4 ms·

I have been looking for a more user-friendly setup for our company, we're currently using OpenVPN with Viscosity as a client. Tailscale was on the list for ser

I have been looking for a more user-friendly setup for our company, we're currently using OpenVPN with Viscosity as a client. Tailscale was on the list for services to check, but if what you say is true, then I will look elsewhere.

cpach 5y ago
It’s also possible to use Wireguard without Tailscale.
- mikevm 5y ago
  Or https://www.zerotier.com/ https://www.zerotier.com/
arthurcolle 5y ago
I highly recommend you check out ZeroTier. I've found WireGuard setup to be non-trivial and extremely error-prone, but with ZeroTier there's a web UI that you can add new services and machines from, all as one logical "network" I believe that the free tier is capable of running clusters of up to 50 machines. Really nice to use + truly trivial to set up.
- deskamess 5y ago
  Do they integrate with IdP like Okta or do they have MFA? I am looking to qualify RDP access to various systems in the network w/IdP + MFA.
mananaysiempre 5y ago
For a FOSS solution (now that ZeroTier no longer is one), there’s Nebula, but you’ll have to operate your own central node. That’s nothing compared to maintaining the hell that is IPsec or even OpenVPN, though. Even bare Wireguard is a joy to set up, to my endless surprise, if you’re fine administering things as a traditional small-scale LAN, manual routing and all.
- api 5y ago
  We want ZeroTier to be FOSS. We just need to find a way to do that without allowing someone to take and rebrand it and write us out. ZT is vulnerable to this because we actually try to make everything decentralized and self hostable. We are not making a cloud silo play where we try to lock everyone into our hub to do their networking, so we have to be able to monetize by licensing as well as SaaS. Our SaaS is optional. This wasn’t an issue a decade or two ago when existing FOSS licenses were created. It’s an issue now, and is why other people working on decentralized easy to set up systems like CockroachDB use the same license we do. If CockroachDB were liberal FOSS someone would fork it and slap their name on it and scoop them, since by not having to do the hard work of actually developing it they could focus exclusively on marketing. (You can self host ZT controllers, and roots become easier to self host in the next major release. Once we do that the protocol could theoretically outlive the company with no loss of functionality including its unified namespace.)
  - mwcampbell 5y ago
    I think people who insist on FOSS are demanding too much. Your choice of license is very reasonable. Don't let the purists and freeloaders get you down. (No, I don't yet use Zerotier, but maybe I should.) More generally, I like what you said a little while back in the thread about the Mighty remote browser [1]: > (2) The hopelessly naive idea that "information wants to be free" and everything has to be "free" (as in beer) needs to die, be cut into a thousand pieces, burned, encased in concrete, and sunk to the bottom of the ocean. Nothing is free. Software takes a vast amount of labor to produce, and that must be funded. If it's not funded directly and honestly it will be funded indirectly and dishonestly (surveillance capitalism, cloud lock-in, etc.). "Everything has to be free" and piracy actually help push us toward a surveillance capitalist panopticon future. That point should be front and center in all discussions on FOSS sustainability (or lack thereof). [1]: https://news.ycombinator.com/item?id=26970617 https://news.ycombinator.com/item?id=26970617
  - mananaysiempre 5y ago
    It’s not my intention to accuse or condemn you, in that while I do dislike the direction you’ve chosen, I don’t think you are being intentionally or unintentionally malicious. It is also hard not to love the tecnhical work you do and the way you’ve not only struck out in the corporate networking badlands but also taken up the mantle of Hamachi, which has lain unclaimed for way too long. You’re absolutely brilliant (like Cloudflare), your goal does not seem evil (similar to that of Cloudflare), neither do the consequences of achieving it (somewhat less like Cloudflare), and you haven’t done outright evil things like patent clever but fundamentally simple tricks (have I mentioned I’m conflicted about Cloudflare?). And when all is said and done, you do have to pay your bills, and only you can say what works and what does not in that respect. So I applaud you when you say, loudly and honestly, that the goal of your licensing model is to pay for the development by making yourself an essential part of it. I believe you when you say your work couldn’t exist otherwise. But my mental model of (dev– and knowledge-of-humankind–centric) open source (unlike that of user-centered free software) is that its very essence is the original developer making themselves unessential or at least not using legal threats to preserve their special position. Thus I am explicitly not saying that your non-open-source approach is evil—that would be unjustified purism; morality judgments are difficult and best not employed as one-sided proclamations. I am not expecting that you will go home ashamed or mend your dastardly ways, because you have nothing to be ashamed of, your ways are not dastardly, and I have no idea how you could mend them and still survive. I am saying that your non-open-source approach disagrees with the very core of the open source idea as I best understand it, not on a purist technicality but in a fundamental way. Bruce Perens co-founded the OSI. He seems to have given up on the idea of open source in the age of mainframe providers wielding armies of star programmers, and probably would not have any issue with your strategy. I am younger and have not given up yet, so I look upon your strategy with sadness and a longing for a better world. Bruce Perens is much smarter than me in more ways than one.
api 5y ago
You can self host ZeroTier controllers, which are the things that control network access. See the controller subfolder of github.com/zerotier/ZeroTierOne. Roots in ZeroTier are harder to self host right now (it’s getting easier in the future) but they are just dumb STUN/TURN equivalents. They have no power to grant access and can’t even see what networks you join or what you are doing.
gilbertbw 5y ago
For large deployments Tailscale does offer self hosting the coordination server, see https://forum.tailscale.com/t/secure-way-to-use-tailscale-without-injection-risk-of-new-network-members/384/2 https://forum.tailscale.com/t/secure-way-to-use-tailscale-wi...

cpach 5y ago

It’s also possible to use Wireguard without Tailscale.

mikevm 5y ago
Or https://www.zerotier.com/ https://www.zerotier.com/

arthurcolle 5y ago

I highly recommend you check out ZeroTier. I've found WireGuard setup to be non-trivial and extremely error-prone, but with ZeroTier there's a web UI that you can add new services and machines from, all as one logical "network" I believe that the free tier is capable of running clusters of up to 50 machines. Really nice to use + truly trivial to set up.

deskamess 5y ago
Do they integrate with IdP like Okta or do they have MFA? I am looking to qualify RDP access to various systems in the network w/IdP + MFA.

mananaysiempre 5y ago

For a FOSS solution (now that ZeroTier no longer is one), there’s Nebula, but you’ll have to operate your own central node. That’s nothing compared to maintaining the hell that is IPsec or even OpenVPN, though. Even bare Wireguard is a joy to set up, to my endless surprise, if you’re fine administering things as a traditional small-scale LAN, manual routing and all.

api 5y ago
We want ZeroTier to be FOSS. We just need to find a way to do that without allowing someone to take and rebrand it and write us out. ZT is vulnerable to this because we actually try to make everything decentralized and self hostable. We are not making a cloud silo play where we try to lock everyone into our hub to do their networking, so we have to be able to monetize by licensing as well as SaaS. Our SaaS is optional. This wasn’t an issue a decade or two ago when existing FOSS licenses were created. It’s an issue now, and is why other people working on decentralized easy to set up systems like CockroachDB use the same license we do. If CockroachDB were liberal FOSS someone would fork it and slap their name on it and scoop them, since by not having to do the hard work of actually developing it they could focus exclusively on marketing. (You can self host ZT controllers, and roots become easier to self host in the next major release. Once we do that the protocol could theoretically outlive the company with no loss of functionality including its unified namespace.)
- mwcampbell 5y ago
  I think people who insist on FOSS are demanding too much. Your choice of license is very reasonable. Don't let the purists and freeloaders get you down. (No, I don't yet use Zerotier, but maybe I should.) More generally, I like what you said a little while back in the thread about the Mighty remote browser [1]: > (2) The hopelessly naive idea that "information wants to be free" and everything has to be "free" (as in beer) needs to die, be cut into a thousand pieces, burned, encased in concrete, and sunk to the bottom of the ocean. Nothing is free. Software takes a vast amount of labor to produce, and that must be funded. If it's not funded directly and honestly it will be funded indirectly and dishonestly (surveillance capitalism, cloud lock-in, etc.). "Everything has to be free" and piracy actually help push us toward a surveillance capitalist panopticon future. That point should be front and center in all discussions on FOSS sustainability (or lack thereof). [1]: https://news.ycombinator.com/item?id=26970617 https://news.ycombinator.com/item?id=26970617
- mananaysiempre 5y ago
  It’s not my intention to accuse or condemn you, in that while I do dislike the direction you’ve chosen, I don’t think you are being intentionally or unintentionally malicious. It is also hard not to love the tecnhical work you do and the way you’ve not only struck out in the corporate networking badlands but also taken up the mantle of Hamachi, which has lain unclaimed for way too long. You’re absolutely brilliant (like Cloudflare), your goal does not seem evil (similar to that of Cloudflare), neither do the consequences of achieving it (somewhat less like Cloudflare), and you haven’t done outright evil things like patent clever but fundamentally simple tricks (have I mentioned I’m conflicted about Cloudflare?). And when all is said and done, you do have to pay your bills, and only you can say what works and what does not in that respect. So I applaud you when you say, loudly and honestly, that the goal of your licensing model is to pay for the development by making yourself an essential part of it. I believe you when you say your work couldn’t exist otherwise. But my mental model of (dev– and knowledge-of-humankind–centric) open source (unlike that of user-centered free software) is that its very essence is the original developer making themselves unessential or at least not using legal threats to preserve their special position. Thus I am explicitly not saying that your non-open-source approach is evil—that would be unjustified purism; morality judgments are difficult and best not employed as one-sided proclamations. I am not expecting that you will go home ashamed or mend your dastardly ways, because you have nothing to be ashamed of, your ways are not dastardly, and I have no idea how you could mend them and still survive. I am saying that your non-open-source approach disagrees with the very core of the open source idea as I best understand it, not on a purist technicality but in a fundamental way. Bruce Perens co-founded the OSI. He seems to have given up on the idea of open source in the age of mainframe providers wielding armies of star programmers, and probably would not have any issue with your strategy. I am younger and have not given up yet, so I look upon your strategy with sadness and a longing for a better world. Bruce Perens is much smarter than me in more ways than one.

api 5y ago

You can self host ZeroTier controllers, which are the things that control network access. See the controller subfolder of github.com/zerotier/ZeroTierOne. Roots in ZeroTier are harder to self host right now (it’s getting easier in the future) but they are just dumb STUN/TURN equivalents. They have no power to grant access and can’t even see what networks you join or what you are doing.

gilbertbw 5y ago

For large deployments Tailscale does offer self hosting the coordination server, see https://forum.tailscale.com/t/secure-way-to-use-tailscale-without-injection-risk-of-new-network-members/384/2 https://forum.tailscale.com/t/secure-way-to-use-tailscale-wi...