3 ms·

Tailscale runs on WireGuard and therefore requires elevated permissions on each client device. That shouldn't be required for simply proxying a local port. Doe

Tailscale runs on WireGuard and therefore requires elevated permissions on each client device. That shouldn't be required for simply proxying a local port. Does Tailscale offer domain registration and TLS certs? Also, is there any way to allow public access to certain ports on certain machines, ie if you wanted to run your personal blog on your RPi?

xyzzy_plugh 6y ago
I mean I suppose it requires elevated permissions but frankly it doesn't require any more permissions than most software, so this feels like a weird point to pick on. You need elevated permissions to bind 80 and 443, etc., right? You mentioned accessing your own devices from anywhere, and that's what I use Tailscale for. It was a dream to set up, and for my own services, I don't need TLS or custom domains, really. I have a few shortcuts on my phone that work everywhere, Tailscale IPs are static. > Also, is there any way to allow public access to certain ports on certain machines, ie if you wanted to run your personal blog on your RPi? This is sorta outside the scope of what Tailscale aims to solve, but one of the cool things you could do is just run a proxy somewhere publicly accessible and route requests to your RPi.
- anderspitman 6y ago
  > I mean I suppose it requires elevated permissions but frankly it doesn't require any more permissions than most software, so this feels like a weird point to pick on. You need elevated permissions to bind 80 and 443, etc., right? I think maybe you're misunderstanding what my goal is. If I have a local webserver running on my laptop on port 8080, I want to expose that via HTTPS on a public domain. The server that terminates the HTTPS connection needs root to run on port 443, but my laptop doesn't need root to start the upstream webserver on 8080, and it shouldn't need root to tunnel it to the public server either.
  - apenwarr 6y ago
    [Tailscale founder here] If you're using a mac, you can just install Tailscale from the app store, which does not require root (thanks to the "magic" of Apple's extension signing). Another experiment we're doing is integrating a completely userspace network stack, which could someday be good for this: https://twitter.com/bradfitz/status/1301937179636068352 https://twitter.com/bradfitz/status/1301937179636068352
    - anderspitman 6y ago
      I don't use mac. I haven't dug into the WireGuard spec yet, so this might be an ignorant question: Do you think it would be possible to create a client that can talk with WG servers normally, but on the local side it forwards to a specific port, rather than a network interface? That would avoid the root requirement. I'm guessing the answer is no since it sounds like you guys are working on integrating a custom non-WG solution.
papul1993 6y ago
I think there is a userspace version written in Go that shouldn't need root access.
- anderspitman 6y ago
  Unless I'm mistaken, wireguard-go[0] only runs the WireGuard protocol code in userspace rather than the kernel. It still requires configuring network interfaces which requires root. [0]: https://github.com/WireGuard/wireguard-go https://github.com/WireGuard/wireguard-go

xyzzy_plugh 6y ago

I mean I suppose it requires elevated permissions but frankly it doesn't require any more permissions than most software, so this feels like a weird point to pick on. You need elevated permissions to bind 80 and 443, etc., right? You mentioned accessing your own devices from anywhere, and that's what I use Tailscale for. It was a dream to set up, and for my own services, I don't need TLS or custom domains, really. I have a few shortcuts on my phone that work everywhere, Tailscale IPs are static. > Also, is there any way to allow public access to certain ports on certain machines, ie if you wanted to run your personal blog on your RPi? This is sorta outside the scope of what Tailscale aims to solve, but one of the cool things you could do is just run a proxy somewhere publicly accessible and route requests to your RPi.

anderspitman 6y ago
> I mean I suppose it requires elevated permissions but frankly it doesn't require any more permissions than most software, so this feels like a weird point to pick on. You need elevated permissions to bind 80 and 443, etc., right? I think maybe you're misunderstanding what my goal is. If I have a local webserver running on my laptop on port 8080, I want to expose that via HTTPS on a public domain. The server that terminates the HTTPS connection needs root to run on port 443, but my laptop doesn't need root to start the upstream webserver on 8080, and it shouldn't need root to tunnel it to the public server either.
- apenwarr 6y ago
  [Tailscale founder here] If you're using a mac, you can just install Tailscale from the app store, which does not require root (thanks to the "magic" of Apple's extension signing). Another experiment we're doing is integrating a completely userspace network stack, which could someday be good for this: https://twitter.com/bradfitz/status/1301937179636068352 https://twitter.com/bradfitz/status/1301937179636068352
  - anderspitman 6y ago
    I don't use mac. I haven't dug into the WireGuard spec yet, so this might be an ignorant question: Do you think it would be possible to create a client that can talk with WG servers normally, but on the local side it forwards to a specific port, rather than a network interface? That would avoid the root requirement. I'm guessing the answer is no since it sounds like you guys are working on integrating a custom non-WG solution.

papul1993 6y ago

I think there is a userspace version written in Go that shouldn't need root access.

anderspitman 6y ago
Unless I'm mistaken, wireguard-go[0] only runs the WireGuard protocol code in userspace rather than the kernel. It still requires configuring network interfaces which requires root. [0]: https://github.com/WireGuard/wireguard-go https://github.com/WireGuard/wireguard-go