11 ms·

Innernet: open source Rust based Tailscale alternative

265 points by ricklamers 6y ago

tmpfs 6y ago
This look great, thanks for the post and open-sourcing the project. I played around with Wireguard directly and having better ergonomics without vendor lock-in is great, i look forward to taking it for a spin.
davidcollantes 6y ago
Wow, so neat! Thank you for developing this, and open sourcing it.
davidcollantes 6y ago
How name resolution is handled? I am going to play with it tonight, but it isn’t clear how is DNS setup. Is that something completely separated, or integrated on the tool? Thanks!
- bschwindHN 6y ago
  Currently it makes non-destructive edits to /etc/hosts. It would be interesting to explore more scalable ways to handle this for larger networks though.
  - JoshTriplett 6y ago
    You could run a local DNS server using something like https://github.com/bluejekyll/trust-dns https://github.com/bluejekyll/trust-dns . Or, you could install an NSS module to resolve names via the innernet client.
- gorkish 6y ago
  DNS seems to be the weakest point of many of these overlay network products: hamachi, zerotier, tailscale, and probably this one all use some convoluted nonsense despite the fact that split dns mechanics exist out of the box now in Windows, MacOS and Linux.
  - ComputerGuru 6y ago
    Windows does not have a comprehensive solution to split dns. The vpn api hacked on something that resembles that, but the core networking stack doesn’t really support it. Windows Server can be configured to handle split brain DNS but that’s a different matter altogether.
    - tssva 6y ago
      Wouldn't Name Resolution Policy Tables (NRPT) be the comprehensive Windows solution?
      - ComputerGuru 6y ago
        So (the last time I checked) the actual code is there but there are no sanctioned user/developer-visible knobs/APIs to tweak NRPT on client Windows SKUs and only limited configuration specifically limited to the resolution of accepted client DNS requests is available on Windows Server. I believe there is basically a optional network stack path that utilizes NRPT but it’s not the default path, so only MS-blessed code that is actively using NRPT (so the new VPN stack and their DNS server) actually works with it.
        gorkish 6y ago
        NRPT has worked fine for me on regular Win10 clients ever since I first started configuring it about 18 months ago. With the exception of apps like Firefox being configured for DNS-over-HTTP and bypassing the OS resolver entirely, it works in all applications and with all the interstitial resolvers in virtual environments I have had occasion to use (VMware workstation, HyperV, Docker, WSL1/2, etc.)
  - bschwindHN 6y ago
    > split dns mechanics exist out of the box now in Windows, MacOS and Linux Could you elaborate more on what split DNS options are available out of the box on the various systems? I'm genuinely curious what a no-convoluted-nonsense DNS setup looks like for this kind of tool.
imiric 6y ago
This is awesome, thanks for sharing! I really like the simple client/server architecture, that it's easily self-hostable and there are no servers outside of my control. The invite system reminds me of the way Tinc[1] handles it, which is great. It's so good to see user friendly tooling on top of WireGuard. [1]: https://tinc-vpn.org/ https://tinc-vpn.org/
- reddec 6y ago
  I have been working on wrapper around Tinc to simplify setup. Project: https://github.com/reddec/tinc-boot https://github.com/reddec/tinc-boot Article: https://dev.to/reddec/tinc-boot-full-mesh-vpn-without-pain-3lg9 https://dev.to/reddec/tinc-boot-full-mesh-vpn-without-pain-3...
  - JeremyNT 6y ago
    I love this tool a lot! For now tinc still has many advantages over wireguard and this makes managing it a lot simple. Thanks for all your work!
ng28 6y ago
Kudos to the team. Great!
JoshTriplett 6y ago
Just a heads-up: there's an old command-line news program named "inn" that might produce name conflicts for the innernet command-line tool. Fortunately, it sounds like that's just an alias, so people who care about "inn" can just spell out "innernet" or make a different alias themselves.
- clpwn 6y ago
  Thanks for the heads-up. Before adding the alias, I did a quick search (https://packages.ubuntu.com/search?suite=xenial&arch=any&mode=exactfilename&searchon=contents&keywords=inn https://packages.ubuntu.com/search?suite=xenial&arch=any&mod...) and did see the "inn" package, but it didn't seem like it included any "inn" binary that would cause name conflicts. Happy to change the way that alias works if it ends up being a problem.
  - JoshTriplett 6y ago
    Ah, sorry. I checked and saw the cron and init scripts were called "inn", and missed that the binary was called "innd". Nevermind.
emperor_ 6y ago
I’m going to try this because tailscale is extremely slow when you want to fully utilize your bandwidth.
- dijit 6y ago
  I think tailscale uses a userland TUN/TAP interface[0] which negotiates at 10MiB/s; that’ll be the largest bottleneck and likely applies to Innernet too. Tailscale does use considerable CPU on my Mac though. [0]: https://github.com/tailscale/tailscale/blob/main/net/tstun/tun.go https://github.com/tailscale/tailscale/blob/main/net/tstun/t...
  - clpwn 6y ago
    Latency and bandwidth was a big issue for us - innernet uses the WireGuard kernel module on Linux when available, which is about as good as you can get (easily achieving saturated gigabit line speeds). macOS is a different story, since there are only userspace implementations at the moment. Innernet currently looks for the official "wireguard-go" implementation, but you can swap out userspace implementations as you like. I'll add an environment variable check to make that easier without needing to recompile.
ing33k 6y ago
I have been using Tailscale personally on all my machines and it's really cool.. Thanks for creating an OSS version of it ! Request to HN floks : I can setup a basic home network, but I want to really learn networking ( Setting up subnets , understanding CIDR, etc ).. Where should I start ?
- torwayburger 6y ago
  I took a CCNA 200-301 class on udemy to learn all that stuff.
- teleforce 6y ago
  Check this excellent guide by 3COM, Understanding IP Addressing: Everything You Ever Wanted To Know https://pages.di.unipi.it/ricci/501302.pdf https://pages.di.unipi.it/ricci/501302.pdf
- clpwn 6y ago
  I found interactive CIDR visualization tools like https://cidr.xyz/ https://cidr.xyz/ to be very helpful in understanding the notation. I also end up using https://gitlab.com/ipcalc/ipcalc https://gitlab.com/ipcalc/ipcalc a lot, and am definitely planning on similarly making it easier in the terminal to manage and visualize the CIDRs in innernet networks. I'm hoping innernet can become a fun way to learn networking in a safe (and cheap) virtual environment.
- littlestymaar 6y ago
  If you have a lot of free time, Computer Networks By Andrew S. Tanenbaum is top notch.
- JetSpiegel 6y ago
  https://www.davidc.net/sites/default/subnets/subnets.html https://www.davidc.net/sites/default/subnets/subnets.html This is the best subnet calculator, since you can split and join subnets visually.
carabiner 6y ago
What about my e-viruses and e-worms?
- bschwindHN 6y ago
  You can kiss those e-viruses goodbye!
afics 6y ago
This looks great! Is a TCP mode planned? This would be useful for networks where outbound UDP isn't allowed. (hotel wifi, other public wifis) Do you plan to add automatic key rollover/expiry?
- clpwn 6y ago
  Thanks! There aren't any current plans to bake in TCP support, but you can rig it up yourself using something like udptunnel. Related old HN comment with basic instructions: https://news.ycombinator.com/item?id=17847008 https://news.ycombinator.com/item?id=17847008 Also see: the "TCP Mode" section in https://www.wireguard.com/known-limitations/ https://www.wireguard.com/known-limitations/.
  - afics 6y ago
    I know about those. Since the whole point of innernet is making wireguard configuration simpler, I figured maybe integrating something like that is worth doing.
    - clpwn 6y ago
      Ah, gotcha - sorry I misunderstood your question. I feel that adding TCP support would push innernet beyond a WireGuard configuration manager and into something a bit more behemoth. I'm quite fond of the fact that innernet doesn't "touch the packets" in its current state. That said, if a strong need arises over time it's not out of the question, and in the mean time anybody is welcome to add their own wrapper around innernet or fork it to support that.
      - afics 6y ago
        Aye, noted. Do you support the case where nodes can not talk directly to each other and relaying is required?
        clpwn 6y ago
        Not currently, but I'm interested in supporting that.
chaz6 6y ago
I cannot wait to start using this as it looks like it will make vpn's a heck of a lot easier to manage. Here are my two questions: 1. Is it possible to use the same subnet on different innernets? 2. Could you please provide installation instructions for generic linux, as I am looking to host on almalinux and opensuse leap, neither of which use dpkg. Thanks for sharing!
- moviuro 6y ago
  Regarding 1.: no. AllowedIPs in the WireGuard world have the double meaning: * I expect anything coming from that peer to have an IP address in AllowedIPs * I know that a peer's AllowedIPs can only be reached through that specific peer Also, RFC 1918 lists 2^24 + 2^20 + 2^16 = 17 million IPs. You should normally not have an issue finding networks that don't overlap. 10/8, 172.16/12 and 192.168/16 Also, using the same net on different interfaces would probably confuse your server. Maybe if you do some magic with VRFs you could. (And it doesn't mean you should)
- clpwn 6y ago
  > 1. Is it possible to use the same subnet on different innernets? As moviuro mentioned, no, not unless you want to get fancy with independent network namespaces (https://man7.org/linux/man-pages/man8/ip-netns.8.html https://man7.org/linux/man-pages/man8/ip-netns.8.html). If you want to be more confident of not having an address space conflict, I recommend using a randomly generated private IPv6 block using the RFC 4193 specification: https://en.wikipedia.org/wiki/Private_network#Private_IPv6_addresses https://en.wikipedia.org/wiki/Private_network#Private_IPv6_a... > 2. Could you please provide installation instructions for generic linux, as I am looking to host on almalinux and opensuse leap, neither of which use dpkg. Our Arch PKGBUILD (https://aur.archlinux.org/cgit/aur.git/tree/PKGBUILD?h=innernet https://aur.archlinux.org/cgit/aur.git/tree/PKGBUILD?h=inner...) may be the simplest existing guide for making your own package for your distro. If it's not a lot of work to add, I'm happy to maintain other package formats, or help you be a maintainer. Thanks! Looking forward to hearing how it goes for you.
reyman 6y ago
Like @chaz6 i'm really interested by tutorial/docs for example to use software on a RPI4 / nixos as an alternative to Tailscale :)
nindalf 6y ago
Could someone help me out? I understand how Wireguard and Tailscale work. But I don’t understand the various ways they could be used for personal and business use cases apart from a workaround for geoblocking. Could people currently using Tailscale chime in?
- spyke112 6y ago
  I'm using Tailscale for managing an old Mac Mini I have in the office, that does some simple 'cron' tasks. But it's behind NAT, but with Tailscale, I'm able to SSH into the box regardless, which is really nice. I believe it's also possible for instance to have Tailscale running on your servers, and only expose port 22 on the Tailscale interface, which is also quite neat.
- popotamonga 6y ago
  Instead of VPN'ing to the cloud to access my servers i just installed tailscale on one of the vms in the cloud and exposed all the routes. I work on 5 different pcs, no more up and down vpn. The only thing missing from tailscale for me is being logged into multiple accounts at the same time.
- tinco 6y ago
  We don't use Tailscale, but we do run a Wireguard server. It allows our remote workers that need local network access. For example we run an internal kubernetes cluster that is not accessible over the internet. And we also have SMB shares that a remote worker might need to look into. Basically the use of a VPN is to add an extra layer of defense. Instead of finding a security hole in our Kubernetes management interface or samba server, an attacker would first have to compromise a workers system, and only then attack our internal servers.
- jitix 6y ago
  My personal use case for tailscale is to connect my home PC, MacBook Air, Raspberry pi, iPhone, iPad and my VPS into a single network without running a VPN server. The best part is that you don’t have to open any ports on your router and it “just works” out of the box. So even if I’m in a different country I can use the nextcloud app on my phone to connect to my raspberry pi in a secure manner and backup photos, which in turn backs them up to my VPS.
adornedCupcake 6y ago
All these seem nice but I never seem to find one that will interface with rootless nodes, amd link back to wherever my laptop is. There's always a requirement for a kernel module or mounting a new interface. For now I use chisel, but it's a hack and I need to manage addresses and ports manually.
- jeroenhd 6y ago
  Isn't the tool linked at the bottom, Nebula [1], capable of running without root? Personally, I'm not surprised in the slightest that messing with networking requires administrative privileges. I don't really understand the use case for rootless nodes or how they're normally managed, but I can see how those are too niche for most networking software to work with. I've never tried it, but perhaps you van get Innernet to work with the usermode WireGuard client (the one written in Go [2]), that seems to work on Android without any kernel support or root privileges. Innernet is a daemon over the wg command line tool so it might work out of the box? [1]: https://github.com/slackhq/nebula https://github.com/slackhq/nebula [2]: https://git.zx2c4.com/wireguard-go/about/ https://git.zx2c4.com/wireguard-go/about/
- syoc 6y ago
  A userspace implementation would use a lot of battery power on laptops and be less performant. Wireguard is now in the Linux kernel and does not require kernel modules. You will however require root privileges. I don't want an unprivileged user to be able to route all my traffic though some tunnel. Changing system wide routes should require root.
sreeramb93 6y ago
private DNS does not work with tailscale. that means No Block Lists or nextdns.io. if you private dns nameservers, DNS queries are made over plaintext. Magic DNS is not a hard-sell.
codethief 6y ago
Somewhat unrelated but in case anyone from tonari.no is reading this: I've been following your project for some time[0] and would love to know more about it! Please please update your blog more frequently and maybe even upload some demo videos! :) [0]: Ever since someone posted https://news.ycombinator.com/item?id=23540586 https://news.ycombinator.com/item?id=23540586
- bschwindHN 6y ago
  We have some more blog posts planned :) Is there anything in particular you'd like to read about?
  - hypermachine 6y ago
    How to use the same low latency tricks as the Tonari mirror in other applications. E.g. cloud gaming, conference calls
  - codethief 6y ago
    > We have some more blog posts planned :) That's great, looking forward to them! :) > Is there anything in particular you'd like to read about? I'd love to get a better impression of what your setup, well, feels like. Specifically, three UX questions have been going through my mind lately – probably because I've been working from home for far too long haha :( and having a portal like yours would be fantastic! 1) How important, in your experience, is it for people to look (or have the impression of looking) into each other's eyes? What ways have you thought of that could accomplish that? Do you maybe even happen to have a solution? My gut feeling has been that being able to hold eye contact would go a long way towards making people on each side of the portal feel "close" to each other. So if this were possible somehow, his would be a game changer. 2) How would one do conference calls with your setup, UI-wise? (Let's assume for a moment that bandwidth is not a constraint.) 3) What about eye contact (question 1) when there's a group on each side of the "portal"? It seems almost impossible to achieve with a 2D screen.
    - codethief 6y ago
byt3r 6y ago
This is amazing! I've been thinking of writing a system for managing a wireguard network in rust for quite a while now but I'm still happy this popped up. Perhaps it would be nice to expand it into a bigger ecosystem with UI based interfaces for different platforms.
- clpwn 6y ago
  We'd love your help if you're interested in it! Supporting more platforms and making graphical frontends are high on the priority list.
moron4hire 6y ago
This was the name of my hometown ISP back in the late 90s. You see, kids, back in the day, the internet was not ran exclusively by gigantic mega corporations whose only argument against monopoly was "but but but WE wanted to be the monopoly!" Before Walmart pushed out all the mom-and-pop grocery stores, we had mom-and-pop internet service providers, and they didn't have to be called "artisanal" or "organic" to get anyone to care about them.
JackC 6y ago
How does one update an oldschool web admin page to interact with this model? For example, suppose Kermpany had already been up and running for a while with a standard Django website running behind Cloudflare with an admin page at example.com/admin/. Now the things in the blog post have happened, and Kermpany wants to make sure that only machines on the "humans" CIDR can connect to the routes hosted at example.com/admin/. What happens next? Does the admin tool move to a new domain? The manual wireguard solution I know of is to add the example.com IP to the list of AllowedIPs, so the wireguard interface gets used for all requests from the local machine to example.com, and then restrict the /admin/ route in nginx to just the wireguard server's IP. But that takes a lot of bookkeeping and I feel like I'm missing something.
- codethief 6y ago
  I don't think there's another way than the two ways you've already described. IMO, moving the admin tool to a separate domain (and server!) would be the best option here in terms of security. That way, there are clear boundaries and fewer attack vectors and you also don't need to do as much bookkeeping.
hpfr 6y ago
Looks cool! Nebula has mobile apps. Might this be possible for Innernet in some distant future? It seems like no if it needs root.

265 points by ricklamers 6y ago

This look great, thanks for the post and open-sourcing the project. I played around with Wireguard directly and having better ergonomics without vendor lock-in is great, i look forward to taking it for a spin.

davidcollantes 6y ago

Wow, so neat! Thank you for developing this, and open sourcing it.

davidcollantes 6y ago

How name resolution is handled? I am going to play with it tonight, but it isn’t clear how is DNS setup. Is that something completely separated, or integrated on the tool? Thanks!

bschwindHN 6y ago
Currently it makes non-destructive edits to /etc/hosts. It would be interesting to explore more scalable ways to handle this for larger networks though.
- JoshTriplett 6y ago
  You could run a local DNS server using something like https://github.com/bluejekyll/trust-dns https://github.com/bluejekyll/trust-dns . Or, you could install an NSS module to resolve names via the innernet client.
gorkish 6y ago
DNS seems to be the weakest point of many of these overlay network products: hamachi, zerotier, tailscale, and probably this one all use some convoluted nonsense despite the fact that split dns mechanics exist out of the box now in Windows, MacOS and Linux.
- ComputerGuru 6y ago
  Windows does not have a comprehensive solution to split dns. The vpn api hacked on something that resembles that, but the core networking stack doesn’t really support it. Windows Server can be configured to handle split brain DNS but that’s a different matter altogether.
  - tssva 6y ago
    Wouldn't Name Resolution Policy Tables (NRPT) be the comprehensive Windows solution?
    - ComputerGuru 6y ago
      So (the last time I checked) the actual code is there but there are no sanctioned user/developer-visible knobs/APIs to tweak NRPT on client Windows SKUs and only limited configuration specifically limited to the resolution of accepted client DNS requests is available on Windows Server. I believe there is basically a optional network stack path that utilizes NRPT but it’s not the default path, so only MS-blessed code that is actively using NRPT (so the new VPN stack and their DNS server) actually works with it.
      - gorkish 6y ago
        NRPT has worked fine for me on regular Win10 clients ever since I first started configuring it about 18 months ago. With the exception of apps like Firefox being configured for DNS-over-HTTP and bypassing the OS resolver entirely, it works in all applications and with all the interstitial resolvers in virtual environments I have had occasion to use (VMware workstation, HyperV, Docker, WSL1/2, etc.)
- bschwindHN 6y ago
  > split dns mechanics exist out of the box now in Windows, MacOS and Linux Could you elaborate more on what split DNS options are available out of the box on the various systems? I'm genuinely curious what a no-convoluted-nonsense DNS setup looks like for this kind of tool.

imiric 6y ago

This is awesome, thanks for sharing! I really like the simple client/server architecture, that it's easily self-hostable and there are no servers outside of my control. The invite system reminds me of the way Tinc[1] handles it, which is great. It's so good to see user friendly tooling on top of WireGuard. [1]: https://tinc-vpn.org/ https://tinc-vpn.org/

reddec 6y ago
I have been working on wrapper around Tinc to simplify setup. Project: https://github.com/reddec/tinc-boot https://github.com/reddec/tinc-boot Article: https://dev.to/reddec/tinc-boot-full-mesh-vpn-without-pain-3lg9 https://dev.to/reddec/tinc-boot-full-mesh-vpn-without-pain-3...
- JeremyNT 6y ago
  I love this tool a lot! For now tinc still has many advantages over wireguard and this makes managing it a lot simple. Thanks for all your work!

ng28 6y ago

Kudos to the team. Great!

JoshTriplett 6y ago

Just a heads-up: there's an old command-line news program named "inn" that might produce name conflicts for the innernet command-line tool. Fortunately, it sounds like that's just an alias, so people who care about "inn" can just spell out "innernet" or make a different alias themselves.

clpwn 6y ago
Thanks for the heads-up. Before adding the alias, I did a quick search (https://packages.ubuntu.com/search?suite=xenial&arch=any&mode=exactfilename&searchon=contents&keywords=inn https://packages.ubuntu.com/search?suite=xenial&arch=any&mod...) and did see the "inn" package, but it didn't seem like it included any "inn" binary that would cause name conflicts. Happy to change the way that alias works if it ends up being a problem.
- JoshTriplett 6y ago
  Ah, sorry. I checked and saw the cron and init scripts were called "inn", and missed that the binary was called "innd". Nevermind.

emperor_ 6y ago

I’m going to try this because tailscale is extremely slow when you want to fully utilize your bandwidth.

dijit 6y ago
I think tailscale uses a userland TUN/TAP interface[0] which negotiates at 10MiB/s; that’ll be the largest bottleneck and likely applies to Innernet too. Tailscale does use considerable CPU on my Mac though. [0]: https://github.com/tailscale/tailscale/blob/main/net/tstun/tun.go https://github.com/tailscale/tailscale/blob/main/net/tstun/t...
- clpwn 6y ago
  Latency and bandwidth was a big issue for us - innernet uses the WireGuard kernel module on Linux when available, which is about as good as you can get (easily achieving saturated gigabit line speeds). macOS is a different story, since there are only userspace implementations at the moment. Innernet currently looks for the official "wireguard-go" implementation, but you can swap out userspace implementations as you like. I'll add an environment variable check to make that easier without needing to recompile.

ing33k 6y ago

I have been using Tailscale personally on all my machines and it's really cool.. Thanks for creating an OSS version of it ! Request to HN floks : I can setup a basic home network, but I want to really learn networking ( Setting up subnets , understanding CIDR, etc ).. Where should I start ?

torwayburger 6y ago
I took a CCNA 200-301 class on udemy to learn all that stuff.
teleforce 6y ago
Check this excellent guide by 3COM, Understanding IP Addressing: Everything You Ever Wanted To Know https://pages.di.unipi.it/ricci/501302.pdf https://pages.di.unipi.it/ricci/501302.pdf
clpwn 6y ago
I found interactive CIDR visualization tools like https://cidr.xyz/ https://cidr.xyz/ to be very helpful in understanding the notation. I also end up using https://gitlab.com/ipcalc/ipcalc https://gitlab.com/ipcalc/ipcalc a lot, and am definitely planning on similarly making it easier in the terminal to manage and visualize the CIDRs in innernet networks. I'm hoping innernet can become a fun way to learn networking in a safe (and cheap) virtual environment.
littlestymaar 6y ago
If you have a lot of free time, Computer Networks By Andrew S. Tanenbaum is top notch.
JetSpiegel 6y ago
https://www.davidc.net/sites/default/subnets/subnets.html https://www.davidc.net/sites/default/subnets/subnets.html This is the best subnet calculator, since you can split and join subnets visually.

carabiner 6y ago

What about my e-viruses and e-worms?

bschwindHN 6y ago
You can kiss those e-viruses goodbye!

afics 6y ago

This looks great! Is a TCP mode planned? This would be useful for networks where outbound UDP isn't allowed. (hotel wifi, other public wifis) Do you plan to add automatic key rollover/expiry?

clpwn 6y ago
Thanks! There aren't any current plans to bake in TCP support, but you can rig it up yourself using something like udptunnel. Related old HN comment with basic instructions: https://news.ycombinator.com/item?id=17847008 https://news.ycombinator.com/item?id=17847008 Also see: the "TCP Mode" section in https://www.wireguard.com/known-limitations/ https://www.wireguard.com/known-limitations/.
- afics 6y ago
  I know about those. Since the whole point of innernet is making wireguard configuration simpler, I figured maybe integrating something like that is worth doing.
  - clpwn 6y ago
    Ah, gotcha - sorry I misunderstood your question. I feel that adding TCP support would push innernet beyond a WireGuard configuration manager and into something a bit more behemoth. I'm quite fond of the fact that innernet doesn't "touch the packets" in its current state. That said, if a strong need arises over time it's not out of the question, and in the mean time anybody is welcome to add their own wrapper around innernet or fork it to support that.
    - afics 6y ago
      Aye, noted. Do you support the case where nodes can not talk directly to each other and relaying is required?
      - clpwn 6y ago
        Not currently, but I'm interested in supporting that.

chaz6 6y ago

I cannot wait to start using this as it looks like it will make vpn's a heck of a lot easier to manage. Here are my two questions: 1. Is it possible to use the same subnet on different innernets? 2. Could you please provide installation instructions for generic linux, as I am looking to host on almalinux and opensuse leap, neither of which use dpkg. Thanks for sharing!

moviuro 6y ago
Regarding 1.: no. AllowedIPs in the WireGuard world have the double meaning: * I expect anything coming from that peer to have an IP address in AllowedIPs * I know that a peer's AllowedIPs can only be reached through that specific peer Also, RFC 1918 lists 2^24 + 2^20 + 2^16 = 17 million IPs. You should normally not have an issue finding networks that don't overlap. 10/8, 172.16/12 and 192.168/16 Also, using the same net on different interfaces would probably confuse your server. Maybe if you do some magic with VRFs you could. (And it doesn't mean you should)
clpwn 6y ago
> 1. Is it possible to use the same subnet on different innernets? As moviuro mentioned, no, not unless you want to get fancy with independent network namespaces (https://man7.org/linux/man-pages/man8/ip-netns.8.html https://man7.org/linux/man-pages/man8/ip-netns.8.html). If you want to be more confident of not having an address space conflict, I recommend using a randomly generated private IPv6 block using the RFC 4193 specification: https://en.wikipedia.org/wiki/Private_network#Private_IPv6_addresses https://en.wikipedia.org/wiki/Private_network#Private_IPv6_a... > 2. Could you please provide installation instructions for generic linux, as I am looking to host on almalinux and opensuse leap, neither of which use dpkg. Our Arch PKGBUILD (https://aur.archlinux.org/cgit/aur.git/tree/PKGBUILD?h=innernet https://aur.archlinux.org/cgit/aur.git/tree/PKGBUILD?h=inner...) may be the simplest existing guide for making your own package for your distro. If it's not a lot of work to add, I'm happy to maintain other package formats, or help you be a maintainer. Thanks! Looking forward to hearing how it goes for you.

reyman 6y ago

Like @chaz6 i'm really interested by tutorial/docs for example to use software on a RPI4 / nixos as an alternative to Tailscale :)

nindalf 6y ago

Could someone help me out? I understand how Wireguard and Tailscale work. But I don’t understand the various ways they could be used for personal and business use cases apart from a workaround for geoblocking. Could people currently using Tailscale chime in?

spyke112 6y ago
I'm using Tailscale for managing an old Mac Mini I have in the office, that does some simple 'cron' tasks. But it's behind NAT, but with Tailscale, I'm able to SSH into the box regardless, which is really nice. I believe it's also possible for instance to have Tailscale running on your servers, and only expose port 22 on the Tailscale interface, which is also quite neat.
popotamonga 6y ago
Instead of VPN'ing to the cloud to access my servers i just installed tailscale on one of the vms in the cloud and exposed all the routes. I work on 5 different pcs, no more up and down vpn. The only thing missing from tailscale for me is being logged into multiple accounts at the same time.
tinco 6y ago
We don't use Tailscale, but we do run a Wireguard server. It allows our remote workers that need local network access. For example we run an internal kubernetes cluster that is not accessible over the internet. And we also have SMB shares that a remote worker might need to look into. Basically the use of a VPN is to add an extra layer of defense. Instead of finding a security hole in our Kubernetes management interface or samba server, an attacker would first have to compromise a workers system, and only then attack our internal servers.
jitix 6y ago
My personal use case for tailscale is to connect my home PC, MacBook Air, Raspberry pi, iPhone, iPad and my VPS into a single network without running a VPN server. The best part is that you don’t have to open any ports on your router and it “just works” out of the box. So even if I’m in a different country I can use the nextcloud app on my phone to connect to my raspberry pi in a secure manner and backup photos, which in turn backs them up to my VPS.

adornedCupcake 6y ago

All these seem nice but I never seem to find one that will interface with rootless nodes, amd link back to wherever my laptop is. There's always a requirement for a kernel module or mounting a new interface. For now I use chisel, but it's a hack and I need to manage addresses and ports manually.

jeroenhd 6y ago
Isn't the tool linked at the bottom, Nebula [1], capable of running without root? Personally, I'm not surprised in the slightest that messing with networking requires administrative privileges. I don't really understand the use case for rootless nodes or how they're normally managed, but I can see how those are too niche for most networking software to work with. I've never tried it, but perhaps you van get Innernet to work with the usermode WireGuard client (the one written in Go [2]), that seems to work on Android without any kernel support or root privileges. Innernet is a daemon over the wg command line tool so it might work out of the box? [1]: https://github.com/slackhq/nebula https://github.com/slackhq/nebula [2]: https://git.zx2c4.com/wireguard-go/about/ https://git.zx2c4.com/wireguard-go/about/
syoc 6y ago
A userspace implementation would use a lot of battery power on laptops and be less performant. Wireguard is now in the Linux kernel and does not require kernel modules. You will however require root privileges. I don't want an unprivileged user to be able to route all my traffic though some tunnel. Changing system wide routes should require root.

sreeramb93 6y ago

private DNS does not work with tailscale. that means No Block Lists or nextdns.io. if you private dns nameservers, DNS queries are made over plaintext. Magic DNS is not a hard-sell.

codethief 6y ago

Somewhat unrelated but in case anyone from tonari.no is reading this: I've been following your project for some time[0] and would love to know more about it! Please please update your blog more frequently and maybe even upload some demo videos! :) [0]: Ever since someone posted https://news.ycombinator.com/item?id=23540586 https://news.ycombinator.com/item?id=23540586

bschwindHN 6y ago
We have some more blog posts planned :) Is there anything in particular you'd like to read about?
- hypermachine 6y ago
  How to use the same low latency tricks as the Tonari mirror in other applications. E.g. cloud gaming, conference calls
- codethief 6y ago
  > We have some more blog posts planned :) That's great, looking forward to them! :) > Is there anything in particular you'd like to read about? I'd love to get a better impression of what your setup, well, feels like. Specifically, three UX questions have been going through my mind lately – probably because I've been working from home for far too long haha :( and having a portal like yours would be fantastic! 1) How important, in your experience, is it for people to look (or have the impression of looking) into each other's eyes? What ways have you thought of that could accomplish that? Do you maybe even happen to have a solution? My gut feeling has been that being able to hold eye contact would go a long way towards making people on each side of the portal feel "close" to each other. So if this were possible somehow, his would be a game changer. 2) How would one do conference calls with your setup, UI-wise? (Let's assume for a moment that bandwidth is not a constraint.) 3) What about eye contact (question 1) when there's a group on each side of the "portal"? It seems almost impossible to achieve with a 2D screen.
  - codethief 6y ago

byt3r 6y ago

This is amazing! I've been thinking of writing a system for managing a wireguard network in rust for quite a while now but I'm still happy this popped up. Perhaps it would be nice to expand it into a bigger ecosystem with UI based interfaces for different platforms.

clpwn 6y ago
We'd love your help if you're interested in it! Supporting more platforms and making graphical frontends are high on the priority list.

moron4hire 6y ago

This was the name of my hometown ISP back in the late 90s. You see, kids, back in the day, the internet was not ran exclusively by gigantic mega corporations whose only argument against monopoly was "but but but WE wanted to be the monopoly!" Before Walmart pushed out all the mom-and-pop grocery stores, we had mom-and-pop internet service providers, and they didn't have to be called "artisanal" or "organic" to get anyone to care about them.

JackC 6y ago

How does one update an oldschool web admin page to interact with this model? For example, suppose Kermpany had already been up and running for a while with a standard Django website running behind Cloudflare with an admin page at example.com/admin/. Now the things in the blog post have happened, and Kermpany wants to make sure that only machines on the "humans" CIDR can connect to the routes hosted at example.com/admin/. What happens next? Does the admin tool move to a new domain? The manual wireguard solution I know of is to add the example.com IP to the list of AllowedIPs, so the wireguard interface gets used for all requests from the local machine to example.com, and then restrict the /admin/ route in nginx to just the wireguard server's IP. But that takes a lot of bookkeeping and I feel like I'm missing something.

codethief 6y ago
I don't think there's another way than the two ways you've already described. IMO, moving the admin tool to a separate domain (and server!) would be the best option here in terms of security. That way, there are clear boundaries and fewer attack vectors and you also don't need to do as much bookkeeping.

hpfr 6y ago

Looks cool! Nebula has mobile apps. Might this be possible for Innernet in some distant future? It seems like no if it needs root.