistent for every thread, it seems that the owners have really powerful friends all over the place and that's why they're having free ride despite having no product. This recipe for having a popular startup name with no actual product has really worked very well in the easy times of 2014-2020. Let's see how things work out this time
- 0az 7y ago
  I've been using ZeroTier for a small collection of two devices plus two servers. Honestly, the main pain points I have are UX: Android and Dashboard. Other than that, I have no complaints.
  - api 7y ago

someonehere 7y ago

I can’t figure it out. The pages load and work but it’s horrendous to understand how to get it set up. ZeroTier is much easier to understand and I like it.

sho 7y ago

Woah. I had been kinda trialing Tailscale casually for a little while but I see they've now introduced pricing of USD$10/user/month! That's gonna be a very hard sell for what it offers. I currently handle access via wireguard VLANs and some ruby scripts and it works fine - change is nowhere frequent enough to justify going from $0 to $250+/month just for a little automation. I'd advise Tailscale to rethink their pricing. I'm not averse to paid services at all, but it's pretty hard for me to justify hundreds of dollars a month for "VPN access management software", even to myself.

sho 7y ago
I'd like to add a little more productivity to this comment by telling tailscale exactly what I would pay. I ran the numbers - I'd be $310/month for VPN access for my devs and staff. It would be my single most expensive SAAS contract per head. No. Tailscale, if you're listening and are not too drunk on the patio11 "charge more" "i know what i'm worth" kool-aid: I am smack bang in your target market. Small to medium company, appreciative of wireguard, very security conscious, time poor, happy to spend money to make my life easier - but your pricing is ludicrous for what is essentially a VPN config manager. I am not paying USD$10/user/month for google login to a VPN. That's more than I pay for actual GSuite. I have to justify, broadly, what I spend. Can you put yourselves in my shoes? I suggest charging $24.95/m for 1 admin user, with 50 non-admin users free. $50 for 3 admins, 99 for 10, and so on.

jiveturkey 7y ago

Not partially. It is entirely an ad (SEO content) for tailscale. The author is one of the founders. I have to say, disappointed in the author's understanding of zero trust. Microsegmentation and ZT are at odds with each other; one is not a progression to the other. Of course, he has that POV because "his salary depends on it". I rather wish he had coined a new term here: nanosegmentation perhaps. Regardless of accuracy/understanding, tailscale is certainly interesting and perhaps a better (more practical) solution than others -- at small scale. So don't take my criticism as poo-pooing their interesting approach. Rather, I am not pleased with their furthering the widespread differing understandings of zero trust, in service to their own needs. Then again, I'm not a principal in a "zero trust" company, so who am I to say what is fair in love and war.

apenwarr 7y ago
I’m also a tailscale founder so perhaps I’m biased :) but I think you are both kinda right. I see zero trust and microsegmentation as two different axes. Zero trust proxies are a way to establish and authenticate an encrypted stream; microsegmentation stops streams from being established except through explicitly permitted (and presumably supposed to be secure) pathways. One enables good things, the other prevents bad things. A good security and connectivity system provides both.