3 ms·

Tailscale is the easy solution here. Just wireguard all the individual machines together as required. Scrap the corporate VPN. https://tailscale.com/ https://t

Tailscale is the easy solution here. Just wireguard all the individual machines together as required. Scrap the corporate VPN. https://tailscale.com/ https://tailscale.com/

donmcronald 6y ago
That's a neat solution, but I feel like $10 / user / month is ridiculous for something I can do for free as a traditional VPN. I know everything in Silicon Valley is $10+ per user per month, but they're out of touch with the real world. I deal with tons of small businesses and they complain about spending $5 / month on MS365 for email which is absolutely essential to their business. The idea they're going to be signing up for all these SaaS platforms is crazy to me. On the other side there's enterprise, but if I have 1000 users, why wouldn't I deal with my own infrastructure instead of paying someone $120,000 / year to do it for me? I'm in Canada and you could get 3 decent sysadmins for that.
xyst 6y ago
This looks interesting, thanks for sharing. Will bookmark and read up later. Always looking for these “zero trust” solutions and alternatives to the VPN based authorization
wmf 6y ago
Tailscale is a better VPN but it's still a VPN. Also, I have a feeling that organizations that can't migrate to BeyondCorp won't be able to "wireguard all the individual machines" either; they'd have to use Tailscale gateways which start to look like VPN servers.
- xtacy 6y ago
  I guess the main issue with BeyondCorp-style architecture is that while they work well with apps that mainly use HTTP, but it can be a pain to get them working for plain TCP or UDP-based apps.
- ignoramous 6y ago
  Afaik, Tailscale works very hard to P2P connections and uses the gateway either to punchhole through NATs, or proxy connections in case of hard NATs, or for authz/n.
  - wmf 6y ago
    I'm talking about what they calll "relay nodes" which could easily become a bottleneck: https://tailscale.com/kb/1019/subnets https://tailscale.com/kb/1019/subnets

Tailscale is the easy solution here. Just wireguard all the individual machines together as required. Scrap the corporate VPN. https://tailscale.com/ https://tailscale.com/

donmcronald 6y ago

That's a neat solution, but I feel like $10 / user / month is ridiculous for something I can do for free as a traditional VPN. I know everything in Silicon Valley is $10+ per user per month, but they're out of touch with the real world. I deal with tons of small businesses and they complain about spending $5 / month on MS365 for email which is absolutely essential to their business. The idea they're going to be signing up for all these SaaS platforms is crazy to me. On the other side there's enterprise, but if I have 1000 users, why wouldn't I deal with my own infrastructure instead of paying someone $120,000 / year to do it for me? I'm in Canada and you could get 3 decent sysadmins for that.

xyst 6y ago

This looks interesting, thanks for sharing. Will bookmark and read up later. Always looking for these “zero trust” solutions and alternatives to the VPN based authorization

wmf 6y ago

Tailscale is a better VPN but it's still a VPN. Also, I have a feeling that organizations that can't migrate to BeyondCorp won't be able to "wireguard all the individual machines" either; they'd have to use Tailscale gateways which start to look like VPN servers.

xtacy 6y ago
I guess the main issue with BeyondCorp-style architecture is that while they work well with apps that mainly use HTTP, but it can be a pain to get them working for plain TCP or UDP-based apps.
ignoramous 6y ago
Afaik, Tailscale works very hard to P2P connections and uses the gateway either to punchhole through NATs, or proxy connections in case of hard NATs, or for authz/n.
- wmf 6y ago
  I'm talking about what they calll "relay nodes" which could easily become a bottleneck: https://tailscale.com/kb/1019/subnets https://tailscale.com/kb/1019/subnets