3 ms·

While perhaps less portable (and a bit more proprietary) it's worth checking out the new project of Avery Pennarun, better known as apenwarr -- the creator of s

While perhaps less portable (and a bit more proprietary) it's worth checking out the new project of Avery Pennarun, better known as apenwarr -- the creator of sshuttle -- which has made the rounds here, Tailscale [0]. I've switched all my devices to it and frankly, it's wonderful. Private VPN, tunnel, VLAN, auth, sharing, all-in-one. 0: https://tailscale.com https://tailscale.com

linsomniac 6y ago
Can I ask why you chose Tailscale over the alternatives? I've been looking at that spectrum of products and Tailscale does look nice. One thing I can't get over is that it's pricing is "per user". That makes sense our user-oriented VPNs (dev workstations, home machines, and phones), but doesn't feel like it's oriented towards server use. My end use case is probably 80% securing server connectivity across sites. Alternatives I've looked at include: ZeroTier, Slack Nebula, OpenVPN Cloud, and PriTunl. ATM, I'm using ZeroTier for my home use and quite happy with it. I had hopes of being able to deploy something for work as well, which is why I leaned towards ZeroTier. For home use, TailScale's pricing wasn't a concern.
- 3np 6y ago
  I’m considering something like this as well and my two current contenders are Nebula and ZeroTier. Would you say there’s and specific reason you singled out ZeroTier and is there anything you miss?
  - linsomniac 6y ago
    Nebula looks great for server-to-server connections for things like administrative management/control or the like. The fact that it's fully free means we wouldn't have to deal with licensing, unfortunately I can find it hard to get approval for licensing and purchasing. I like ZeroTier because: It was dead simple to set up, the web management UI is good, the "public" networks seemed like they might be nice for CI/CD servers to connect into some infrastructure to deploy (though that didn't work out because CI/CD docker didn't have flags allowing ZeroTier to work, but I did just get SSH over userspace ZeroTier working). It's super easy to set up in all the environments I've looked at.
- nine_k 6y ago
  For one, ZeroTier does not necessarily want to authenticate you via a public OAuth provider. I'd rather not rely on it where not strictly necessary. Then, ZeroTier does have a free tier, with open-source clients for every platform I care about. Yes, they are limited to version 1.x, but maintained nevertheless.
- xyzzy_plugh 6y ago
  I am currently using Tailscale just within the free "Solo" pricing tier, so cost has not been an issue. Compared to alternatives, it's as close to fire-and-forget as I think you can get. Everything just works, and they've been working hard to keep it that way. The sort of software I like. If you're a larger business, the pricing seems... fine? I don't know what their enterprising pricing is like, but the next-highest tier appears to cap at $10k/yr, which seems like a trivial cost to anyone operating at that scale. Consider also that you don't need to run tailscale on every host -- though you could. Depending on your architecture, a single gateway instance in each VPC could be sufficient. In other words, I could probably scale the two non-enterprise tiers very, very far, at least until you had close to ~500 employees, in which case you probably want to strike a deal for custom support and SAML SSO anyways. Alternatively, at $LAST_JOB we just ran our own OpenVPN servers and in-house beyondcorp authwalls. There was honestly not a lot of complexity in there. We had <3000 employees. > That makes sense our user-oriented VPNs (dev workstations, home machines, and phones), but doesn't feel like it's oriented towards server use. Just to be clear, you don't pay per-server. Just for logins. > My end use case is probably 80% securing server connectivity across sites. 100% is not by any means an unachievable goal in, say, a quarter or two. Any reason why you don't want that 20% tail?
  - linsomniac 6y ago
    To clarify, I meant 80% of my use is server to server communications, 20% is user to workstation or server use.
    - xyzzy_plugh 6y ago
      Ah that makes a lot more sense. I run tailscale on a subset of my servers, but I use tailscale to talk to all of them. For example, I can use my desktop at home as an exit node for my phone, so I can configure my network hardware (router, switch, AP) from my phone, from anywhere.

linsomniac 6y ago

Can I ask why you chose Tailscale over the alternatives? I've been looking at that spectrum of products and Tailscale does look nice. One thing I can't get over is that it's pricing is "per user". That makes sense our user-oriented VPNs (dev workstations, home machines, and phones), but doesn't feel like it's oriented towards server use. My end use case is probably 80% securing server connectivity across sites. Alternatives I've looked at include: ZeroTier, Slack Nebula, OpenVPN Cloud, and PriTunl. ATM, I'm using ZeroTier for my home use and quite happy with it. I had hopes of being able to deploy something for work as well, which is why I leaned towards ZeroTier. For home use, TailScale's pricing wasn't a concern.

3np 6y ago
I’m considering something like this as well and my two current contenders are Nebula and ZeroTier. Would you say there’s and specific reason you singled out ZeroTier and is there anything you miss?
- linsomniac 6y ago
  Nebula looks great for server-to-server connections for things like administrative management/control or the like. The fact that it's fully free means we wouldn't have to deal with licensing, unfortunately I can find it hard to get approval for licensing and purchasing. I like ZeroTier because: It was dead simple to set up, the web management UI is good, the "public" networks seemed like they might be nice for CI/CD servers to connect into some infrastructure to deploy (though that didn't work out because CI/CD docker didn't have flags allowing ZeroTier to work, but I did just get SSH over userspace ZeroTier working). It's super easy to set up in all the environments I've looked at.
nine_k 6y ago
For one, ZeroTier does not necessarily want to authenticate you via a public OAuth provider. I'd rather not rely on it where not strictly necessary. Then, ZeroTier does have a free tier, with open-source clients for every platform I care about. Yes, they are limited to version 1.x, but maintained nevertheless.
xyzzy_plugh 6y ago
I am currently using Tailscale just within the free "Solo" pricing tier, so cost has not been an issue. Compared to alternatives, it's as close to fire-and-forget as I think you can get. Everything just works, and they've been working hard to keep it that way. The sort of software I like. If you're a larger business, the pricing seems... fine? I don't know what their enterprising pricing is like, but the next-highest tier appears to cap at $10k/yr, which seems like a trivial cost to anyone operating at that scale. Consider also that you don't need to run tailscale on every host -- though you could. Depending on your architecture, a single gateway instance in each VPC could be sufficient. In other words, I could probably scale the two non-enterprise tiers very, very far, at least until you had close to ~500 employees, in which case you probably want to strike a deal for custom support and SAML SSO anyways. Alternatively, at $LAST_JOB we just ran our own OpenVPN servers and in-house beyondcorp authwalls. There was honestly not a lot of complexity in there. We had <3000 employees. > That makes sense our user-oriented VPNs (dev workstations, home machines, and phones), but doesn't feel like it's oriented towards server use. Just to be clear, you don't pay per-server. Just for logins. > My end use case is probably 80% securing server connectivity across sites. 100% is not by any means an unachievable goal in, say, a quarter or two. Any reason why you don't want that 20% tail?
- linsomniac 6y ago
  To clarify, I meant 80% of my use is server to server communications, 20% is user to workstation or server use.
  - xyzzy_plugh 6y ago
    Ah that makes a lot more sense. I run tailscale on a subset of my servers, but I use tailscale to talk to all of them. For example, I can use my desktop at home as an exit node for my phone, so I can configure my network hardware (router, switch, AP) from my phone, from anywhere.