4 ms·

Wireguard is pretty much half of what you'd expect from a VPN. It does the low-level part (encryption, packetization, session setup, NAT traversal, etc. -- the

Wireguard is pretty much half of what you'd expect from a VPN. It does the low-level part (encryption, packetization, session setup, NAT traversal, etc. -- the “actual VPN”) brilliantly, but everything around key distribution is left to external systems. (Tailscale is a popular choice, but by no means the only one.) E.g., you can't connect to vpn.example.com with user foo and password bar and that's it; there needs to be an Ed25519 public/private keypair set up on both sides, an IP address range (essentially a routing table), and so on. Of course, if you want to connect two static networks, wg-quick is all you need. But for the typical “remote worker VPN”, it's pretty much a (great) building block.

netr0ute 5y ago
> but everything around key distribution is left to external systems. That's what I'd like, since authentication is usually a pain to set up and with Wireguard, there's none to be done. This also means it's totally stateless and is great for mobile devices where a connection might be broken and crsated again frequently.
nemosaltat 5y ago
I’ve been begrudgingly using Tailscale because it’s so damn simple, but hate that I have to authenticate through Google. I recently noticed they’ve added a “sign in with GitHub option,” but I don’t see any easy way to migrate my account (and nodes). Many of the clients are PiHoles I’ve sent off to my family as gifts, so physical access is a PITA. The only way I’ve found to reliably clear the Tailscale settings is to `apt purge Tailscale`, which would cause me to lose Tailscale SSH access. Looking at the hassle of the remote reinstall- I’m thinking to SSH in with Tailscale, then establish a reverse SSH tunnel to maintain remote access - I think I may finally give Innernet [0] a go. [0] https://github.com/tonarino/innernet https://github.com/tonarino/innernet
- Serow225 5y ago
  You can also use Microsoft now (both "personal" accounts like used for Xbox/Outlook and "Enterprise" accounts like Microsoft365 and other AAD based accounts) I'm sure if you asked them about switching auth methods they would help with that.
  - nemosaltat 5y ago
    That’s a good point. I’ve sent them an email and I’ll see what they say. EDIT: since I’m still in the edit window, here’s what Tailscale came back with (great response time!). >We can fairly easily switch between auth providers where the usernames are an email address, like Microsoft or Google or Okta. >For GitHub the username is different, GitHub uses your Profile name. Any email addresses associated with your GitHub profile are not available. >Unfortunately there isn't a straightforward way to migrate an existing Tailnet with its devices from Google to GitHub. We generally recommend making a new Tailnet with GitHub and re-authenticate devices using GitHub one at a time. For remote devices, this is more challenging. >If you want to try it, a suggestion: 1. you can create a Reusable authkey at https://login.tailscale.com/admin/settings/authkeys https://login.tailscale.com/admin/settings/authkeys for the new GitHub Tailnet 2. Over ssh to a node currently on the Google Tailnet, you can: `tailscale up --force-reauth --authkey=tskey-0123456789abcdef` 3. You'll lose the SSH session. The device will make a new Node key and be issued a new IP address on the new GitHub Tailnet. 4. You can look up its new IP address on https://login.tailscale.com/admin/machines https://login.tailscale.com/admin/machines of the GitHub Tailnet, and should be able to ssh to the new address.

netr0ute 5y ago

> but everything around key distribution is left to external systems. That's what I'd like, since authentication is usually a pain to set up and with Wireguard, there's none to be done. This also means it's totally stateless and is great for mobile devices where a connection might be broken and crsated again frequently.

nemosaltat 5y ago

I’ve been begrudgingly using Tailscale because it’s so damn simple, but hate that I have to authenticate through Google. I recently noticed they’ve added a “sign in with GitHub option,” but I don’t see any easy way to migrate my account (and nodes). Many of the clients are PiHoles I’ve sent off to my family as gifts, so physical access is a PITA. The only way I’ve found to reliably clear the Tailscale settings is to `apt purge Tailscale`, which would cause me to lose Tailscale SSH access. Looking at the hassle of the remote reinstall- I’m thinking to SSH in with Tailscale, then establish a reverse SSH tunnel to maintain remote access - I think I may finally give Innernet [0] a go. [0] https://github.com/tonarino/innernet https://github.com/tonarino/innernet

Serow225 5y ago
You can also use Microsoft now (both "personal" accounts like used for Xbox/Outlook and "Enterprise" accounts like Microsoft365 and other AAD based accounts) I'm sure if you asked them about switching auth methods they would help with that.
- nemosaltat 5y ago
  That’s a good point. I’ve sent them an email and I’ll see what they say. EDIT: since I’m still in the edit window, here’s what Tailscale came back with (great response time!). >We can fairly easily switch between auth providers where the usernames are an email address, like Microsoft or Google or Okta. >For GitHub the username is different, GitHub uses your Profile name. Any email addresses associated with your GitHub profile are not available. >Unfortunately there isn't a straightforward way to migrate an existing Tailnet with its devices from Google to GitHub. We generally recommend making a new Tailnet with GitHub and re-authenticate devices using GitHub one at a time. For remote devices, this is more challenging. >If you want to try it, a suggestion: 1. you can create a Reusable authkey at https://login.tailscale.com/admin/settings/authkeys https://login.tailscale.com/admin/settings/authkeys for the new GitHub Tailnet 2. Over ssh to a node currently on the Google Tailnet, you can: `tailscale up --force-reauth --authkey=tskey-0123456789abcdef` 3. You'll lose the SSH session. The device will make a new Node key and be issued a new IP address on the new GitHub Tailnet. 4. You can look up its new IP address on https://login.tailscale.com/admin/machines https://login.tailscale.com/admin/machines of the GitHub Tailnet, and should be able to ssh to the new address.